cdk-local 0.153.2 → 0.154.0

package/dist/{local-studio-DCTVck5l.js → local-studio-CJfNARFz.js}

@@ -1,11 +1,13 @@
-import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-BSdu45mc.js";
-import { a as setEmbedConfig, r as getEmbedConfig, t as getLogger } from "./logger-CwFXOD1w.js";
+import { C as sanitizeServiceExceptionMessage, S as isAwsServiceException, _ as resolveAssemblyPath, a as isDockerClientEnvKey, b as describeCredentialLoadFailure, c as runDockerStreaming, d as absoluteAssemblyPathEscape, f as assemblyPathEscape, g as renderAssemblyPathEscape, h as namesTheSameDirectory, i as getDockerCmd, l as spawnStreaming, m as isPasteableCommandArg, n as finchSecretArgvRefusal, o as isMalformedEnvKey, p as displayUntrustedValue, r as formatDockerLoginError, s as runDockerForeground, u as warnFinchArgvExposure, v as clampErrorName, w as stringifyThrown, x as flattenToOneLine, y as describeAwsFailureForWarn } from "./docker-cmd-CoZdbeos.js";
+import { a as displayIdent, c as getEmbedConfig, i as STACK_REF_MAX_CODE_POINTS, o as displayStackName, s as displayToolOutput, t as getLogger, u as setEmbedConfig } from "./logger-Co5XVwco.js";
 import { chmodSync, cpSync, createWriteStream, existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import * as path$1 from "node:path";
 import path, { basename, dirname, isAbsolute, join, normalize, relative, resolve, sep } from "node:path";
-import { Command, Option } from "commander";
+import { Command, InvalidArgumentError, Option } from "commander";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
+import * as nodeCrypto from "node:crypto";
+import { X509Certificate, createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { Agent, createServer, request } from "node:http";
 import { Agent as Agent$1, createServer as createServer$1, request as request$1 } from "node:https";
 import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
@@ -24,12 +26,11 @@ import { GetFunctionConfigurationCommand, LambdaClient } from "@aws-sdk/client-l
 import { BedrockAgentCoreControlClient, GetAgentRuntimeCommand } from "@aws-sdk/client-bedrock-agentcore-control";
 import { execFile, spawn } from "node:child_process";
 import { connect, createServer as createServer$2 } from "node:net";
+import { StringDecoder } from "node:string_decoder";
 import { promisify } from "node:util";
-import * as nodeCrypto from "node:crypto";
-import { X509Certificate, createHash, createHmac, createPublicKey, createVerify, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
 import { readFile } from "fs/promises";
-import { join as join$1 } from "path";
+import { basename as basename$1, dirname as dirname$1, join as join$1 } from "path";
 import { WebSocket, WebSocketServer } from "ws";
 import { Readable } from "node:stream";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -674,14 +675,14 @@ function parseAssumeRoleToken(raw, previous) {
 	const eqIndex = raw.indexOf("=");
 	if (eqIndex === -1) {
 		const bare = raw.trim();
-		if (!isIamRoleArn(bare)) throw new Error(`Invalid --assume-role value "${raw}": expected an IAM role ARN like arn:aws:iam::123456789012:role/MyRole, or LogicalId=<arn>.`);
+		if (!isIamRoleArn(bare)) throw new InvalidArgumentError(`Invalid --assume-role value "${raw}": expected an IAM role ARN like arn:aws:iam::123456789012:role/MyRole, or LogicalId=<arn>.`);
 		acc.globalArn = bare;
 		return acc;
 	}
 	const logicalId = raw.substring(0, eqIndex).trim();
 	const arn = raw.substring(eqIndex + 1).trim();
-	if (!/^[A-Za-z][A-Za-z0-9]*$/.test(logicalId)) throw new Error(`Invalid --assume-role value "${raw}": left-hand side "${logicalId}" must be a CloudFormation logical ID (alphanumeric, leading letter).`);
-	if (!isIamRoleArn(arn)) throw new Error(`Invalid --assume-role value "${raw}": right-hand side "${arn}" must be an IAM role ARN like arn:aws:iam::123456789012:role/MyRole.`);
+	if (!/^[A-Za-z][A-Za-z0-9]*$/.test(logicalId)) throw new InvalidArgumentError(`Invalid --assume-role value "${raw}": left-hand side "${logicalId}" must be a CloudFormation logical ID (alphanumeric, leading letter).`);
+	if (!isIamRoleArn(arn)) throw new InvalidArgumentError(`Invalid --assume-role value "${raw}": right-hand side "${arn}" must be an IAM role ARN like arn:aws:iam::123456789012:role/MyRole.`);
 	acc.perLambda[logicalId] = arn;
 	return acc;
 }
@@ -1160,23 +1161,106 @@ function resolveCdkPathToLogicalIds(input, index) {
 		cdkPath
 	}));
 }
+function stackForConstructPath(path, stacks) {
+	let best;
+	let bestRank = -1;
+	for (const s of stacks) {
+		const names = [[s.displayName, 1], [s.stackName, 0]];
+		for (const [name, preference] of names) {
+			if (typeof name !== "string" || name.length === 0) continue;
+			if (!path.startsWith(`${name}/`)) continue;
+			const rank = name.length * 2 + preference;
+			if (rank > bestRank) {
+				best = s;
+				bestRank = rank;
+			}
+		}
+	}
+	return best;
+}
+function stackForPathFormTarget(parsed, target, stacks) {
+	if (!parsed.isPath || parsed.pathOrId !== target) return void 0;
+	return stackForConstructPath(parsed.pathOrId, stacks);
+}
 
 //#endregion
 //#region src/cli/stack-matcher.ts
 function matchStacks(stacks, patterns) {
 	if (patterns.length === 0) return [];
-	const seen = /* @__PURE__ */ new Set();
-	const result = [];
-	for (const stack of stacks) if (patterns.some((pattern) => stackMatchesPattern(stack, pattern)) && !seen.has(stack.stackName)) {
-		seen.add(stack.stackName);
-		result.push(stack);
+	const selected = /* @__PURE__ */ new Set();
+	for (const pattern of patterns) for (const stack of stacksForPattern(stacks, pattern)) selected.add(stack);
+	return stacks.filter((s) => selected.has(s));
+}
+function stacksForPattern(stacks, pattern) {
+	const byId = stacks.filter((s) => pathGlobMatches(pattern, s.displayName ?? s.stackName));
+	return byId.length > 0 ? byId : stacks.filter((s) => s.stackName === pattern);
+}
+function describeStack(stack) {
+	const name = displayUntrustedValue(stack.stackName);
+	if (stack.displayName && stack.displayName !== stack.stackName) return `${name} (${displayUntrustedValue(stack.displayName)})`;
+	return name;
+}
+function describeStacks(stacks) {
+	return stacks.map(describeStack).join(", ");
+}
+function selectTargetStack(parsed, target, stacks) {
+	if (parsed.stackPattern === null) return stacks.length === 1 ? {
+		kind: "found",
+		stack: stacks[0]
+	} : { kind: "no-prefix" };
+	const byPrefix = stackForPathFormTarget(parsed, target, stacks);
+	if (byPrefix) return {
+		kind: "found",
+		stack: byPrefix
+	};
+	const matched = matchStacks([...stacks], [parsed.stackPattern]);
+	if (matched.length === 1) return {
+		kind: "found",
+		stack: matched[0]
+	};
+	if (matched.length === 0) return {
+		kind: "not-found",
+		pattern: parsed.stackPattern
+	};
+	return {
+		kind: "ambiguous",
+		pattern: parsed.stackPattern,
+		matched
+	};
+}
+function candidateTargetStack(parsed, target, stacks) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	return selection.kind === "found" ? selection.stack : void 0;
+}
+function globMatches(pattern, subject) {
+	const segments = pattern.split("*");
+	if (segments.length === 1) return pattern === subject;
+	const head = segments[0];
+	const tail = segments[segments.length - 1];
+	if (subject.length < head.length + tail.length) return false;
+	if (!subject.startsWith(head) || !subject.endsWith(tail)) return false;
+	const end = subject.length - tail.length;
+	let cursor = head.length;
+	for (let i = 1; i < segments.length - 1; i++) {
+		const segment = segments[i];
+		if (segment === "") continue;
+		const at = subject.indexOf(segment, cursor);
+		if (at === -1 || at + segment.length > end) return false;
+		cursor = at + segment.length;
 	}
-	return result;
+	return true;
 }
-function stackMatchesPattern(stack, pattern) {
-	const target = pattern.includes("/") ? stack.displayName ?? stack.stackName : stack.stackName;
-	if (pattern.includes("*")) return new RegExp("^" + pattern.replace(/\*/g, ".*") + "$").test(target);
-	return target === pattern;
+function pathGlobMatches(pattern, subject) {
+	const p = pattern.split("/");
+	const s = subject.split("/");
+	let can = s.map(() => false).concat(true);
+	for (let i = p.length - 1; i >= 0; i--) {
+		const next = new Array(s.length + 1).fill(false);
+		if (p[i] === "**") for (let j = s.length; j >= 0; j--) next[j] = can[j] || j < s.length && next[j + 1];
+		else for (let j = 0; j < s.length; j++) next[j] = can[j + 1] && globMatches(p[i], s[j]);
+		can = next;
+	}
+	return can[0];
 }
 
 //#endregion
@@ -1472,7 +1556,7 @@ function resolveLambdaArchitecture(props, logicalId) {
 		const first = arches[0];
 		if (first === "arm64") return "arm64";
 		if (first === "x86_64") return "x86_64";
-		throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has unsupported Architectures value '${String(first)}'. ${getEmbedConfig().cliName} supports x86_64 and arm64.`);
+		throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has unsupported Architectures value ${displayIdent(String(first))}. ${getEmbedConfig().cliName} supports x86_64 and arm64.`);
 	}
 	return "x86_64";
 }
@@ -1511,7 +1595,7 @@ function parseTarget(target) {
 function resolveLambdaTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalInvokeResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseTarget(target);
-	const stack = pickStack$5(parsed, stacks);
+	const stack = pickStack$5(parsed, stacks, target);
 	const template = stack.template;
 	const resources = template.Resources ?? {};
 	let match;
@@ -1519,7 +1603,7 @@ function resolveLambdaTarget(target, stacks) {
 		const index = buildCdkPathIndex(template);
 		const lambdaMatches = resolveCdkPathToLogicalIds(parsed.pathOrId, index).filter(({ logicalId }) => resources[logicalId]?.Type === "AWS::Lambda::Function");
 		if (lambdaMatches.length === 0) throw notFoundError$3(target, stack, resources);
-		if (lambdaMatches.length > 1) throw new LocalInvokeResolutionError(`Target '${target}' matches ${lambdaMatches.length} Lambda functions in ${stack.stackName}: ` + lambdaMatches.map((m) => m.logicalId).join(", ") + ". Refine the path or use the stack:LogicalId form.");
+		if (lambdaMatches.length > 1) throw new LocalInvokeResolutionError(`Target '${target}' matches ${lambdaMatches.length} Lambda functions in ${displayStackName(stack.stackName)}: ` + lambdaMatches.map((m) => displayIdent(m.logicalId, { listMember: true })).join(", ") + ". Refine the path or use the stack:LogicalId form.");
 		const m = lambdaMatches[0];
 		match = {
 			logicalId: m.logicalId,
@@ -1535,20 +1619,19 @@ function resolveLambdaTarget(target, stacks) {
 	}
 	const { logicalId, resource } = match;
 	if (resource.Type !== "AWS::Lambda::Function") {
-		if (resource.Type.startsWith("Custom::")) throw new LocalInvokeResolutionError(`Resource '${logicalId}' in ${stack.stackName} is a Custom Resource (${resource.Type}), not a Lambda function. Custom Resources are invoked by the deploy framework, not by users. If you want to test the underlying handler, target the ServiceToken Lambda directly.`);
-		throw new LocalInvokeResolutionError(`Resource '${logicalId}' in ${stack.stackName} is ${resource.Type}, not a Lambda function. ${getEmbedConfig().cliName} only invokes AWS::Lambda::Function resources.`);
+		if (resource.Type.startsWith("Custom::")) throw new LocalInvokeResolutionError(`Resource ${displayIdent(logicalId)} in ${displayStackName(stack.stackName)} is a Custom Resource (${displayIdent(resource.Type)}), not a Lambda function. Custom Resources are invoked by the deploy framework, not by users. If you want to test the underlying handler, target the ServiceToken Lambda directly.`);
+		throw new LocalInvokeResolutionError(`Resource ${displayIdent(logicalId)} in ${displayStackName(stack.stackName)} is ${displayIdent(resource.Type)}, not a Lambda function. ${getEmbedConfig().cliName} only invokes AWS::Lambda::Function resources.`);
 	}
 	return extractLambdaProperties(stack, logicalId, resource, resources);
 }
-function pickStack$5(parsed, stacks) {
-	if (parsed.stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		throw new LocalInvokeResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
+function pickStack$5(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new LocalInvokeResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new LocalInvokeResolutionError(`Stack '${selection.pattern}' not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new LocalInvokeResolutionError(`Stack pattern '${selection.pattern}' matched ${selection.matched.length} stacks: ` + describeStacks(selection.matched) + ". Use a more specific pattern, or the stack's display path (path form).");
 	}
-	const matched = matchStacks(stacks, [parsed.stackPattern]);
-	if (matched.length === 0) throw new LocalInvokeResolutionError(`Stack '${parsed.stackPattern}' not found. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
-	if (matched.length > 1) throw new LocalInvokeResolutionError(`Stack pattern '${parsed.stackPattern}' matched ${matched.length} stacks: ` + matched.map((s) => s.stackName).join(", ") + ". Use a more specific pattern.");
-	return matched[0];
 }
 function extractLambdaProperties(stack, logicalId, resource, resources) {
 	const props = resource.Properties ?? {};
@@ -1569,8 +1652,8 @@ function extractLambdaProperties(stack, logicalId, resource, resources) {
 	});
 	const runtime = typeof props["Runtime"] === "string" ? props["Runtime"] : "";
 	const handler = typeof props["Handler"] === "string" ? props["Handler"] : "";
-	if (!runtime) throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has no Runtime property and no Code.ImageUri. ${getEmbedConfig().productName} cannot tell if this is a ZIP or a container Lambda.`);
-	if (!handler) throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has no Handler property.`);
+	if (!runtime) throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has no Runtime property and no Code.ImageUri. ${getEmbedConfig().productName} cannot tell if this is a ZIP or a container Lambda.`);
+	if (!handler) throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has no Handler property.`);
 	const inlineCode = typeof code["ZipFile"] === "string" ? code["ZipFile"] : void 0;
 	let codePath = null;
 	if (!inlineCode) codePath = resolveAssetCodePath$1(stack, logicalId, resource, { allowZip: true });
@@ -1599,7 +1682,7 @@ function extractEphemeralStorageMb(props, logicalId) {
 	const size = raw["Size"];
 	if (typeof size !== "number") return;
 	if (!Number.isFinite(size) || size < 1) return void 0;
-	if (size > 10240) throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has Properties.EphemeralStorage.Size = ${size} MiB, which exceeds the AWS limit of 10240 MiB. AWS would reject the function at deploy time; cap the value to <= 10240 (10 GiB) and retry.`);
+	if (size > 10240) throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has Properties.EphemeralStorage.Size = ${size} MiB, which exceeds the AWS limit of 10240 MiB. AWS would reject the function at deploy time; cap the value to <= 10240 (10 GiB) and retry.`);
 	return Math.floor(size);
 }
 function extractImageUri$1(value, logicalId, stackName, resources, region) {
@@ -1613,10 +1696,10 @@ function extractImageUri$1(value, logicalId, stackName, resources, region) {
 			const pseudoParameters = derivePseudoParametersFromRegion(region);
 			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
-			if (joinResolved.kind === "needs-state") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — deploy the stack first (so ${getEmbedConfig().productName} records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
-			if (joinResolved.kind === "unsupported-join") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. ${getEmbedConfig().cliName} recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
+			if (joinResolved.kind === "needs-state") throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} in ${displayStackName(stackName)} references same-stack ECR repository ${displayIdent(joinResolved.repoLogicalId)} via Fn::Join. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — deploy the stack first (so ${getEmbedConfig().productName} records the repository physical id), rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
+			if (joinResolved.kind === "unsupported-join") throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} in ${displayStackName(stackName)} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. ${getEmbedConfig().cliName} recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
 			const accountIdHint = pseudoParameters ? ` (likely \${AWS::AccountId}, which ${getEmbedConfig().productName} cannot derive without --from-state or STS)` : ` (${getEmbedConfig().productName} could not derive AWS pseudo parameters because stack.region was undefined)`;
-			throw new LocalInvokeResolutionError(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that ${getEmbedConfig().cliName} cannot resolve${accountIdHint}. Workarounds: deploy first and run with --from-state, or pin a fully-literal public image URI.`);
+			throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} in ${displayStackName(stackName)} has an Fn::Join Code.ImageUri that ${getEmbedConfig().cliName} cannot resolve${accountIdHint}. Workarounds: deploy first and run with --from-state, or pin a fully-literal public image URI.`);
 		}
 	}
 }
@@ -1804,13 +1887,13 @@ function parseZipUnixModes(bytes) {
 function resolveSafeZipEntryPath(root, entry) {
 	const dest = normalize(join(root, entry));
 	const rootWithSep = root.endsWith(sep) ? root : root + sep;
-	if (dest !== root && !dest.startsWith(rootWithSep)) throw new LocalInvokeResolutionError(`Refusing to extract a Lambda ZIP asset entry that escapes the target dir: '${entry}'.`);
+	if (dest !== root && !dest.startsWith(rootWithSep)) throw new LocalInvokeResolutionError(`Refusing to extract a Lambda ZIP asset entry that escapes the target dir: ${displayUntrustedValue(entry)}.`);
 	return dest;
 }
 function resolveLambdaLayers(stack, logicalId, props) {
 	const layers = props["Layers"];
 	if (layers === void 0) return [];
-	if (!Array.isArray(layers)) throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has a non-array Layers property. Expected an array of LayerVersion references.`);
+	if (!Array.isArray(layers)) throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has a non-array Layers property. Expected an array of LayerVersion references.`);
 	if (layers.length === 0) return [];
 	const resources = stack.template.Resources ?? {};
 	const out = [];
@@ -1818,7 +1901,7 @@ function resolveLambdaLayers(stack, logicalId, props) {
 		const entry = layers[i];
 		if (typeof entry === "string") {
 			const parsed = parseLayerVersionArn(entry);
-			if (!parsed) throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has a Layers entry [${i}] ${getEmbedConfig().productName} cannot resolve locally: literal string '${entry}'. Expected a same-stack Ref / Fn::GetAtt to an AWS::Lambda::LayerVersion OR a literal layer-version ARN of the form arn:<partition>:lambda:<region>:<account>:layer:<name>:<version>, whose partition agrees with its region.`);
+			if (!parsed) throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has a Layers entry [${i}] ${getEmbedConfig().productName} cannot resolve locally: literal string ${displayUntrustedValue(entry)}. Expected a same-stack Ref / Fn::GetAtt to an AWS::Lambda::LayerVersion OR a literal layer-version ARN of the form arn:<partition>:lambda:<region>:<account>:layer:<name>:<version>, whose partition agrees with its region.`);
 			out.push({
 				kind: "arn",
 				logicalId: parsed.arn,
@@ -1827,10 +1910,10 @@ function resolveLambdaLayers(stack, logicalId, props) {
 			continue;
 		}
 		const layerLogicalId = pickLayerLogicalId(entry);
-		if (!layerLogicalId) throw new LocalInvokeResolutionError(`Lambda '${logicalId}' has a Layers entry [${i}] ${getEmbedConfig().productName} cannot resolve locally: ${describeLayerEntry(entry)}. Expected a same-stack Ref / Fn::GetAtt to an AWS::Lambda::LayerVersion OR a literal layer-version ARN of the form arn:<partition>:lambda:<region>:<account>:layer:<name>:<version>, whose partition agrees with its region.`);
+		if (!layerLogicalId) throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} has a Layers entry [${i}] ${getEmbedConfig().productName} cannot resolve locally: ${describeLayerEntry(entry)}. Expected a same-stack Ref / Fn::GetAtt to an AWS::Lambda::LayerVersion OR a literal layer-version ARN of the form arn:<partition>:lambda:<region>:<account>:layer:<name>:<version>, whose partition agrees with its region.`);
 		const layerResource = resources[layerLogicalId];
-		if (!layerResource) throw new LocalInvokeResolutionError(`Lambda '${logicalId}' Layers entry [${i}] references '${layerLogicalId}', but no resource with that logical ID exists in stack '${stack.stackName}'.`);
-		if (layerResource.Type !== "AWS::Lambda::LayerVersion") throw new LocalInvokeResolutionError(`Lambda '${logicalId}' Layers entry [${i}] references '${layerLogicalId}' (${layerResource.Type}), which is not an AWS::Lambda::LayerVersion.`);
+		if (!layerResource) throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} Layers entry [${i}] references ${displayIdent(layerLogicalId)}, but no resource with that logical ID exists in stack ${displayStackName(stack.stackName)}.`);
+		if (layerResource.Type !== "AWS::Lambda::LayerVersion") throw new LocalInvokeResolutionError(`Lambda ${displayIdent(logicalId)} Layers entry [${i}] references ${displayIdent(layerLogicalId)} (${displayIdent(layerResource.Type)}), which is not an AWS::Lambda::LayerVersion.`);
 		const assetPath = resolveAssetCodePath$1(stack, layerLogicalId, layerResource);
 		out.push({
 			kind: "asset",
@@ -1864,7 +1947,7 @@ function pickLayerLogicalId(entry) {
 	}
 }
 function describeLayerEntry(entry) {
-	if (typeof entry === "string") return `literal ARN '${entry}'`;
+	if (typeof entry === "string") return `literal ARN ${displayUntrustedValue(entry)}`;
 	if (entry === null) return "null";
 	if (typeof entry !== "object") return stringifyValue(entry);
 	try {
@@ -1885,12 +1968,13 @@ function notFoundError$3(target, stack, resources) {
 			logicalId
 		});
 	}
-	let msg = `target '${target}' did not match any Lambda function in ${stack.stackName}.\n\n`;
-	if (lambdas.length === 0) msg += `Stack ${stack.stackName} has no Lambda functions.`;
+	let msg = `target '${target}' did not match any Lambda function in ${displayStackName(stack.stackName)}.\n\n`;
+	if (lambdas.length === 0) msg += `Stack ${displayStackName(stack.stackName)} has no Lambda functions.`;
 	else {
-		const width = Math.max(...lambdas.map((l) => l.displayPath.length));
-		msg += `Available Lambda functions in ${stack.stackName}:\n`;
-		for (const l of lambdas) msg += `  ${l.displayPath.padEnd(width)}  (${l.logicalId})\n`;
+		const rendered = lambdas.map((l) => displayStackName(l.displayPath));
+		const width = Math.max(...rendered.map((p) => p.length));
+		msg += `Available Lambda functions in ${displayStackName(stack.stackName)}:\n`;
+		for (const [idx, l] of lambdas.entries()) msg += `  ${rendered[idx].padEnd(width)}  (${displayIdent(l.logicalId)})\n`;
 	}
 	return new LocalInvokeResolutionError(msg.trimEnd());
 }
@@ -1918,27 +2002,23 @@ var AgentCoreResolutionError = class AgentCoreResolutionError extends Error {
 function resolveAgentCoreTarget(target, stacks, imageContext) {
 	if (stacks.length === 0) throw new AgentCoreResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseTarget(target);
-	const stack = pickStack$4(parsed, stacks);
+	const stack = pickStack$4(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	const { logicalId, resource } = matchRuntime(parsed, target, stack, resources);
-	if (resource.Type !== "AWS::BedrockAgentCore::Runtime") throw new AgentCoreResolutionError(`Resource '${logicalId}' in ${stack.stackName} is ${resource.Type}, not ${AGENTCORE_RUNTIME_TYPE}. ${getEmbedConfig().cliName} invoke-agentcore only runs Bedrock AgentCore Runtime resources.`);
+	if (resource.Type !== "AWS::BedrockAgentCore::Runtime") throw new AgentCoreResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is ${resource.Type}, not ${AGENTCORE_RUNTIME_TYPE}. ${getEmbedConfig().cliName} invoke-agentcore only runs Bedrock AgentCore Runtime resources.`);
 	return extractRuntimeProperties(stack, logicalId, resource, resources, imageContext);
 }
 function pickAgentCoreCandidateStack(target, stacks) {
-	const parsed = parseTarget(target);
-	if (parsed.stackPattern === null) return stacks.length === 1 ? stacks[0] : void 0;
-	const matched = matchStacks(stacks, [parsed.stackPattern]);
-	return matched.length === 1 ? matched[0] : void 0;
+	return candidateTargetStack(parseTarget(target), target, stacks);
 }
-function pickStack$4(parsed, stacks) {
-	if (parsed.stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		throw new AgentCoreResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
+function pickStack$4(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new AgentCoreResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new AgentCoreResolutionError(`Stack '${selection.pattern}' not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new AgentCoreResolutionError(`Stack pattern '${selection.pattern}' matched ${selection.matched.length} stacks: ` + describeStacks(selection.matched) + ". Use a more specific pattern, or the stack's display path (path form).");
 	}
-	const matched = matchStacks(stacks, [parsed.stackPattern]);
-	if (matched.length === 0) throw new AgentCoreResolutionError(`Stack '${parsed.stackPattern}' not found. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
-	if (matched.length > 1) throw new AgentCoreResolutionError(`Stack pattern '${parsed.stackPattern}' matched ${matched.length} stacks: ` + matched.map((s) => s.stackName).join(", ") + ". Use a more specific pattern.");
-	return matched[0];
 }
 function matchRuntime(parsed, target, stack, resources) {
 	if (parsed.isPath) {
@@ -1989,7 +2069,7 @@ function extractJwtAuthorizer(authorizerConfig, logicalId) {
 	const cfg = jwt;
 	const discoveryUrl = cfg["DiscoveryUrl"];
 	if (typeof discoveryUrl !== "string" || discoveryUrl.length === 0) {
-		getLogger().warn(`AgentCore Runtime '${logicalId}' declares a CustomJWTAuthorizer whose DiscoveryUrl is not a literal string; ${getEmbedConfig().cliName} invoke-agentcore cannot verify inbound JWTs against it and will skip auth.`);
+		getLogger().warn(`AgentCore Runtime ${displayIdent(logicalId)} declares a CustomJWTAuthorizer whose DiscoveryUrl is not a literal string; ${getEmbedConfig().cliName} invoke-agentcore cannot verify inbound JWTs against it and will skip auth.`);
 		return;
 	}
 	const toStringArray = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string") : void 0;
@@ -2016,7 +2096,7 @@ function extractCustomClaims(raw, logicalId) {
 		const matchObj = e["AuthorizingClaimMatchValue"];
 		if (typeof name !== "string" || name.length === 0) continue;
 		if (valueType !== "STRING" && valueType !== "STRING_ARRAY") {
-			getLogger().warn(`AgentCore Runtime '${logicalId}' CustomClaims entry '${name}' has unsupported InboundTokenClaimValueType '${String(valueType)}' (expected STRING / STRING_ARRAY); skipping.`);
+			getLogger().warn(`AgentCore Runtime ${displayIdent(logicalId)} CustomClaims entry ${displayIdent(name)} has unsupported InboundTokenClaimValueType ${displayIdent(String(valueType))} (expected STRING / STRING_ARRAY); skipping.`);
 			continue;
 		}
 		if (!matchObj || typeof matchObj !== "object" || Array.isArray(matchObj)) continue;
@@ -2024,7 +2104,7 @@ function extractCustomClaims(raw, logicalId) {
 		const operator = m["ClaimMatchOperator"];
 		const matchValue = m["ClaimMatchValue"];
 		if (operator !== "EQUALS" && operator !== "CONTAINS" && operator !== "CONTAINS_ANY") {
-			getLogger().warn(`AgentCore Runtime '${logicalId}' CustomClaims entry '${name}' has unsupported ClaimMatchOperator '${String(operator)}' (expected EQUALS / CONTAINS / CONTAINS_ANY); skipping.`);
+			getLogger().warn(`AgentCore Runtime ${displayIdent(logicalId)} CustomClaims entry ${displayIdent(name)} has unsupported ClaimMatchOperator ${displayIdent(String(operator))} (expected EQUALS / CONTAINS / CONTAINS_ANY); skipping.`);
 			continue;
 		}
 		if (!matchValue || typeof matchValue !== "object" || Array.isArray(matchValue)) continue;
@@ -2041,7 +2121,7 @@ function extractCustomClaims(raw, logicalId) {
 			if (typeof s === "string" && s.length > 0) value = s;
 		}
 		if (value === void 0) {
-			getLogger().warn(`AgentCore Runtime '${logicalId}' CustomClaims entry '${name}' has no usable MatchValueString / MatchValueStringList for operator ${operator}; skipping.`);
+			getLogger().warn(`AgentCore Runtime ${displayIdent(logicalId)} CustomClaims entry ${displayIdent(name)} has no usable MatchValueString / MatchValueStringList for operator ${operator}; skipping.`);
 			continue;
 		}
 		out.push({
@@ -2055,21 +2135,21 @@ function extractCustomClaims(raw, logicalId) {
 }
 function extractProtocol(value, logicalId, stackName) {
 	if (value === void 0 || value === null) return AGENTCORE_HTTP_PROTOCOL;
-	if (typeof value !== "string") throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} has a non-string ProtocolConfiguration. ${getEmbedConfig().cliName} invoke-agentcore supports the ${SUPPORTED_AGENTCORE_PROTOCOLS.join(" / ")} protocols.`);
-	if (!SUPPORTED_AGENTCORE_PROTOCOLS.includes(value)) throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} uses the ${value} protocol. ${getEmbedConfig().cliName} invoke-agentcore supports the ${SUPPORTED_AGENTCORE_PROTOCOLS.join(" / ")} protocols.`);
+	if (typeof value !== "string") throw new AgentCoreResolutionError(`AgentCore Runtime ${displayIdent(logicalId)} in ${stackName} has a non-string ProtocolConfiguration. ${getEmbedConfig().cliName} invoke-agentcore supports the ${SUPPORTED_AGENTCORE_PROTOCOLS.join(" / ")} protocols.`);
+	if (!SUPPORTED_AGENTCORE_PROTOCOLS.includes(value)) throw new AgentCoreResolutionError(`AgentCore Runtime ${displayIdent(logicalId)} in ${stackName} uses the ${value} protocol. ${getEmbedConfig().cliName} invoke-agentcore supports the ${SUPPORTED_AGENTCORE_PROTOCOLS.join(" / ")} protocols.`);
 	return value;
 }
 function extractArtifact(artifact, logicalId, stackName, resources, region, imageContext) {
-	if (!artifact || typeof artifact !== "object" || Array.isArray(artifact)) throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} has no AgentRuntimeArtifact.`);
+	if (!artifact || typeof artifact !== "object" || Array.isArray(artifact)) throw new AgentCoreResolutionError(`AgentCore Runtime ${displayIdent(logicalId)} in ${stackName} has no AgentRuntimeArtifact.`);
 	const art = artifact;
 	if (art["CodeConfiguration"] && !art["ContainerConfiguration"]) return {
 		kind: "code",
 		codeArtifact: extractCodeArtifact(art["CodeConfiguration"], logicalId, stackName)
 	};
 	const container = art["ContainerConfiguration"];
-	if (!container || typeof container !== "object" || Array.isArray(container)) throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} has no ContainerConfiguration in its AgentRuntimeArtifact.`);
+	if (!container || typeof container !== "object" || Array.isArray(container)) throw new AgentCoreResolutionError(`AgentCore Runtime ${displayIdent(logicalId)} in ${stackName} has no ContainerConfiguration in its AgentRuntimeArtifact.`);
 	const uri = resolveImageUri(container["ContainerUri"], logicalId, stackName, resources, region, imageContext);
-	if (uri === void 0) throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} has a ContainerConfiguration.ContainerUri that ${getEmbedConfig().cliName} invoke-agentcore cannot resolve. v1 resolves a literal image URI, an Fn::Sub asset URI (the fromAsset / Dockerfile path), an imported-ECR Fn::Join, and a same-stack AWS::ECR::Repository Fn::Join under --from-cfn-stack — build the agent as a fromAsset image, or pin a literal / imported ECR image URI.`);
+	if (uri === void 0) throw new AgentCoreResolutionError(`AgentCore Runtime ${displayIdent(logicalId)} in ${stackName} has a ContainerConfiguration.ContainerUri that ${getEmbedConfig().cliName} invoke-agentcore cannot resolve. v1 resolves a literal image URI, an Fn::Sub asset URI (the fromAsset / Dockerfile path), an imported-ECR Fn::Join, and a same-stack AWS::ECR::Repository Fn::Join under --from-cfn-stack — build the agent as a fromAsset image, or pin a literal / imported ECR image URI.`);
 	return {
 		kind: "container",
 		containerUri: uri
@@ -2078,14 +2158,14 @@ function extractArtifact(artifact, logicalId, stackName, resources, region, imag
 function extractCodeArtifact(codeConfig, logicalId, stackName) {
 	const cfg = codeConfig && typeof codeConfig === "object" && !Array.isArray(codeConfig) ? codeConfig : {};
 	const runtime = cfg["Runtime"];
-	if (typeof runtime !== "string" || runtime.length === 0) throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} has a CodeConfiguration with no string Runtime.`);
+	if (typeof runtime !== "string" || runtime.length === 0) throw new AgentCoreResolutionError(`AgentCore Runtime ${displayIdent(logicalId)} in ${stackName} has a CodeConfiguration with no string Runtime.`);
 	const entryPointRaw = cfg["EntryPoint"];
 	const entryPoint = Array.isArray(entryPointRaw) ? entryPointRaw.filter((x) => typeof x === "string") : [];
-	if (entryPoint.length === 0) throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} has a CodeConfiguration with no EntryPoint.`);
+	if (entryPoint.length === 0) throw new AgentCoreResolutionError(`AgentCore Runtime ${displayIdent(logicalId)} in ${stackName} has a CodeConfiguration with no EntryPoint.`);
 	const s3 = cfg["Code"] && typeof cfg["Code"] === "object" ? cfg["Code"]["S3"] : void 0;
 	const s3Obj = s3 && typeof s3 === "object" && !Array.isArray(s3) ? s3 : {};
 	const prefix = s3Obj["Prefix"];
-	if (typeof prefix !== "string" || prefix.length === 0) throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} has a CodeConfiguration whose Code.S3.Prefix is not a literal string. ${getEmbedConfig().cliName} invoke-agentcore needs a literal object key — re-synthesize a fromCodeAsset bundle, or pass a literal bucket + key for a fromS3 bundle.`);
+	if (typeof prefix !== "string" || prefix.length === 0) throw new AgentCoreResolutionError(`AgentCore Runtime ${displayIdent(logicalId)} in ${stackName} has a CodeConfiguration whose Code.S3.Prefix is not a literal string. ${getEmbedConfig().cliName} invoke-agentcore needs a literal object key — re-synthesize a fromCodeAsset bundle, or pass a literal bucket + key for a fromS3 bundle.`);
 	const codeAssetHash = prefix.replace(/^.*\//, "").replace(/\.zip$/, "");
 	const bucket = s3Obj["Bucket"];
 	const versionId = s3Obj["VersionId"];
@@ -2127,7 +2207,7 @@ function resolveImageUri(value, logicalId, stackName, resources, region, imageCo
 		})();
 		const joinResolved = tryResolveImageFnJoin(value, resources, context);
 		if (joinResolved.kind === "resolved") return joinResolved.uri;
-		if (joinResolved.kind === "needs-state") throw new AgentCoreResolutionError(`AgentCore Runtime '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — ` + formatStateRemedy(context) + ", build via Runtime.fromAsset, or pin a literal / imported ECR image URI.");
+		if (joinResolved.kind === "needs-state") throw new AgentCoreResolutionError(`AgentCore Runtime ${displayIdent(logicalId)} in ${stackName} references same-stack ECR repository ${displayIdent(joinResolved.repoLogicalId)} via Fn::Join. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — ` + formatStateRemedy(context) + ", build via Runtime.fromAsset, or pin a literal / imported ECR image URI.");
 	}
 }
 
@@ -2536,13 +2616,13 @@ function applyResponseParameters(base, responseParameters, responseCtx) {
 		}
 		const headerMatch = /^(append|overwrite|remove):header\.(.+)$/i.exec(key);
 		if (!headerMatch || !headerMatch[1] || !headerMatch[2]) {
-			logger.warn(`ResponseParameters: key '${key}' does not match the expected shape '(append|overwrite|remove):header.<name>' or 'overwrite:statuscode'; the value was dropped. Check for typos (e.g. 'appen:' vs 'append:').`);
+			logger.warn(`ResponseParameters: key ${displayIdent(key)} does not match the expected shape '(append|overwrite|remove):header.<name>' or 'overwrite:statuscode'; the value was dropped. Check for typos (e.g. 'appen:' vs 'append:').`);
 			continue;
 		}
 		const op = headerMatch[1].toLowerCase();
 		const name = headerMatch[2].toLowerCase();
 		if (isReservedHeader(name)) {
-			logger.warn(`ResponseParameters: header '${name}' is reserved by API Gateway and was skipped`);
+			logger.warn(`ResponseParameters: header ${displayIdent(name)} is reserved by API Gateway and was skipped`);
 			continue;
 		}
 		if (op === "remove") delete headers[name];
@@ -2650,10 +2730,10 @@ function discoverRoutes(stacks) {
 function discoverRestV1Method(logicalId, resource, template, stackName) {
 	const props = resource.Properties ?? {};
 	const integration = props["Integration"];
-	if (!integration) throw new Error(`${stackName}/${logicalId} (AWS::ApiGateway::Method): missing Integration property`);
+	if (!integration) throw new Error(`${displayStackName(`${stackName}/${logicalId}`)} (AWS::ApiGateway::Method): missing Integration property`);
 	const restApiId = props["RestApiId"];
 	const restApiLogicalId = pickRefLogicalId(restApiId);
-	if (!restApiLogicalId) throw new Error(`${stackName}/${logicalId} (AWS::ApiGateway::Method): RestApiId must be a { Ref: '...' } reference (got ${shortJson$1(restApiId)}).`);
+	if (!restApiLogicalId) throw new Error(`${displayStackName(`${stackName}/${logicalId}`)} (AWS::ApiGateway::Method): RestApiId must be a { Ref: '...' } reference (got ${shortJson$1(restApiId)}).`);
 	const resourceId = props["ResourceId"];
 	const path = buildRestV1Path(resourceId, restApiLogicalId, template, stackName, logicalId);
 	const httpMethod = stringifyValue(props["HttpMethod"] ?? "ANY");
@@ -2745,7 +2825,7 @@ function discoverRestV1Method(logicalId, resource, template, stackName) {
 		method: httpMethod,
 		pathPattern: path,
 		lambdaLogicalId: "",
-		unsupported: { reason: `${stackName}/${logicalId}: unknown REST v1 integration type '${String(integrationType)}' (expected AWS_PROXY / AWS / HTTP / HTTP_PROXY / MOCK).` }
+		unsupported: { reason: `${displayStackName(`${stackName}/${logicalId}`)}: unknown REST v1 integration type ${displayIdent(String(integrationType))} (expected AWS_PROXY / AWS / HTTP / HTTP_PROXY / MOCK).` }
 	}];
 	const integrationUri = integration["Uri"];
 	const arnOutcome = resolveLambdaArnOutcome(integrationUri);
@@ -2754,7 +2834,7 @@ function discoverRestV1Method(logicalId, resource, template, stackName) {
 		method: httpMethod,
 		pathPattern: path,
 		lambdaLogicalId: "",
-		unsupported: { reason: `${stackName}/${logicalId}.Integration.Uri: ${arnOutcome.detail} (got ${shortJson$1(integrationUri)}). Lambda Arn intrinsics on cross-stack / imported references are not resolvable locally; deploy the producer stack and use \`${getEmbedConfig().cliName} invoke --from-state\` shapes if you need it.` }
+		unsupported: { reason: `${displayStackName(`${stackName}/${logicalId}`)}.Integration.Uri: ${arnOutcome.detail} (got ${shortJson$1(integrationUri)}). Lambda Arn intrinsics on cross-stack / imported references are not resolvable locally; deploy the producer stack and use \`${getEmbedConfig().cliName} invoke --from-state\` shapes if you need it.` }
 	}];
 	return [{
 		...baseRoute,
@@ -2804,7 +2884,7 @@ function buildHttpProxyIntegrationConfig(integration, stackName, logicalId) {
 	const uri = integration["Uri"];
 	if (typeof uri !== "string" || uri.length === 0) return {
 		kind: "unsupported",
-		reason: `${stackName}/${logicalId}: HTTP_PROXY Integration.Uri must be a literal string in v1 (${getEmbedConfig().cliName} start-api does not resolve Fn::Sub / Fn::Join in HTTP_PROXY Uris); got ${shortJson$1(uri)}.`
+		reason: `${displayStackName(`${stackName}/${logicalId}`)}: HTTP_PROXY Integration.Uri must be a literal string in v1 (${getEmbedConfig().cliName} start-api does not resolve Fn::Sub / Fn::Join in HTTP_PROXY Uris); got ${shortJson$1(uri)}.`
 	};
 	const integrationHttpMethod = pickStringField(integration, "IntegrationHttpMethod");
 	const requestParameters = pickStringRecord(integration["RequestParameters"]);
@@ -2824,7 +2904,7 @@ function buildHttpIntegrationConfig(integration, stackName, logicalId) {
 	const uri = integration["Uri"];
 	if (typeof uri !== "string" || uri.length === 0) return {
 		kind: "unsupported",
-		reason: `${stackName}/${logicalId}: HTTP Integration.Uri must be a literal string in v1 (${getEmbedConfig().cliName} start-api does not resolve Fn::Sub / Fn::Join in HTTP Uris); got ${shortJson$1(uri)}.`
+		reason: `${displayStackName(`${stackName}/${logicalId}`)}: HTTP Integration.Uri must be a literal string in v1 (${getEmbedConfig().cliName} start-api does not resolve Fn::Sub / Fn::Join in HTTP Uris); got ${shortJson$1(uri)}.`
 	};
 	const integrationHttpMethod = pickStringField(integration, "IntegrationHttpMethod");
 	const requestParameters = pickStringRecord(integration["RequestParameters"]);
@@ -2846,12 +2926,12 @@ function buildAwsIntegrationConfig(integration, stackName, logicalId) {
 	const uri = integration["Uri"];
 	if (!uriContainsLambdaMarker(uri)) return {
 		kind: "unsupported",
-		reason: `${stackName}/${logicalId}: REST v1 AWS integration targeting a non-Lambda service (Uri ${shortJson$1(uri)}) is not emulated locally in ${getEmbedConfig().binaryName} v1. Lambda non-proxy AWS integrations are supported; direct AWS service integrations (S3 / SQS / SNS / DynamoDB) require deploying to AWS. See https://github.com/go-to-k/cdk-local/blob/main/docs/local-emulation.md.`
+		reason: `${displayStackName(`${stackName}/${logicalId}`)}: REST v1 AWS integration targeting a non-Lambda service (Uri ${shortJson$1(uri)}) is not emulated locally in ${getEmbedConfig().binaryName} v1. Lambda non-proxy AWS integrations are supported; direct AWS service integrations (S3 / SQS / SNS / DynamoDB) require deploying to AWS. See https://github.com/go-to-k/cdk-local/blob/main/docs/local-emulation.md.`
 	};
 	const arnOutcome = resolveLambdaArnOutcome(uri);
 	if (arnOutcome.kind === "unsupported") return {
 		kind: "unsupported",
-		reason: `${stackName}/${logicalId}.Integration.Uri: ${arnOutcome.detail} (got ${shortJson$1(uri)}). Lambda Arn intrinsics on cross-stack / imported references are not resolvable locally.`
+		reason: `${displayStackName(`${stackName}/${logicalId}`)}.Integration.Uri: ${arnOutcome.detail} (got ${shortJson$1(uri)}). Lambda Arn intrinsics on cross-stack / imported references are not resolvable locally.`
 	};
 	const requestTemplates = pickStringRecord(integration["RequestTemplates"]);
 	const responses = readIntegrationResponses(integration);
@@ -2933,19 +3013,19 @@ function buildRestV1Path(resourceIdIntrinsic, restApiLogicalId, template, stackN
 		}
 	}
 	const resourceLogicalId = pickRefLogicalId(resourceIdIntrinsic);
-	if (!resourceLogicalId) throw new Error(`${stackName}/${methodLogicalId}: ResourceId must be { Ref: '...' } or { 'Fn::GetAtt': [..., 'RootResourceId'] } (got ${shortJson$1(resourceIdIntrinsic)}).`);
+	if (!resourceLogicalId) throw new Error(`${displayStackName(`${stackName}/${methodLogicalId}`)}: ResourceId must be { Ref: '...' } or { 'Fn::GetAtt': [..., 'RootResourceId'] } (got ${shortJson$1(resourceIdIntrinsic)}).`);
 	const segments = [];
 	const visited = /* @__PURE__ */ new Set();
 	let cursor = resourceLogicalId;
 	while (cursor && cursor !== restApiLogicalId) {
-		if (visited.has(cursor)) throw new Error(`${stackName}/${methodLogicalId}: cycle detected in AWS::ApiGateway::Resource ParentId chain at ${cursor}`);
+		if (visited.has(cursor)) throw new Error(`${displayStackName(`${stackName}/${methodLogicalId}`)}: cycle detected in AWS::ApiGateway::Resource ParentId chain at ${displayIdent(cursor)}`);
 		visited.add(cursor);
 		const node = template.Resources?.[cursor];
-		if (!node) throw new Error(`${stackName}/${methodLogicalId}: ParentId chain references missing resource '${cursor}'`);
-		if (node.Type !== "AWS::ApiGateway::Resource") throw new Error(`${stackName}/${methodLogicalId}: ParentId chain hit ${node.Type} (expected AWS::ApiGateway::Resource or RestApi root)`);
+		if (!node) throw new Error(`${displayStackName(`${stackName}/${methodLogicalId}`)}: ParentId chain references missing resource ${displayIdent(cursor)}`);
+		if (node.Type !== "AWS::ApiGateway::Resource") throw new Error(`${displayStackName(`${stackName}/${methodLogicalId}`)}: ParentId chain hit ${node.Type} (expected AWS::ApiGateway::Resource or RestApi root)`);
 		const nodeProps = node.Properties ?? {};
 		const pathPart = nodeProps["PathPart"];
-		if (typeof pathPart !== "string") throw new Error(`${stackName}/${methodLogicalId}: AWS::ApiGateway::Resource '${cursor}' missing PathPart`);
+		if (typeof pathPart !== "string") throw new Error(`${displayStackName(`${stackName}/${methodLogicalId}`)}: AWS::ApiGateway::Resource ${displayIdent(cursor)} missing PathPart`);
 		segments.unshift(pathPart);
 		const parentId = nodeProps["ParentId"];
 		if (parentId && typeof parentId === "object" && !Array.isArray(parentId) && "Fn::GetAtt" in parentId) {
@@ -2972,9 +3052,9 @@ function discoverHttpApiRoute(logicalId, resource, template, stackName) {
 	const props = resource.Properties ?? {};
 	const apiId = props["ApiId"];
 	const apiLogicalId = pickRefLogicalId(apiId);
-	if (!apiLogicalId) throw new Error(`${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): ApiId must be { Ref: '...' } (got ${shortJson$1(apiId)}).`);
+	if (!apiLogicalId) throw new Error(`${displayStackName(`${stackName}/${logicalId}`)} (AWS::ApiGatewayV2::Route): ApiId must be { Ref: '...' } (got ${shortJson$1(apiId)}).`);
 	const routeKey = props["RouteKey"];
-	if (typeof routeKey !== "string" || routeKey.length === 0) throw new Error(`${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): RouteKey must be a string`);
+	if (typeof routeKey !== "string" || routeKey.length === 0) throw new Error(`${displayStackName(`${stackName}/${logicalId}`)} (AWS::ApiGatewayV2::Route): RouteKey must be a string`);
 	const apiCdkPath = readApiCdkPath$1(apiLogicalId, template);
 	const apiResource = template.Resources?.[apiLogicalId];
 	if (apiResource?.Type === "AWS::ApiGatewayV2::Api") {
@@ -2993,22 +3073,22 @@ function discoverHttpApiRoute(logicalId, resource, template, stackName) {
 		declaredAt: `${stackName}/${logicalId}`
 	};
 	const target = props["Target"];
-	const integrationLogicalId = parseHttpApiTargetIntegration(target, `${stackName}/${logicalId}.Target`);
+	const integrationLogicalId = parseHttpApiTargetIntegration(target, `${displayStackName(`${stackName}/${logicalId}`)}.Target`);
 	const integration = template.Resources?.[integrationLogicalId];
-	if (!integration || integration.Type !== "AWS::ApiGatewayV2::Integration") throw new Error(`${stackName}/${logicalId} (AWS::ApiGatewayV2::Route): Target points at '${integrationLogicalId}' which is not an AWS::ApiGatewayV2::Integration`);
+	if (!integration || integration.Type !== "AWS::ApiGatewayV2::Integration") throw new Error(`${displayStackName(`${stackName}/${logicalId}`)} (AWS::ApiGatewayV2::Route): Target points at ${displayIdent(integrationLogicalId)} which is not an AWS::ApiGatewayV2::Integration`);
 	const integrationProps = integration.Properties ?? {};
 	const integrationType = integrationProps["IntegrationType"];
 	if (integrationType !== "AWS_PROXY") return [{
 		...baseRoute,
 		lambdaLogicalId: "",
-		unsupported: { reason: `${stackName}/${logicalId}: HTTP API v2 integration type '${String(integrationType)}' is not supported (only AWS_PROXY).` }
+		unsupported: { reason: `${displayStackName(`${stackName}/${logicalId}`)}: HTTP API v2 integration type ${displayIdent(String(integrationType))} is not supported (only AWS_PROXY).` }
 	}];
 	if (integrationProps["IntegrationSubtype"] !== void 0) return [classifyServiceIntegrationRoute(baseRoute, integrationProps, stackName, logicalId, integrationLogicalId)];
 	const arnOutcome = resolveLambdaArnOutcome(integrationProps["IntegrationUri"]);
 	if (arnOutcome.kind === "unsupported") return [{
 		...baseRoute,
 		lambdaLogicalId: "",
-		unsupported: { reason: `${stackName}/${integrationLogicalId}.IntegrationUri: ${arnOutcome.detail} (got ${shortJson$1(integrationProps["IntegrationUri"])}). Lambda Arn intrinsics on cross-stack / imported references are not resolvable locally.` }
+		unsupported: { reason: `${displayStackName(`${stackName}/${integrationLogicalId}`)}.IntegrationUri: ${arnOutcome.detail} (got ${shortJson$1(integrationProps["IntegrationUri"])}). Lambda Arn intrinsics on cross-stack / imported references are not resolvable locally.` }
 	}];
 	return [{
 		...baseRoute,
@@ -3021,13 +3101,13 @@ function classifyServiceIntegrationRoute(baseRoute, integrationProps, stackName,
 	if (!isSupportedSubtype(subtypeRaw)) return {
 		...baseRoute,
 		lambdaLogicalId: "",
-		unsupported: { reason: `${declaredAt}: HTTP API v2 service integration subtype '${stringifyValue(subtypeRaw)}' is not supported by ${getEmbedConfig().cliName} start-api (see https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-aws-services-reference.html for the supported list).` }
+		unsupported: { reason: `${displayStackName(declaredAt)}: HTTP API v2 service integration subtype ${displayIdent(stringifyValue(subtypeRaw))} is not supported by ${getEmbedConfig().cliName} start-api (see https://docs.aws.amazon.com/apigateway/latest/developerguide/http-api-develop-integrations-aws-services-reference.html for the supported list).` }
 	};
 	const requestParameters = integrationProps["RequestParameters"];
 	if (!requestParameters || typeof requestParameters !== "object" || Array.isArray(requestParameters)) return {
 		...baseRoute,
 		lambdaLogicalId: "",
-		unsupported: { reason: `${stackName}/${integrationLogicalId}: HTTP API v2 service integration '${subtypeRaw}' is missing RequestParameters or it is not an object — cannot dispatch to the SDK without input mapping.` }
+		unsupported: { reason: `${displayStackName(`${stackName}/${integrationLogicalId}`)}: HTTP API v2 service integration ${displayIdent(subtypeRaw)} is missing RequestParameters or it is not an object — cannot dispatch to the SDK without input mapping.` }
 	};
 	const responseParameters = integrationProps["ResponseParameters"];
 	const validatedResponseParameters = responseParameters && typeof responseParameters === "object" && !Array.isArray(responseParameters) ? responseParameters : void 0;
@@ -3045,7 +3125,7 @@ function discoverFunctionUrl(logicalId, resource, template, stackName) {
 	const props = resource.Properties ?? {};
 	const targetArn = props["TargetFunctionArn"];
 	const arnOutcome = resolveLambdaArnOutcome(targetArn);
-	if (arnOutcome.kind === "unsupported") throw new Error(`${stackName}/${logicalId}.TargetFunctionArn: ${arnOutcome.detail} (got ${shortJson$1(targetArn)}).`);
+	if (arnOutcome.kind === "unsupported") throw new Error(`${displayStackName(`${stackName}/${logicalId}`)}.TargetFunctionArn: ${arnOutcome.detail} (got ${shortJson$1(targetArn)}).`);
 	const lambdaLogicalId = arnOutcome.logicalId;
 	const lambdaCdkPath = readApiCdkPath$1(lambdaLogicalId, template);
 	const baseRoute = {
@@ -3063,7 +3143,7 @@ function discoverFunctionUrl(logicalId, resource, template, stackName) {
 	if (authType !== "NONE" && authType !== "AWS_IAM") return [{
 		...baseRoute,
 		lambdaLogicalId,
-		unsupported: { reason: `${stackName}/${logicalId}: AuthType ${shortJson$1(authType)} is not a recognized Function URL auth type (expected 'NONE' or 'AWS_IAM').` }
+		unsupported: { reason: `${displayStackName(`${stackName}/${logicalId}`)}: AuthType ${shortJson$1(authType)} is not a recognized Function URL auth type (expected 'NONE' or 'AWS_IAM').` }
 	}];
 	const invokeModeRaw = props["InvokeMode"];
 	let invokeMode = "BUFFERED";
@@ -3071,7 +3151,7 @@ function discoverFunctionUrl(logicalId, resource, template, stackName) {
 	else if (invokeModeRaw !== void 0 && invokeModeRaw !== "BUFFERED") return [{
 		...baseRoute,
 		lambdaLogicalId,
-		unsupported: { reason: `${stackName}/${logicalId}: InvokeMode ${shortJson$1(invokeModeRaw)} is not a recognized value (expected 'BUFFERED' or 'RESPONSE_STREAM').` }
+		unsupported: { reason: `${displayStackName(`${stackName}/${logicalId}`)}: InvokeMode ${shortJson$1(invokeModeRaw)} is not a recognized value (expected 'BUFFERED' or 'RESPONSE_STREAM').` }
 	}];
 	return [{
 		...baseRoute,
@@ -3092,7 +3172,7 @@ function parseHttpApiTargetIntegration(target, location) {
 	if (typeof target === "string") {
 		const m = /^integrations\/(.+)$/.exec(target);
 		if (m) return m[1];
-		throw new Error(`${location}: literal Target '${target}' must start with 'integrations/'`);
+		throw new Error(`${location}: literal Target ${displayIdent(target)} must start with 'integrations/'`);
 	}
 	if (target && typeof target === "object" && !Array.isArray(target)) {
 		const obj = target;
@@ -3140,7 +3220,7 @@ function parseRouteKey(routeKey) {
 		pathPattern: "$default"
 	};
 	const m = /^([A-Za-z]+)\s+(\S+)$/.exec(routeKey);
-	if (!m) throw new Error(`RouteKey '${routeKey}' is malformed: expected '<METHOD> <path>' (e.g. 'GET /items/{id}') or '$default'.`);
+	if (!m) throw new Error(`RouteKey ${displayIdent(routeKey)} is malformed: expected '<METHOD> <path>' (e.g. 'GET /items/{id}') or '$default'.`);
 	return {
 		method: m[1].toUpperCase(),
 		pathPattern: m[2]
@@ -3194,7 +3274,7 @@ function discoverOneApi(logicalId, resource, template, stackName) {
 	const stage = pickStage$1(logicalId, template);
 	const apiCdkPath = readApiCdkPath(logicalId, template);
 	const routes = collectRoutesForApi(logicalId, template, stackName);
-	if (routes.length === 0) throw new Error(`${declaredAt}: WebSocket API has no AWS::ApiGatewayV2::Route children — at least one route (typically '$connect') is required to dispatch.`);
+	if (routes.length === 0) throw new Error(`${displayStackName(declaredAt)}: WebSocket API has no AWS::ApiGatewayV2::Route children — at least one route (typically '$connect') is required to dispatch.`);
 	const authRoutes = collectAuthRoutesForApi(logicalId, template, stackName);
 	const unsupported = authRoutes.length > 0 ? { reason: `WebSocket API requires authorizer support, which ${getEmbedConfig().binaryName} v1 does not emulate. Affected route(s): ${authRoutes.map((r) => `${r.routeKey} [AuthorizationType=${r.authorizationType}]`).join(", ")}. The API will be discovered but no upgrade requests will be accepted on this server.` } : void 0;
 	return {
@@ -3235,7 +3315,7 @@ function collectAuthRoutesForApi(apiLogicalId, template, _stackName) {
 	return result;
 }
 function assertSupportedSelectionExpression(expr, declaredAt) {
-	if (!/^\$request\.body(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/.test(expr)) throw new Error(`${declaredAt}: RouteSelectionExpression '${expr}' is not supported in ${getEmbedConfig().cliName} start-api v1 — only '$request.body.<key>' shapes (optionally nested via dots) are recognized. File a follow-up issue if you need '$request.header.X' / '$context.X' / array-index access.`);
+	if (!/^\$request\.body(?:\.[A-Za-z_][A-Za-z0-9_]*)+$/.test(expr)) throw new Error(`${displayStackName(declaredAt)}: RouteSelectionExpression ${displayIdent(expr)} is not supported in ${getEmbedConfig().cliName} start-api v1 — only '$request.body.<key>' shapes (optionally nested via dots) are recognized. File a follow-up issue if you need '$request.header.X' / '$context.X' / array-index access.`);
 }
 function parseSelectionExpressionPath(expr) {
 	const m = /^\$request\.body\.(.+)$/.exec(expr);
@@ -3264,17 +3344,17 @@ function collectRoutesForApi(apiLogicalId, template, stackName) {
 		if (pickRefLogicalId(props["ApiId"]) !== apiLogicalId) continue;
 		const declaredAt = `${stackName}/${routeLogicalId}`;
 		const routeKey = props["RouteKey"];
-		if (typeof routeKey !== "string" || routeKey.length === 0) throw new Error(`${declaredAt}: RouteKey must be a non-empty string.`);
-		if (seenKeys.has(routeKey)) throw new Error(`${declaredAt}: WebSocket API has duplicate RouteKey '${routeKey}' — each RouteKey may appear at most once per API.`);
+		if (typeof routeKey !== "string" || routeKey.length === 0) throw new Error(`${displayStackName(declaredAt)}: RouteKey must be a non-empty string.`);
+		if (seenKeys.has(routeKey)) throw new Error(`${displayStackName(declaredAt)}: WebSocket API has duplicate RouteKey ${displayIdent(routeKey)} — each RouteKey may appear at most once per API.`);
 		seenKeys.add(routeKey);
 		const targetLogicalId = parseRouteTarget(props["Target"], declaredAt);
 		const integration = resources[targetLogicalId];
-		if (!integration || integration.Type !== "AWS::ApiGatewayV2::Integration") throw new Error(`${declaredAt}: Target points at '${targetLogicalId}' which is not an AWS::ApiGatewayV2::Integration.`);
+		if (!integration || integration.Type !== "AWS::ApiGatewayV2::Integration") throw new Error(`${displayStackName(declaredAt)}: Target points at ${displayIdent(targetLogicalId)} which is not an AWS::ApiGatewayV2::Integration.`);
 		const integrationProps = integration.Properties ?? {};
 		const integrationType = integrationProps["IntegrationType"];
-		if (integrationType !== "AWS_PROXY") throw new Error(`${declaredAt}: WebSocket route IntegrationType '${String(integrationType)}' is not supported in ${getEmbedConfig().cliName} start-api v1 — only AWS_PROXY (Lambda) integrations are emulated.`);
+		if (integrationType !== "AWS_PROXY") throw new Error(`${displayStackName(declaredAt)}: WebSocket route IntegrationType ${displayIdent(String(integrationType))} is not supported in ${getEmbedConfig().cliName} start-api v1 — only AWS_PROXY (Lambda) integrations are emulated.`);
 		const arnOutcome = resolveLambdaArnIntrinsic(integrationProps["IntegrationUri"]);
-		if (arnOutcome.kind === "unsupported") throw new Error(`${stackName}/${targetLogicalId}.IntegrationUri: ${arnOutcome.detail} — WebSocket routes must point at a same-template Lambda.`);
+		if (arnOutcome.kind === "unsupported") throw new Error(`${displayStackName(`${stackName}/${targetLogicalId}`)}.IntegrationUri: ${arnOutcome.detail} — WebSocket routes must point at a same-template Lambda.`);
 		result.push({
 			routeKey,
 			targetLambdaLogicalId: arnOutcome.logicalId,
@@ -3288,7 +3368,7 @@ function parseRouteTarget(target, location) {
 	if (typeof target === "string") {
 		const m = /^integrations\/(.+)$/.exec(target);
 		if (m) return m[1];
-		throw new Error(`${location}: literal Target '${target}' must start with 'integrations/'.`);
+		throw new Error(`${displayStackName(location)}: literal Target ${displayIdent(target)} must start with 'integrations/'.`);
 	}
 	if (target && typeof target === "object" && !Array.isArray(target)) {
 		const obj = target;
@@ -3329,7 +3409,7 @@ function parseRouteTarget(target, location) {
 			}
 		}
 	}
-	throw new Error(`${location}: Target must be 'integrations/<id>' literal, Fn::Join with the documented shapes, or Fn::Sub with an 'integrations/\${...}' template.`);
+	throw new Error(`${displayStackName(location)}: Target must be 'integrations/<id>' literal, Fn::Join with the documented shapes, or Fn::Sub with an 'integrations/\${...}' template.`);
 }
 function readApiCdkPath(logicalId, template) {
 	const resource = template.Resources?.[logicalId];
@@ -3412,7 +3492,7 @@ function scanAgentCoreRuntimes(stacks) {
 function listApiSurfaces(stacks) {
 	const byKey = /* @__PURE__ */ new Map();
 	const add = (stackName, logicalId, cdkPath, kind) => {
-		const key = `${stackName}:${logicalId}`;
+		const key = cdkPath ?? `${stackName}:${logicalId}`;
 		if (!byKey.has(key)) byKey.set(key, makeEntry(stackName, logicalId, cdkPath, kind));
 	};
 	try {
@@ -3582,7 +3662,7 @@ async function resolveMultiTarget(provided, params) {
 async function loadSynthDeps() {
 	const [toolkitLib, { CdklIoHost }, { AssetManifestArtifact }] = await Promise.all([
 		import("@aws-cdk/toolkit-lib"),
-		import("./cdkl-io-host-CDXI-7cC.js"),
+		import("./cdkl-io-host-DFQf5KWv.js"),
 		import("@aws-cdk/cloud-assembly-api")
 	]);
 	return {
@@ -3628,12 +3708,12 @@ var AssemblyReader = class {
 	}
 };
 function collectStacks(assembly, assetManifestClass) {
-	return assembly.stacks.map((stack) => mapStackArtifact(stack, assembly.directory, assetManifestClass));
+	return assembly.stacksRecursively.map((stack) => mapStackArtifact(stack, assembly.directory, assetManifestClass));
 }
 function mapStackArtifact(stack, assetOutdir, assetManifestClass) {
 	const info = {
 		stackName: stack.stackName,
-		displayName: stack.displayName ?? stack.id,
+		displayName: stack.hierarchicalId,
 		artifactId: stack.id,
 		template: stack.template,
 		dependencyNames: stack.dependencies.map((d) => d.id),
@@ -3823,7 +3903,10 @@ async function resolveSsmParameters(client, refs, label) {
 			const invalid = resp.InvalidParameters ?? [];
 			if (invalid.length > 0) logger.warn(`${label}: SSM GetParameters reported invalid parameter name(s): ${invalid.join(", ")}. Ref to the matching CloudFormation parameter(s) will warn-and-drop (was the SSM parameter created?).`);
 		} catch (err) {
-			logger.warn(`${label}: SSM GetParameters(${flattenToOneLine(names.join(", "))}) failed: ${describeAwsFailureForWarn(err, "SSM GetParameters")}. Ref to the matching CloudFormation parameter(s) will warn-and-drop (grant ssm:GetParameters or override via --env-vars).`);
+			logger.warn(`${label}: SSM GetParameters(${names.map((n) => displayIdent(n, {
+				listMember: true,
+				maxCodePoints: 1011
+			})).join(", ")}) failed: ${describeAwsFailureForWarn(err, "SSM GetParameters")}. Ref to the matching CloudFormation parameter(s) will warn-and-drop (grant ssm:GetParameters or override via --env-vars).`);
 			continue;
 		}
 		for (const p of resolved) {
@@ -3953,19 +4036,19 @@ var CfnLocalStateProvider = class {
 			resourceMap = buildResourceStateMap(await fetchAllStackResources(client, this.cfnStackName));
 		} catch (err) {
 			const detail = formatAwsErrorForWarn(err, "CloudFormation ListStackResources");
-			this.lastLoadError = `ListStackResources(${this.cfnStackName}) failed: ${detail} (region='${this.region}')`;
-			logger.warn(`${this.label}: ListStackResources(${this.cfnStackName}) failed: ${detail}. Was the stack deployed in region '${this.region}'? Falling back.`);
+			this.lastLoadError = `ListStackResources(${displayStackName(this.cfnStackName)}) failed: ${detail} (region=${displayIdent(this.region)})`;
+			logger.warn(`${this.label}: ListStackResources(${displayStackName(this.cfnStackName)}) failed: ${detail}. Was the stack deployed in region ${displayIdent(this.region)}? Falling back.`);
 			return;
 		}
 		let outputs;
 		try {
 			const stack = (await client.send(new DescribeStacksCommand({ StackName: this.cfnStackName }))).Stacks?.[0];
 			if (!stack) {
-				logger.warn(`${this.label}: DescribeStacks(${this.cfnStackName}) returned no stack; outputs will be empty.`);
+				logger.warn(`${this.label}: DescribeStacks(${displayStackName(this.cfnStackName)}) returned no stack; outputs will be empty.`);
 				outputs = {};
 			} else outputs = buildOutputsMap(stack.Outputs ?? []);
 		} catch (err) {
-			logger.warn(`${this.label}: DescribeStacks(${this.cfnStackName}) failed: ${formatAwsErrorForWarn(err, "CloudFormation DescribeStacks")}. Outputs will be empty (Fn::GetStackOutput cannot resolve).`);
+			logger.warn(`${this.label}: DescribeStacks(${displayStackName(this.cfnStackName)}) failed: ${formatAwsErrorForWarn(err, "CloudFormation DescribeStacks")}. Outputs will be empty (Fn::GetStackOutput cannot resolve).`);
 			outputs = {};
 		}
 		return {
@@ -4207,7 +4290,7 @@ function substituteAgainstState(value, contextOrResources) {
 	};
 	return {
 		kind: "unresolved",
-		reason: `unsupported intrinsic '${intrinsic}' (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join, Fn::Select, Fn::Split)`
+		reason: `unsupported intrinsic ${displayIdent(intrinsic)} (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join, Fn::Select, Fn::Split)`
 	};
 }
 function isContext(v) {
@@ -4238,13 +4321,13 @@ function resolveRef(arg, context) {
 	}
 	return {
 		kind: "unresolved",
-		reason: `Ref '${arg}': no record in the state source (was the resource deployed, or is it a CloudFormation parameter that could not be resolved — e.g. an SSM-backed AWS::SSM::Parameter::Value parameter whose SSM value was not readable?)`
+		reason: `Ref ${displayIdent(arg)}: no record in the state source (was the resource deployed, or is it a CloudFormation parameter that could not be resolved — e.g. an SSM-backed AWS::SSM::Parameter::Value parameter whose SSM value was not readable?)`
 	};
 }
 function resolvePseudoParameter(name, pseudo) {
 	if (!pseudo) return {
 		kind: "unresolved",
-		reason: `Ref '${name}': pseudo parameter not supplied (need an active state source, e.g. --from-cfn-stack)`
+		reason: `Ref ${displayIdent(name)}: pseudo parameter not supplied (need an active state source, e.g. --from-cfn-stack)`
 	};
 	switch (name) {
 		case "AWS::AccountId":
@@ -4273,12 +4356,12 @@ function resolvePseudoParameter(name, pseudo) {
 			break;
 		default: return {
 			kind: "unresolved",
-			reason: `Ref '${name}': pseudo parameter not supported (supported: AWS::AccountId, AWS::Region, AWS::Partition, AWS::URLSuffix)`
+			reason: `Ref ${displayIdent(name)}: pseudo parameter not supported (supported: AWS::AccountId, AWS::Region, AWS::Partition, AWS::URLSuffix)`
 		};
 	}
 	return {
 		kind: "unresolved",
-		reason: `Ref '${name}': pseudo parameter value not resolved`
+		reason: `Ref ${displayIdent(name)}: pseudo parameter value not resolved`
 	};
 }
 function resolveGetAtt(arg, context) {
@@ -4295,7 +4378,7 @@ function resolveGetAtt(arg, context) {
 		const dot = arg.indexOf(".");
 		if (dot <= 0 || dot === arg.length - 1) return {
 			kind: "unresolved",
-			reason: `Fn::GetAtt string form must be '<LogicalId>.<Attribute>', got '${arg}'`
+			reason: `Fn::GetAtt string form must be '<LogicalId>.<Attribute>', got ${displayIdent(arg)}`
 		};
 		logicalId = arg.slice(0, dot);
 		attr = arg.slice(dot + 1);
@@ -4306,12 +4389,12 @@ function resolveGetAtt(arg, context) {
 	const resource = context.resources[logicalId];
 	if (!resource) return {
 		kind: "unresolved",
-		reason: `Fn::GetAtt '${logicalId}.${attr}': no record in the state source`
+		reason: `Fn::GetAtt ${displayIdent(`${logicalId}.${attr}`)}: no record in the state source`
 	};
 	const cached = resource.attributes?.[attr];
 	if (cached === void 0) return {
 		kind: "unresolved",
-		reason: `Fn::GetAtt '${logicalId}.${attr}': attribute not captured in the state source at deploy time`
+		reason: `Fn::GetAtt ${displayIdent(`${logicalId}.${attr}`)}: attribute not captured in the state source at deploy time`
 	};
 	if (typeof cached === "string" || typeof cached === "number" || typeof cached === "boolean") return {
 		kind: "literal",
@@ -4346,7 +4429,7 @@ function resolveSub(arg, context) {
 			const sub = substituteAgainstState(bindings[placeholder], context);
 			if (sub.kind !== "literal") return {
 				kind: "unresolved",
-				reason: `Fn::Sub placeholder '\${${placeholder}}': ${sub.reason}`
+				reason: `Fn::Sub placeholder \${${displayIdent(placeholder)}}: ${sub.reason}`
 			};
 			resolutions.set(placeholder, String(sub.value));
 			continue;
@@ -4355,7 +4438,7 @@ function resolveSub(arg, context) {
 			const sub = resolvePseudoParameter(placeholder, context.pseudoParameters);
 			if (sub.kind !== "literal") return {
 				kind: "unresolved",
-				reason: `Fn::Sub placeholder '\${${placeholder}}': ${sub.reason}`
+				reason: `Fn::Sub placeholder \${${displayIdent(placeholder)}}: ${sub.reason}`
 			};
 			resolutions.set(placeholder, String(sub.value));
 			continue;
@@ -4364,14 +4447,14 @@ function resolveSub(arg, context) {
 			const sub = resolveRef(placeholder, context);
 			if (sub.kind !== "literal") return {
 				kind: "unresolved",
-				reason: `Fn::Sub placeholder '\${${placeholder}}': ${sub.reason}`
+				reason: `Fn::Sub placeholder \${${displayIdent(placeholder)}}: ${sub.reason}`
 			};
 			resolutions.set(placeholder, String(sub.value));
 		} else {
 			const sub = resolveGetAtt(placeholder, context);
 			if (sub.kind !== "literal") return {
 				kind: "unresolved",
-				reason: `Fn::Sub placeholder '\${${placeholder}}': ${sub.reason}`
+				reason: `Fn::Sub placeholder \${${displayIdent(placeholder)}}: ${sub.reason}`
 			};
 			resolutions.set(placeholder, String(sub.value));
 		}
@@ -4510,7 +4593,7 @@ async function substituteAgainstStateAsync(value, contextOrResources) {
 	if (intrinsic === "Fn::GetStackOutput") return resolveGetStackOutputAsync(arg, context);
 	return {
 		kind: "unresolved",
-		reason: `unsupported intrinsic '${intrinsic}' (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join, Fn::Select, Fn::Split, Fn::ImportValue, Fn::GetStackOutput)`
+		reason: `unsupported intrinsic ${displayIdent(intrinsic)} (supported: Ref, Fn::GetAtt, Fn::Sub, Fn::Join, Fn::Select, Fn::Split, Fn::ImportValue, Fn::GetStackOutput)`
 	};
 }
 async function resolveImportValueAsync(arg, context) {
@@ -5012,7 +5095,7 @@ function parseEcsTarget(target) {
 function resolveEcsTaskTarget(target, stacks, context) {
 	if (stacks.length === 0) throw new EcsTaskResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$3(parsed, stacks);
+	const stack = pickStack$3(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	let logicalId;
 	let resource;
@@ -5029,19 +5112,18 @@ function resolveEcsTaskTarget(target, stacks, context) {
 		logicalId = parsed.pathOrId;
 	}
 	if (!logicalId || !resource) throw notFoundError$1(target, stack, resources);
-	if (resource.Type === "AWS::Lambda::Function") throw new EcsTaskResolutionError(`Resource '${logicalId}' in ${stack.stackName} is a Lambda function, not an ECS task definition. Use \`${getEmbedConfig().cliName} invoke\` for Lambda; \`${getEmbedConfig().cliName} run-task\` is ECS only.`);
-	if (resource.Type !== "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`Resource '${logicalId}' in ${stack.stackName} is ${resource.Type}, not an AWS::ECS::TaskDefinition.`);
+	if (resource.Type === "AWS::Lambda::Function") throw new EcsTaskResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is a Lambda function, not an ECS task definition. Use \`${getEmbedConfig().cliName} invoke\` for Lambda; \`${getEmbedConfig().cliName} run-task\` is ECS only.`);
+	if (resource.Type !== "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`Resource ${displayIdent(logicalId)} in ${stack.stackName} is ${displayIdent(resource.Type)}, not an AWS::ECS::TaskDefinition.`);
 	return extractTaskDefinitionProperties(stack, logicalId, resource, context);
 }
-function pickStack$3(parsed, stacks) {
-	if (parsed.stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		throw new EcsTaskResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
+function pickStack$3(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new EcsTaskResolutionError(`Multiple stacks in app, target '${parsed.pathOrId}' is missing a stack prefix. Use 'StackName:${parsed.pathOrId}' or 'StackName/...' (path form). Available stacks: ${describeStacks(stacks)}.`);
+		case "not-found": throw new EcsTaskResolutionError(`Stack '${selection.pattern}' not found. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new EcsTaskResolutionError(`Stack pattern '${selection.pattern}' matched ${selection.matched.length} stacks: ` + describeStacks(selection.matched) + ". Use a more specific pattern, or the stack's display path (path form).");
 	}
-	const matched = matchStacks(stacks, [parsed.stackPattern]);
-	if (matched.length === 0) throw new EcsTaskResolutionError(`Stack '${parsed.stackPattern}' not found. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
-	if (matched.length > 1) throw new EcsTaskResolutionError(`Stack pattern '${parsed.stackPattern}' matched ${matched.length} stacks: ` + matched.map((s) => s.stackName).join(", ") + ". Use a more specific pattern.");
-	return matched[0];
 }
 function extractTaskDefinitionProperties(stack, logicalId, resource, context) {
 	const props = resource.Properties ?? {};
@@ -5050,22 +5132,22 @@ function extractTaskDefinitionProperties(stack, logicalId, resource, context) {
 	const rawNetworkMode = pickString(props["NetworkMode"]) ?? "bridge";
 	let networkMode;
 	if (rawNetworkMode === "bridge" || rawNetworkMode === "awsvpc" || rawNetworkMode === "host" || rawNetworkMode === "none") networkMode = rawNetworkMode;
-	else throw new EcsTaskResolutionError(`Task definition '${logicalId}' has unsupported NetworkMode '${rawNetworkMode}'. Supported values: bridge / awsvpc / host / none.`);
-	if (networkMode === "awsvpc") warnings.push(`NetworkMode 'awsvpc' on '${logicalId}' is mapped to docker bridge locally — docker cannot emulate ENI-per-task. AWS SDK calls still reach public endpoints via the developer network.`);
-	if (props["ProxyConfiguration"]) warnings.push(`Task definition '${logicalId}' declares 'ProxyConfiguration' (custom Envoy / App Mesh bootstrap), which is NOT honored by '${getEmbedConfig().cliName} start-service' / '${getEmbedConfig().cliName} run-task' in v1. Local execution will run without the configured proxy. See design doc § 2 for the rationale.`);
+	else throw new EcsTaskResolutionError(`Task definition ${displayIdent(logicalId)} has unsupported NetworkMode ${displayIdent(rawNetworkMode)}. Supported values: bridge / awsvpc / host / none.`);
+	if (networkMode === "awsvpc") warnings.push(`NetworkMode 'awsvpc' on ${displayIdent(logicalId)} is mapped to docker bridge locally — docker cannot emulate ENI-per-task. AWS SDK calls still reach public endpoints via the developer network.`);
+	if (props["ProxyConfiguration"]) warnings.push(`Task definition ${displayIdent(logicalId)} declares 'ProxyConfiguration' (custom Envoy / App Mesh bootstrap), which is NOT honored by '${getEmbedConfig().cliName} start-service' / '${getEmbedConfig().cliName} run-task' in v1. Local execution will run without the configured proxy. See design doc § 2 for the rationale.`);
 	const resources = stack.template.Resources ?? {};
 	const subContext = buildSubstitutionContextFromImageContext(context);
 	const taskRoleArn = resolveRoleArn(props["TaskRoleArn"], resources, subContext);
 	const executionRoleArn = resolveRoleArn(props["ExecutionRoleArn"], resources, subContext);
 	const runtimePlatform = parseRuntimePlatform(props["RuntimePlatform"]);
 	const rawContainers = props["ContainerDefinitions"];
-	if (!Array.isArray(rawContainers) || rawContainers.length === 0) throw new EcsTaskResolutionError(`Task definition '${logicalId}' has no ContainerDefinitions.`);
+	if (!Array.isArray(rawContainers) || rawContainers.length === 0) throw new EcsTaskResolutionError(`Task definition ${displayIdent(logicalId)} has no ContainerDefinitions.`);
 	const containers = rawContainers.map((c, idx) => parseContainerDefinition(c, idx, logicalId, resources, stack, context));
-	for (const ctr of containers) for (const w of ctr.warnings) warnings.push(`Container '${ctr.name}': ${w}`);
+	for (const ctr of containers) for (const w of ctr.warnings) warnings.push(`Container ${displayIdent(ctr.name)}: ${w}`);
 	const rawVolumes = props["Volumes"];
 	const volumes = Array.isArray(rawVolumes) ? rawVolumes.map((v, idx) => parseVolume(v, idx, logicalId, subContext)) : [];
 	const containerNames = new Set(containers.map((c) => c.name));
-	for (const c of containers) for (const d of c.dependsOn) if (!containerNames.has(d.containerName)) throw new EcsTaskResolutionError(`Container '${c.name}' depends on '${d.containerName}', which is not defined in task '${logicalId}'.`);
+	for (const c of containers) for (const d of c.dependsOn) if (!containerNames.has(d.containerName)) throw new EcsTaskResolutionError(`Container ${displayIdent(c.name)} depends on ${displayIdent(d.containerName)}, which is not defined in task ${displayIdent(logicalId)}.`);
 	const out = {
 		stack,
 		taskDefinitionLogicalId: logicalId,
@@ -5095,10 +5177,10 @@ function parseRuntimePlatform(value) {
 	};
 }
 function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, context) {
-	if (!raw || typeof raw !== "object") throw new EcsTaskResolutionError(`Task '${taskLogicalId}' ContainerDefinitions[${idx}] is not an object.`);
+	if (!raw || typeof raw !== "object") throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} ContainerDefinitions[${idx}] is not an object.`);
 	const c = raw;
 	const name = pickString(c["Name"]);
-	if (!name) throw new EcsTaskResolutionError(`Task '${taskLogicalId}' ContainerDefinitions[${idx}] has no Name.`);
+	if (!name) throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} ContainerDefinitions[${idx}] has no Name.`);
 	const image = parseContainerImage(c["Image"], name, taskLogicalId, resources, stack, context);
 	const command = pickStringArray$1(c["Command"]);
 	const entryPoint = pickStringArray$1(c["EntryPoint"]);
@@ -5202,7 +5284,7 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 		const containerName = pickString(d["ContainerName"]);
 		const condition = pickString(d["Condition"]);
 		if (!containerName || !condition) continue;
-		if (condition !== "START" && condition !== "COMPLETE" && condition !== "SUCCESS" && condition !== "HEALTHY") throw new EcsTaskResolutionError(`Container '${name}' has invalid DependsOn condition '${condition}'. Accepted values: START / COMPLETE / SUCCESS / HEALTHY.`);
+		if (condition !== "START" && condition !== "COMPLETE" && condition !== "SUCCESS" && condition !== "HEALTHY") throw new EcsTaskResolutionError(`Container ${displayIdent(name)} has invalid DependsOn condition ${displayIdent(condition)}. Accepted values: START / COMPLETE / SUCCESS / HEALTHY.`);
 		dependsOn.push({
 			containerName,
 			condition
@@ -5240,8 +5322,8 @@ function parseContainerDefinition(raw, idx, taskLogicalId, resources, stack, con
 		});
 	}
 	const warnings = [];
-	for (const d of droppedEnvKeys) warnings.push(`Environment '${d.key}' dropped: ${d.reason}`);
-	for (const d of droppedSecretKeys) warnings.push(`Secret '${d.key}' dropped: ${d.reason}`);
+	for (const d of droppedEnvKeys) warnings.push(`Environment ${displayIdent(d.key)} dropped: ${d.reason}`);
+	for (const d of droppedSecretKeys) warnings.push(`Secret ${displayIdent(d.key)} dropped: ${d.reason}`);
 	const out = {
 		name,
 		image,
@@ -5278,10 +5360,10 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 	if (getAttImage) return classifyResolvedImage(getAttImage);
 	const joinResolved = tryResolveImageFnJoin(raw, resources, context);
 	if (joinResolved.kind === "resolved") return classifyResolvedImage(joinResolved.uri);
-	if (joinResolved.kind === "needs-state") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — ` + formatStateRemedy(context) + ", build via ContainerImage.fromAsset, or pin a public image.");
-	if (joinResolved.kind === "unsupported-join") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unsupported Fn::Join Image shape: ${joinResolved.reason}. ${getEmbedConfig().cliName} recognizes the canonical CDK 2.x ContainerImage.fromEcrRepository Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
+	if (joinResolved.kind === "needs-state") throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} references same-stack ECR repository ${displayIdent(joinResolved.repoLogicalId)} via Fn::Join. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — ` + formatStateRemedy(context) + ", build via ContainerImage.fromAsset, or pin a public image.");
+	if (joinResolved.kind === "unsupported-join") throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} has an unsupported Fn::Join Image shape: ${joinResolved.reason}. ${getEmbedConfig().cliName} recognizes the canonical CDK 2.x ContainerImage.fromEcrRepository Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
 	const flat = extractImageString(raw);
-	if (!flat) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unparseable Image property. ${getEmbedConfig().cliName} supports flat string images, single-key Fn::Sub bodies, and CDK-asset Image references.`);
+	if (!flat) throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} has an unparseable Image property. ${getEmbedConfig().cliName} supports flat string images, single-key Fn::Sub bodies, and CDK-asset Image references.`);
 	if (flat.includes("cdk-hnb659fds-container-assets-")) {
 		const hashMatch = /:([a-f0-9]{8,})$/.exec(flat);
 		const out = { kind: "cdk-asset" };
@@ -5291,9 +5373,9 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 	const substituted = substituteImagePlaceholders(flat, resources, context);
 	if (substituted.includes("${")) {
 		const unresolvedRepoRef = findUnresolvedEcrRepositoryRef(substituted, resources);
-		if (unresolvedRepoRef) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' references same-stack ECR repository '${unresolvedRepoRef}'. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — ` + formatStateRemedy(context) + ", build via ContainerImage.fromAsset, or pin a public image.");
-		if (substituted.includes("AWS::")) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image that references AWS pseudo parameters (${substituted}). ${getEmbedConfig().productName} could not resolve them: confirm AWS credentials are configured so STS GetCallerIdentity succeeds, and that --region / AWS_REGION names the target region. Workaround: build the image locally (ContainerImage.fromAsset) or pin a public image.`);
-		throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an Image with unresolved \${...} placeholders (${substituted}). ${getEmbedConfig().cliName} only resolves AWS pseudo parameters and same-stack AWS::ECR::Repository refs.`);
+		if (unresolvedRepoRef) throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} references same-stack ECR repository ${displayIdent(unresolvedRepoRef)}. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — ` + formatStateRemedy(context) + ", build via ContainerImage.fromAsset, or pin a public image.");
+		if (substituted.includes("AWS::")) throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} has an Image that references AWS pseudo parameters (${displayUntrustedValue(substituted)}). ${getEmbedConfig().productName} could not resolve them: confirm AWS credentials are configured so STS GetCallerIdentity succeeds, and that --region / AWS_REGION names the target region. Workaround: build the image locally (ContainerImage.fromAsset) or pin a public image.`);
+		throw new EcsTaskResolutionError(`Container ${displayIdent(containerName)} in task ${displayIdent(taskLogicalId)} has an Image with unresolved \${...} placeholders (${displayUntrustedValue(substituted)}). ${getEmbedConfig().cliName} only resolves AWS pseudo parameters and same-stack AWS::ECR::Repository refs.`);
 	}
 	const ecrHost = parseEcrRegistryHost(substituted);
 	if (ecrHost) return {
@@ -5375,12 +5457,12 @@ function extractImageString(value) {
 	}
 }
 function parseVolume(raw, idx, taskLogicalId, subContext) {
-	if (!raw || typeof raw !== "object") throw new EcsTaskResolutionError(`Task '${taskLogicalId}' Volumes[${idx}] is not an object.`);
+	if (!raw || typeof raw !== "object") throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} Volumes[${idx}] is not an object.`);
 	const v = raw;
 	const name = pickString(v["Name"]);
-	if (!name) throw new EcsTaskResolutionError(`Task '${taskLogicalId}' Volumes[${idx}] has no Name.`);
-	if (v["EFSVolumeConfiguration"]) throw new EcsTaskResolutionError(`Task '${taskLogicalId}' Volumes[${idx}] '${name}' uses EFSVolumeConfiguration, which ${getEmbedConfig().cliName} cannot proxy locally. Workaround: bind-mount a local directory at the same containerPath via Host: { SourcePath: '<local-path>' }, or override at runtime via --env-vars semantics for a Phase 2 follow-up.`);
-	if (v["FSxWindowsFileServerVolumeConfiguration"]) throw new EcsTaskResolutionError(`Task '${taskLogicalId}' Volumes[${idx}] '${name}' uses FSxWindowsFileServerVolumeConfiguration, which ${getEmbedConfig().cliName} cannot proxy locally.`);
+	if (!name) throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} Volumes[${idx}] has no Name.`);
+	if (v["EFSVolumeConfiguration"]) throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} Volumes[${idx}] ${displayIdent(name)} uses EFSVolumeConfiguration, which ${getEmbedConfig().cliName} cannot proxy locally. Workaround: bind-mount a local directory at the same containerPath via Host: { SourcePath: '<local-path>' }, or override at runtime via --env-vars semantics for a Phase 2 follow-up.`);
+	if (v["FSxWindowsFileServerVolumeConfiguration"]) throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} Volumes[${idx}] ${displayIdent(name)} uses FSxWindowsFileServerVolumeConfiguration, which ${getEmbedConfig().cliName} cannot proxy locally.`);
 	const dockerCfg = v["DockerVolumeConfiguration"];
 	if (dockerCfg && typeof dockerCfg === "object") {
 		const d = dockerCfg;
@@ -5422,11 +5504,11 @@ function parseVolume(raw, idx, taskLogicalId, subContext) {
 function resolveVolumeSourcePath(raw, volumeName, idx, taskLogicalId, subContext) {
 	if (raw === void 0 || raw === null) return void 0;
 	if (typeof raw === "string") return raw.length > 0 ? raw : void 0;
-	if (typeof raw !== "object") throw new EcsTaskResolutionError(`Task '${taskLogicalId}' Volumes[${idx}] '${volumeName}' Host.SourcePath must be a string or a CFn intrinsic, got ${typeof raw}.`);
-	if (!subContext) throw new EcsTaskResolutionError(`Task '${taskLogicalId}' Volumes[${idx}] '${volumeName}' Host.SourcePath is a CFn intrinsic (Ref/Fn::Sub/Fn::Join/Fn::GetAtt). Pass --from-state to substitute it against the deployed state + AWS pseudo parameters.`);
+	if (typeof raw !== "object") throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} Volumes[${idx}] ${displayIdent(volumeName)} Host.SourcePath must be a string or a CFn intrinsic, got ${typeof raw}.`);
+	if (!subContext) throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} Volumes[${idx}] ${displayIdent(volumeName)} Host.SourcePath is a CFn intrinsic (Ref/Fn::Sub/Fn::Join/Fn::GetAtt). Pass --from-state to substitute it against the deployed state + AWS pseudo parameters.`);
 	const sub = substituteAgainstState(raw, subContext);
 	if (sub.kind === "literal" && typeof sub.value === "string" && sub.value.length > 0) return sub.value;
-	throw new EcsTaskResolutionError(`Task '${taskLogicalId}' Volumes[${idx}] '${volumeName}' Host.SourcePath could not be resolved: ` + (sub.kind === "literal" ? "resolved to non-string / empty value" : sub.reason));
+	throw new EcsTaskResolutionError(`Task ${displayIdent(taskLogicalId)} Volumes[${idx}] ${displayIdent(volumeName)} Host.SourcePath could not be resolved: ` + (sub.kind === "literal" ? "resolved to non-string / empty value" : sub.reason));
 }
 const TASK_ROLE_ACCOUNT_PLACEHOLDER = "${AWS::AccountId}";
 function resolveRoleArn(value, resources, subContext) {
@@ -5479,7 +5561,7 @@ function notFoundError$1(target, stack, resources) {
 	else {
 		const width = Math.max(...tasks.map((t) => t.displayPath.length));
 		msg += `Available task definitions in ${stack.stackName}:\n`;
-		for (const t of tasks) msg += `  ${t.displayPath.padEnd(width)}  (${t.logicalId})\n`;
+		for (const t of tasks) msg += `  ${t.displayPath.padEnd(width)}  (${displayIdent(t.logicalId)})\n`;
 	}
 	return new EcsTaskResolutionError(msg.trimEnd());
 }
@@ -5539,13 +5621,13 @@ async function applyCrossStackResolverToTask(task, context) {
 		}
 		if (resolvedEnvKeys.size > 0 || resolvedSecretNames.size > 0) {
 			container.warnings = container.warnings.filter((w) => {
-				for (const k of resolvedEnvKeys) if (w.startsWith(`Environment '${k}' dropped:`)) return false;
-				for (const k of resolvedSecretNames) if (w.startsWith(`Secret '${k}' dropped:`)) return false;
+				for (const k of resolvedEnvKeys) if (w.startsWith(`Environment ${displayIdent(k)} dropped:`)) return false;
+				for (const k of resolvedSecretNames) if (w.startsWith(`Secret ${displayIdent(k)} dropped:`)) return false;
 				return true;
 			});
 			task.warnings = task.warnings.filter((w) => {
-				for (const k of resolvedEnvKeys) if (w.startsWith(`Container '${containerName}': Environment '${k}' dropped:`)) return false;
-				for (const k of resolvedSecretNames) if (w.startsWith(`Container '${containerName}': Secret '${k}' dropped:`)) return false;
+				for (const k of resolvedEnvKeys) if (w.startsWith(`Container ${displayIdent(containerName)}: Environment ${displayIdent(k)} dropped:`)) return false;
+				for (const k of resolvedSecretNames) if (w.startsWith(`Container ${displayIdent(containerName)}: Secret ${displayIdent(k)} dropped:`)) return false;
 				return true;
 			});
 		}
@@ -5642,7 +5724,7 @@ function resolveRuntimeImage(runtime) {
 }
 function resolveRuntimeFileExtension(runtime) {
 	const spec = resolveRuntimeSpec(runtime);
-	if (spec.fileExtension === null) throw new UnsupportedRuntimeError(runtime, `Inline 'Code.ZipFile' is not supported for runtime '${runtime}'. The Lambda Handler shape for this runtime names a compiled artifact (a JVM class, a .NET assembly, or — for the OS-only \`provided.*\` runtimes — an arbitrary \`bootstrap\` binary) that cannot be expressed as a single inline source file. Use \`lambda.Code.fromAsset(<dir>)\` with a directory containing the compiled output (.class hierarchy / JAR / DLL / native binary).`);
+	if (spec.fileExtension === null) throw new UnsupportedRuntimeError(runtime, `Inline 'Code.ZipFile' is not supported for runtime ${displayIdent(runtime)}. The Lambda Handler shape for this runtime names a compiled artifact (a JVM class, a .NET assembly, or — for the OS-only \`provided.*\` runtimes — an arbitrary \`bootstrap\` binary) that cannot be expressed as a single inline source file. Use \`lambda.Code.fromAsset(<dir>)\` with a directory containing the compiled output (.class hierarchy / JAR / DLL / native binary).`);
 	return spec.fileExtension;
 }
 function resolveRuntimeSpec(runtime) {
@@ -5650,7 +5732,7 @@ function resolveRuntimeSpec(runtime) {
 	const spec = SUPPORTED_RUNTIMES[runtime];
 	if (spec) return spec;
 	if (runtime === "go1.x") throw new UnsupportedRuntimeError(runtime, "Runtime 'go1.x' was deprecated by AWS Lambda on 2024-01-08 and is no longer available. Migrate to the OS-only runtime: build your Go program as a `bootstrap` binary and set the CDK runtime to `lambda.Runtime.PROVIDED_AL2023` (or `lambda.Runtime.PROVIDED_AL2`). See https://docs.aws.amazon.com/lambda/latest/dg/lambda-golang.html");
-	throw new UnsupportedRuntimeError(runtime, `Unknown runtime '${runtime}'. ${getEmbedConfig().cliName} invoke supports nodejs18.x / nodejs20.x / nodejs22.x / nodejs24.x / python3.11 / python3.12 / python3.13 / python3.14 / ruby3.2 / ruby3.3 / java8.al2 / java11 / java17 / java21 / dotnet6 / dotnet8 / provided.al2 / provided.al2023.`);
+	throw new UnsupportedRuntimeError(runtime, `Unknown runtime ${displayIdent(runtime)}. ${getEmbedConfig().cliName} invoke supports nodejs18.x / nodejs20.x / nodejs22.x / nodejs24.x / python3.11 / python3.12 / python3.13 / python3.14 / ruby3.2 / ruby3.3 / java8.al2 / java11 / java17 / java21 / dotnet6 / dotnet8 / provided.al2 / provided.al2023.`);
 }
 function resolveRuntimeCodeMountPath(runtime) {
 	resolveRuntimeSpec(runtime);
@@ -6101,7 +6183,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 			result = await spawnStreaming(cmd, args, { cwd });
 		} catch (err) {
 			const e = err;
-			throw options.wrapError(e.stderr || e.message || String(err));
+			throw options.wrapError(displayToolOutput(e.stderr || e.message || String(err)));
 		}
 		const tag = result.stdout.trim();
 		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${displayUntrustedValue(cmd)}`);
@@ -6113,7 +6195,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 	const contextDir = contextDirectory(source.directory, `send that directory to docker build as the context of an image ${getEmbedConfig().productName} then runs locally`);
 	buildArgs.push(".");
 	warnEscapingBuildKitPaths(source, contextDir, assetOutdir);
-	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).map((a) => displayUntrustedValue(a)).join(" ")} (cwd=${displayUntrustedValue(contextDir)})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
@@ -6122,7 +6204,7 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		});
 	} catch (err) {
 		const e = err;
-		throw options.wrapError(e.stderr || e.message || String(err));
+		throw options.wrapError(displayToolOutput(e.stderr || e.message || String(err)));
 	}
 	return options.tag;
 }
@@ -6175,7 +6257,7 @@ function isCredentialFresh(creds) {
 async function pullEcrImage(imageUri, options) {
 	const logger = getLogger().child("ecr-puller");
 	const parsed = parseEcrUri(imageUri);
-	if (!parsed) throw new LocalInvokeBuildError(`Image URI '${imageUri}' is not an ECR URI. ${getEmbedConfig().cliName} invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
+	if (!parsed) throw new LocalInvokeBuildError(`Image URI ${displayUntrustedValue(imageUri)} is not an ECR URI. ${getEmbedConfig().cliName} invoke v1 only authenticates against ECR for the deployed-image fallback path.`);
 	const canonicalUri = parsed.canonicalUri;
 	const callerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"];
 	if (options.skipPull) {
@@ -6299,7 +6381,7 @@ async function verifyImageInLocalCache(imageUri) {
 			imageUri
 		]);
 	} catch {
-		throw new LocalInvokeBuildError(`Image '${imageUri}' is not in the local docker cache and --no-pull was set. Either remove --no-pull (${getEmbedConfig().productName} will pull from ECR) or pre-pull the image manually with \`docker pull\`.`);
+		throw new LocalInvokeBuildError(`Image ${displayUntrustedValue(imageUri)} is not in the local docker cache and --no-pull was set. Either remove --no-pull (${getEmbedConfig().productName} will pull from ECR) or pre-pull the image manually with \`docker pull\`.`);
 	}
 }
 async function isImageInLocalCache(imageRef) {
@@ -6323,7 +6405,7 @@ async function buildContainerImage(asset, cdkOutDir, options) {
 	const logger = getLogger().child("local-invoke-build");
 	if (options.noBuild === true) {
 		logger.info(`Skipping docker build (--no-build). Verifying ${tag} is in local registry...`);
-		if (!await isImageInLocalCache(tag)) throw new LocalInvokeBuildError(`image '${tag}' not in local registry and --no-build is set; remove --no-build or run \`docker build\` manually first.`);
+		if (!await isImageInLocalCache(tag)) throw new LocalInvokeBuildError(`image ${displayIdent(tag)} not in local registry and --no-build is set; remove --no-build or run \`docker build\` manually first.`);
 		logger.debug(`Local tag ${tag} is cached; skipping build.`);
 		return tag;
 	}
@@ -6337,7 +6419,7 @@ async function buildContainerImage(asset, cdkOutDir, options) {
 		...options.assetOutdir !== void 0 && { assetOutdir: options.assetOutdir }
 	});
 	if (actualTag !== tag) {
-		logger.debug(`Re-tagging executable-built image '${actualTag}' → '${tag}'`);
+		logger.debug(`Re-tagging executable-built image ${displayIdent(actualTag)} → ${displayIdent(tag)}`);
 		try {
 			await runDockerStreaming([
 				"tag",
@@ -6346,7 +6428,7 @@ async function buildContainerImage(asset, cdkOutDir, options) {
 			]);
 		} catch (err) {
 			const e = err;
-			throw new LocalInvokeBuildError(`docker tag failed re-tagging '${actualTag}' → '${tag}': ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new LocalInvokeBuildError(`docker tag failed re-tagging ${displayIdent(actualTag)} → ${displayIdent(tag)}: ${displayToolOutput(e.stderr?.trim() || e.message || String(err))}`);
 		}
 	}
 	return tag;
@@ -6365,7 +6447,7 @@ function warnIfEmulatedPlatform(platform, opts = {}) {
 	if (warnedEmulatedPlatforms.has(platform)) return;
 	warnedEmulatedPlatforms.add(platform);
 	const logger = opts.logger ?? getLogger();
-	const what = opts.label ? `'${opts.label}' ` : "";
+	const what = opts.label ? `${displayIdent(opts.label)} ` : "";
 	logger.warn(`Running ${what}under ${platform} emulation on a ${host} host (the declared architecture differs from the host). Emulation is slower and some compiled binaries can fail under it. If the container does not run correctly, enable Rosetta for x86/amd64 emulation in your Docker engine settings, or build the function for ${host}.`);
 }
 function computeLocalTag(source) {
@@ -6417,12 +6499,12 @@ var DockerRunnerError = class DockerRunnerError extends Error {
 async function pullImage(image, skipPull, platform) {
 	const logger = getLogger().child("docker");
 	if (skipPull) {
-		logger.debug(`Skipping docker pull for ${image} (--no-pull)`);
+		logger.debug(`Skipping docker pull for ${displayIdent(image)} (--no-pull)`);
 		return;
 	}
 	const platformArgs = platform ? ["--platform", platform] : [];
 	if (getLogger().getLevel() === "debug") {
-		logger.info(`Pulling ${image}${platform ? ` (${platform})` : ""}...`);
+		logger.info(`Pulling ${displayIdent(image)}${platform ? ` (${displayIdent(platform)})` : ""}...`);
 		try {
 			await runDockerForeground([
 				"pull",
@@ -6430,11 +6512,12 @@ async function pullImage(image, skipPull, platform) {
 				image
 			]);
 		} catch (err) {
-			throw new DockerRunnerError(`docker pull ${image} failed: ${err.message}`);
+			const e = err;
+			throw new DockerRunnerError(`docker pull ${displayIdent(image)} failed: ${e.message}`);
 		}
 		return;
 	}
-	logger.debug(`Pulling ${image} (silent — pass --verbose to stream progress)`);
+	logger.debug(`Pulling ${displayIdent(image)} (silent — pass --verbose to stream progress)`);
 	try {
 		await runDockerStreaming([
 			"pull",
@@ -6442,13 +6525,13 @@ async function pullImage(image, skipPull, platform) {
 			image
 		], {
 			streamLive: false,
-			progressLabel: `Pulling ${image}`
+			progressLabel: `Pulling ${displayIdent(image)}`
 		});
 	} catch (err) {
 		const e = err;
-		if (e.exitCode === void 0 || e.exitCode === null) throw new DockerRunnerError(`docker pull ${image} failed: ${e.message ?? String(err)}`);
+		if (e.exitCode === void 0 || e.exitCode === null) throw new DockerRunnerError(`docker pull ${displayIdent(image)} failed: ${displayToolOutput(e.message ?? String(err))}`);
 		const detail = e.stderr?.trim() || e.stdout?.trim() || "(no output)";
-		throw new DockerRunnerError(`docker pull ${image} exited with code ${e.exitCode}: ${detail}`);
+		throw new DockerRunnerError(`docker pull ${displayIdent(image)} exited with code ${e.exitCode}: ${displayToolOutput(detail)}`);
 	}
 }
 async function runDetached(opts) {
@@ -6486,7 +6569,7 @@ async function runDetached(opts) {
 	}
 	args.push(opts.image, ...entryPointTail, ...opts.cmd);
 	const logger = getLogger().child("docker");
-	logger.debug(flattenToOneLine(`${getDockerCmd()} ${redactDockerArgvValues(args).join(" ")}`));
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(args).map((a) => displayUntrustedValue(a)).join(" ")}`);
 	if (collisions.length > 0) logger.warn(describeRefusedSensitiveEnvKeys(`Container for image ${displayUntrustedValue(opts.image)}`, collisions));
 	const forwardedKeys = Object.keys(passthroughEnv);
 	const refusal = finchSecretArgvRefusal(forwardedKeys.filter((k) => opts.sensitiveEnvKeys?.has(k)), {
@@ -6502,8 +6585,40 @@ async function runDetached(opts) {
 		});
 		return stdout.trim();
 	} catch (error) {
-		throw new DockerRunnerError(`docker run failed: ${error.stderr?.trim() || describeExitWithoutArgv(error)}`);
-	}
+		throw new DockerRunnerError(`docker run failed: ${displayToolOutput(error.stderr?.trim() || describeExitWithoutArgv(error))}`);
+	}
+}
+const PREFIX_CONTAINER_OUTPUT_ENV = "CDKL_PREFIX_CONTAINER_OUTPUT";
+const MAX_HELD_LINE_CHARS = 64 * 1024;
+function createPrefixedLineRelay(prefix, out) {
+	const decoder = new StringDecoder("utf8");
+	let pending = "";
+	const emit = (text) => {
+		let nl = text.indexOf("\n");
+		if (nl !== -1) nl += pending.length;
+		pending += text;
+		while (nl !== -1) {
+			out.write(`${prefix}${pending.slice(0, nl + 1)}`);
+			pending = pending.slice(nl + 1);
+			nl = pending.indexOf("\n");
+		}
+		while (pending.length >= MAX_HELD_LINE_CHARS) {
+			const high = pending.charCodeAt(MAX_HELD_LINE_CHARS - 1);
+			const cut = high >= 55296 && high <= 56319 ? MAX_HELD_LINE_CHARS - 1 : MAX_HELD_LINE_CHARS;
+			out.write(`${prefix}${pending.slice(0, cut)}\n`);
+			pending = pending.slice(cut);
+		}
+	};
+	return {
+		push: (chunk) => emit(decoder.write(chunk)),
+		flush: () => {
+			emit(decoder.end());
+			if (pending.length > 0) {
+				out.write(`${prefix}${pending}\n`);
+				pending = "";
+			}
+		}
+	};
 }
 function streamLogs(containerId) {
 	const proc = spawn(getDockerCmd(), [
@@ -6515,10 +6630,25 @@ function streamLogs(containerId) {
 		"pipe",
 		"pipe"
 	] });
-	proc.stdout?.on("data", (chunk) => process.stdout.write(chunk));
-	proc.stderr?.on("data", (chunk) => process.stderr.write(chunk));
+	let flush = () => void 0;
+	if (process.env["CDKL_PREFIX_CONTAINER_OUTPUT"] === "1") {
+		const tag = `[${flattenToOneLine(containerId.slice(0, 12)).replace(/[\]\s]/g, "_")}] `;
+		const stdoutRelay = createPrefixedLineRelay(tag, process.stdout);
+		const stderrRelay = createPrefixedLineRelay(tag, process.stderr);
+		proc.stdout?.on("data", (chunk) => stdoutRelay.push(chunk));
+		proc.stderr?.on("data", (chunk) => stderrRelay.push(chunk));
+		flush = () => {
+			stdoutRelay.flush();
+			stderrRelay.flush();
+		};
+		proc.on("close", () => flush());
+	} else {
+		proc.stdout?.on("data", (chunk) => process.stdout.write(chunk));
+		proc.stderr?.on("data", (chunk) => process.stderr.write(chunk));
+	}
 	proc.on("error", () => {});
 	return () => {
+		flush();
 		if (!proc.killed) proc.kill("SIGTERM");
 	};
 }
@@ -6604,29 +6734,33 @@ function execEnvForSecrets(passthrough) {
 //#region src/assets/asset-manifest-loader.ts
 var AssetManifestLoader = class {
 	logger = getLogger().child("AssetManifestLoader");
-	async loadManifest(cdkOutputDir, stackName) {
-		const resolved = resolveAssemblyPath(cdkOutputDir, `${stackName}.assets.json`);
+	async loadStackManifest(stack, fallbackDir) {
+		if (stack.assetManifestPath) return this.loadManifest(dirname$1(stack.assetManifestPath), stack.stackName, basename$1(stack.assetManifestPath));
+		return this.loadManifest(fallbackDir, stack.stackName);
+	}
+	async loadManifest(cdkOutputDir, stackName, fileName = `${stackName}.assets.json`) {
+		const resolved = resolveAssemblyPath(cdkOutputDir, fileName);
 		if (!resolved.contained) throw new Error(`Refusing to read the asset manifest for stack ${displayUntrustedValue(stackName)}: it ` + renderAssemblyPathEscape(resolved, cdkOutputDir, "read it"));
-		const manifestPath = join$1(cdkOutputDir, `${stackName}.assets.json`);
+		const manifestPath = join$1(cdkOutputDir, fileName);
 		try {
-			this.logger.debug(`Loading asset manifest from: ${manifestPath}`);
+			this.logger.debug(`Loading asset manifest from: ${displayUntrustedValue(manifestPath)}`);
 			const content = await readFile(manifestPath, "utf-8");
 			const manifest = JSON.parse(content);
 			this.logger.debug(`Loaded asset manifest: ${Object.keys(manifest.files).length} file assets, ${Object.keys(manifest.dockerImages).length} docker image assets`);
 			return manifest;
 		} catch (error) {
 			if (error.code === "ENOENT") {
-				this.logger.debug(`Asset manifest not found: ${manifestPath}`);
+				this.logger.debug(`Asset manifest not found: ${displayUntrustedValue(manifestPath)}`);
 				return null;
 			}
-			throw new Error(`Failed to load asset manifest from ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`);
+			throw new Error(`Failed to load asset manifest from ${displayUntrustedValue(manifestPath)}: ${error instanceof Error ? error.message : String(error)}`);
 		}
 	}
 	getFileAssets(manifest) {
 		const fileAssets = /* @__PURE__ */ new Map();
 		for (const [assetHash, asset] of Object.entries(manifest.files)) {
 			if (asset.source.path.endsWith(".json") || asset.source.path.endsWith(".template.json")) {
-				this.logger.debug(`Skipping CloudFormation template asset: ${asset.displayName}`);
+				this.logger.debug(`Skipping CloudFormation template asset: ${displayStackName(asset.displayName)}`);
 				continue;
 			}
 			fileAssets.set(assetHash, asset);
@@ -7226,7 +7360,7 @@ function attachWebSocketServer(opts) {
 				try {
 					ws.close(1008, "Forbidden");
 				} catch {}
-				logger.info(`WebSocket $connect denied for connection ${connectionId} on ${cfg.api.declaredAt} — authorizer returned a non-allow verdict. Client was closed with code 1008.`);
+				logger.info(`WebSocket $connect denied for connection ${connectionId} on ${displayStackName(cfg.api.declaredAt)} — authorizer returned a non-allow verdict. Client was closed with code 1008.`);
 				return;
 			}
 		}
@@ -7245,7 +7379,7 @@ function attachWebSocketServer(opts) {
 			stage: cfg.api.stage
 		};
 		registry.register(entry);
-		logger.debug(`WebSocket connected: ${connectionId} (${cfg.api.declaredAt}, stage=${cfg.api.stage})`);
+		logger.debug(`WebSocket connected: ${connectionId} (${displayStackName(cfg.api.declaredAt)}, stage=${cfg.api.stage})`);
 		ws.on("message", (raw, isBinary) => {
 			const { body, isBase64Encoded } = bufferToBody(raw, isBinary);
 			logger.debug(`WebSocket message received for connection ${connectionId}: ${body.slice(0, 200)}`);
@@ -7636,10 +7770,10 @@ var VtlEvaluator = class {
 	handleSetDirective(block, after) {
 		const { args, end } = this.readParenArgs(block, after);
 		const eq = args.indexOf("=");
-		if (eq === -1) throw new VtlEvaluationError(`#set requires '=': got #set(${args})`);
+		if (eq === -1) throw new VtlEvaluationError(`#set requires '=': got #set(${displayUntrustedValue(args)})`);
 		const left = args.slice(0, eq).trim();
 		const right = args.slice(eq + 1).trim();
-		if (!left.startsWith("$")) throw new VtlEvaluationError(`#set left side must be a $var reference (got '${left}')`);
+		if (!left.startsWith("$")) throw new VtlEvaluationError(`#set left side must be a $var reference (got ${displayUntrustedValue(left)})`);
 		const varName = left.slice(1).replace(/^\{/, "").replace(/\}$/, "");
 		const value = this.evaluateExpression(right);
 		this.scopes[this.scopes.length - 1].set(varName, value);
@@ -7923,7 +8057,7 @@ var VtlEvaluator = class {
 				return this.callValueAsMethod(value, argsRaw, refPath);
 			}
 		}
-		throw new VtlEvaluationError(`Could not evaluate VTL sub-expression: '${trimmed}'`);
+		throw new VtlEvaluationError(`Could not evaluate VTL sub-expression: ${displayUntrustedValue(trimmed)}`);
 	}
 	unescapeStringLiteral(s) {
 		return s.replace(/\\n/g, "\n").replace(/\\r/g, "\r").replace(/\\t/g, "	").replace(/\\\\/g, "\\").replace(/\\"/g, "\"").replace(/\\'/g, "'");
@@ -8103,7 +8237,7 @@ function buildVtlInput(body, headers, querystring, pathParams) {
 function applyJsonPath(root, expr) {
 	const trimmed = expr.trim();
 	if (trimmed === "$" || trimmed.length === 0) return root;
-	if (!trimmed.startsWith("$")) throw new VtlEvaluationError(`JSONPath must start with '$': got '${trimmed}'`);
+	if (!trimmed.startsWith("$")) throw new VtlEvaluationError(`JSONPath must start with '$': got ${displayUntrustedValue(trimmed)}`);
 	let cursor = root;
 	let i = 1;
 	while (i < trimmed.length) {
@@ -8111,25 +8245,25 @@ function applyJsonPath(root, expr) {
 		if (c === ".") {
 			i++;
 			const m = /^[a-zA-Z_][a-zA-Z_0-9]*/.exec(trimmed.slice(i));
-			if (!m) throw new VtlEvaluationError(`Unsupported JSONPath syntax at position ${i}: '${trimmed}' (${getEmbedConfig().productName} supports $, $.field, $.field.sub, $.array[index] only).`);
+			if (!m) throw new VtlEvaluationError(`Unsupported JSONPath syntax at position ${i}: ${displayUntrustedValue(trimmed)} (${getEmbedConfig().productName} supports $, $.field, $.field.sub, $.array[index] only).`);
 			cursor = lookupField(cursor, m[0]);
 			i += m[0].length;
 			continue;
 		}
 		if (c === "[") {
 			const close = trimmed.indexOf("]", i);
-			if (close === -1) throw new VtlEvaluationError(`Unterminated [ in JSONPath: '${trimmed}'`);
+			if (close === -1) throw new VtlEvaluationError(`Unterminated [ in JSONPath: ${displayUntrustedValue(trimmed)}`);
 			const inside = trimmed.slice(i + 1, close).trim();
 			if (/^-?\d+$/.test(inside)) {
 				const idx = Number(inside);
 				if (Array.isArray(cursor)) cursor = cursor[idx];
 				else cursor = null;
 			} else if (inside.startsWith("\"") && inside.endsWith("\"") || inside.startsWith("'") && inside.endsWith("'")) cursor = lookupField(cursor, inside.slice(1, -1));
-			else throw new VtlEvaluationError(`Unsupported JSONPath bracket expression: '${inside}' (${getEmbedConfig().productName} supports integer indices and quoted string keys only).`);
+			else throw new VtlEvaluationError(`Unsupported JSONPath bracket expression: ${displayUntrustedValue(inside)} (${getEmbedConfig().productName} supports integer indices and quoted string keys only).`);
 			i = close + 1;
 			continue;
 		}
-		throw new VtlEvaluationError(`Unexpected character in JSONPath at position ${i}: '${trimmed}'`);
+		throw new VtlEvaluationError(`Unexpected character in JSONPath at position ${i}: ${displayUntrustedValue(trimmed)}`);
 	}
 	return cursor;
 }
@@ -8203,7 +8337,7 @@ function evaluateResponseParameters(responseParameters, opts = {}) {
 			out[headerName] = value.slice(1, -1);
 			continue;
 		}
-		opts.onUnsupported?.(key, value, `ResponseParameter value '${value}' is a mapping expression (integration.response.* / context.*) which ${getEmbedConfig().cliName} start-api does not emulate. Only single-quoted literals are honored.`);
+		opts.onUnsupported?.(key, value, `ResponseParameter value ${displayIdent(value)} is a mapping expression (integration.response.* / context.*) which ${getEmbedConfig().cliName} start-api does not emulate. Only single-quoted literals are honored.`);
 	}
 	return out;
 }
@@ -8581,16 +8715,16 @@ function applyRequestParameters(requestParameters, req, out) {
 	for (const [key, value] of Object.entries(requestParameters)) {
 		const resolved = resolveRequestParameterValue(value, req);
 		if (resolved === void 0) {
-			logger.warn(`RequestParameter '${key}' value '${value}' is not a recognized mapping; skipping.`);
+			logger.warn(`RequestParameter ${displayIdent(key)} value ${displayIdent(value)} is not a recognized mapping; skipping.`);
 			continue;
 		}
 		const headerMatch = /^integration\.request\.header\.(.+)$/.exec(key);
 		const queryMatch = /^integration\.request\.querystring\.(.+)$/.exec(key);
 		const pathMatch = /^integration\.request\.path\.(.+)$/.exec(key);
 		if (headerMatch) out.headers[headerMatch[1].toLowerCase()] = resolved;
-		else if (queryMatch) logger.warn(`RequestParameter '${key}' (querystring rewrite) is recognized but ${getEmbedConfig().productName} applies querystring rewrites only via URI placeholder substitution; ignoring.`);
-		else if (pathMatch) logger.warn(`RequestParameter '${key}' (path rewrite) is recognized but ${getEmbedConfig().productName} substitutes path placeholders via {param} in the URI; ignoring.`);
-		else logger.warn(`Unsupported RequestParameter key '${key}'; skipping.`);
+		else if (queryMatch) logger.warn(`RequestParameter ${displayIdent(key)} (querystring rewrite) is recognized but ${getEmbedConfig().productName} applies querystring rewrites only via URI placeholder substitution; ignoring.`);
+		else if (pathMatch) logger.warn(`RequestParameter ${displayIdent(key)} (path rewrite) is recognized but ${getEmbedConfig().productName} substitutes path placeholders via {param} in the URI; ignoring.`);
+		else logger.warn(`Unsupported RequestParameter key ${displayIdent(key)}; skipping.`);
 	}
 }
 function resolveRequestParameterValue(raw, req) {
@@ -8735,7 +8869,7 @@ function createContainerPool(specs, options) {
 		try {
 			handle.stopLogStream();
 		} catch (err) {
-			logger.debug(`stopLogStream(${handle.containerName}) failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`stopLogStream(${displayIdent(handle.containerName)}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		try {
 			await removeContainer(handle.containerId);
@@ -8767,7 +8901,7 @@ function createContainerPool(specs, options) {
 	return {
 		async acquire(logicalId) {
 			const entry = entries.get(logicalId);
-			if (!entry) throw new Error(`containerPool.acquire: no spec registered for Lambda '${logicalId}'. This is a bug — every reachable route's Lambda should be registered at server boot.`);
+			if (!entry) throw new Error(`containerPool.acquire: no spec registered for Lambda ${displayIdent(logicalId)}. This is a bug — every reachable route's Lambda should be registered at server boot.`);
 			if (entry.warm.length > 0) {
 				const handle = entry.warm.shift();
 				entry.inUse.add(handle);
@@ -9627,13 +9761,13 @@ function buildAuthorizerContextShape(authorizer, result) {
 //#region src/local/authorizer-resolver.ts
 function resolveRestV1Authorizer(authorizerLogicalId, template, stackName, declaredAt) {
 	const authResource = template.Resources?.[authorizerLogicalId];
-	if (!authResource || authResource.Type !== "AWS::ApiGateway::Authorizer") throw new RouteDiscoveryError(`${declaredAt}: AuthorizerId '${authorizerLogicalId}' does not point at an AWS::ApiGateway::Authorizer in stack '${stackName}'.`);
+	if (!authResource || authResource.Type !== "AWS::ApiGateway::Authorizer") throw new RouteDiscoveryError(`${displayStackName(declaredAt)}: AuthorizerId ${displayIdent(authorizerLogicalId)} does not point at an AWS::ApiGateway::Authorizer in stack ${displayStackName(stackName)}.`);
 	const props = authResource.Properties ?? {};
 	const type = props["Type"];
 	if (type === "TOKEN") return {
 		kind: "lambda-token",
 		logicalId: authorizerLogicalId,
-		lambdaLogicalId: resolveLambdaArn(props["AuthorizerUri"], `${stackName}/${authorizerLogicalId}.AuthorizerUri`),
+		lambdaLogicalId: resolveLambdaArn(props["AuthorizerUri"], `${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}.AuthorizerUri`),
 		tokenHeader: parseRestV1HeaderSelector(typeof props["IdentitySource"] === "string" ? props["IdentitySource"] : "method.request.header.Authorization", stackName, authorizerLogicalId),
 		resultTtlSeconds: parseTtl(props["AuthorizerResultTtlInSeconds"], 300, 3600),
 		declaredAt
@@ -9641,7 +9775,7 @@ function resolveRestV1Authorizer(authorizerLogicalId, template, stackName, decla
 	if (type === "REQUEST") return {
 		kind: "lambda-request",
 		logicalId: authorizerLogicalId,
-		lambdaLogicalId: resolveLambdaArn(props["AuthorizerUri"], `${stackName}/${authorizerLogicalId}.AuthorizerUri`),
+		lambdaLogicalId: resolveLambdaArn(props["AuthorizerUri"], `${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}.AuthorizerUri`),
 		identitySources: parseRestV1IdentitySources(typeof props["IdentitySource"] === "string" ? props["IdentitySource"] : ""),
 		resultTtlSeconds: parseTtl(props["AuthorizerResultTtlInSeconds"], 300, 3600),
 		apiVersion: "v1",
@@ -9649,10 +9783,10 @@ function resolveRestV1Authorizer(authorizerLogicalId, template, stackName, decla
 	};
 	if (type === "COGNITO_USER_POOLS") {
 		const arns = props["ProviderARNs"];
-		if (!Array.isArray(arns) || arns.length === 0) throw new RouteDiscoveryError(`${stackName}/${authorizerLogicalId}: COGNITO_USER_POOLS authorizer is missing ProviderARNs.`);
+		if (!Array.isArray(arns) || arns.length === 0) throw new RouteDiscoveryError(`${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}: COGNITO_USER_POOLS authorizer is missing ProviderARNs.`);
 		const pools = arns.map((entry, idx) => {
-			const arn = pickStringFromArn(entry, `${stackName}/${authorizerLogicalId}.ProviderARNs[${idx}]`);
-			const parsed = parseCognitoUserPoolArn(arn, `${stackName}/${authorizerLogicalId}.ProviderARNs[${idx}]`);
+			const arn = pickStringFromArn(entry, `${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}.ProviderARNs[${idx}]`);
+			const parsed = parseCognitoUserPoolArn(arn, `${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}.ProviderARNs[${idx}]`);
 			return {
 				userPoolArn: arn,
 				region: parsed.region,
@@ -9670,17 +9804,17 @@ function resolveRestV1Authorizer(authorizerLogicalId, template, stackName, decla
 			declaredAt
 		};
 	}
-	throw new RouteDiscoveryError(`${stackName}/${authorizerLogicalId}: AWS::ApiGateway::Authorizer.Type '${String(type)}' is not supported by ${getEmbedConfig().cliName} start-api (only TOKEN / REQUEST / COGNITO_USER_POOLS are accepted at the Authorizer resource).`);
+	throw new RouteDiscoveryError(`${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}: AWS::ApiGateway::Authorizer.Type ${displayIdent(stringifyValue(type))} is not supported by ${getEmbedConfig().cliName} start-api (only TOKEN / REQUEST / COGNITO_USER_POOLS are accepted at the Authorizer resource).`);
 }
 function resolveHttpApiAuthorizer(authorizerLogicalId, routeAuthorizationScopes, template, stackName, declaredAt) {
 	const authResource = template.Resources?.[authorizerLogicalId];
-	if (!authResource || authResource.Type !== "AWS::ApiGatewayV2::Authorizer") throw new RouteDiscoveryError(`${declaredAt}: AuthorizerId '${authorizerLogicalId}' does not point at an AWS::ApiGatewayV2::Authorizer in stack '${stackName}'.`);
+	if (!authResource || authResource.Type !== "AWS::ApiGatewayV2::Authorizer") throw new RouteDiscoveryError(`${displayStackName(declaredAt)}: AuthorizerId ${displayIdent(authorizerLogicalId)} does not point at an AWS::ApiGatewayV2::Authorizer in stack ${displayStackName(stackName)}.`);
 	const props = authResource.Properties ?? {};
 	const authType = props["AuthorizerType"];
 	if (authType === "REQUEST") return {
 		kind: "lambda-request",
 		logicalId: authorizerLogicalId,
-		lambdaLogicalId: resolveLambdaArn(props["AuthorizerUri"], `${stackName}/${authorizerLogicalId}.AuthorizerUri`),
+		lambdaLogicalId: resolveLambdaArn(props["AuthorizerUri"], `${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}.AuthorizerUri`),
 		identitySources: parseHttpV2IdentitySources(props["IdentitySource"]),
 		resultTtlSeconds: parseTtl(props["AuthorizerResultTtlInSeconds"], 0, 3600),
 		apiVersion: "v2",
@@ -9688,10 +9822,10 @@ function resolveHttpApiAuthorizer(authorizerLogicalId, routeAuthorizationScopes,
 	};
 	if (authType === "JWT") {
 		const jwt = props["JwtConfiguration"];
-		if (!jwt || typeof jwt !== "object") throw new RouteDiscoveryError(`${stackName}/${authorizerLogicalId}: AWS::ApiGatewayV2::Authorizer.JwtConfiguration is required for AuthorizerType=JWT.`);
+		if (!jwt || typeof jwt !== "object") throw new RouteDiscoveryError(`${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}: AWS::ApiGatewayV2::Authorizer.JwtConfiguration is required for AuthorizerType=JWT.`);
 		const obj = jwt;
 		const issuer = obj["Issuer"];
-		if (typeof issuer !== "string" || issuer.length === 0) throw new RouteDiscoveryError(`${stackName}/${authorizerLogicalId}: JwtConfiguration.Issuer must be a string.`);
+		if (typeof issuer !== "string" || issuer.length === 0) throw new RouteDiscoveryError(`${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}: JwtConfiguration.Issuer must be a string.`);
 		const audienceRaw = obj["Audience"];
 		const audience = Array.isArray(audienceRaw) ? audienceRaw.filter((s) => typeof s === "string") : [];
 		const cognito = parseCognitoIssuer(issuer);
@@ -9707,7 +9841,7 @@ function resolveHttpApiAuthorizer(authorizerLogicalId, routeAuthorizationScopes,
 			declaredAt
 		};
 	}
-	throw new RouteDiscoveryError(`${stackName}/${authorizerLogicalId}: AWS::ApiGatewayV2::Authorizer.AuthorizerType '${String(authType)}' is not supported by ${getEmbedConfig().cliName} start-api (only REQUEST / JWT).`);
+	throw new RouteDiscoveryError(`${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}: AWS::ApiGatewayV2::Authorizer.AuthorizerType ${displayIdent(stringifyValue(authType))} is not supported by ${getEmbedConfig().cliName} start-api (only REQUEST / JWT).`);
 }
 var AuthorizerLambdaUnresolvableError = class AuthorizerLambdaUnresolvableError extends RouteDiscoveryError {
 	reason;
@@ -9725,7 +9859,7 @@ function resolveLambdaArn(value, location) {
 }
 function parseRestV1HeaderSelector(identitySource, stackName, authorizerLogicalId) {
 	const m = /^method\.request\.header\.([A-Za-z0-9-_]+)$/.exec(identitySource.trim());
-	if (!m) throw new RouteDiscoveryError(`${stackName}/${authorizerLogicalId}: TOKEN authorizer IdentitySource '${identitySource}' must be 'method.request.header.<HeaderName>'.`);
+	if (!m) throw new RouteDiscoveryError(`${displayStackName(stackName)}/${displayIdent(authorizerLogicalId)}: TOKEN authorizer IdentitySource ${displayIdent(identitySource)} must be 'method.request.header.<HeaderName>'.`);
 	return m[1].toLowerCase();
 }
 function parseRestV1IdentitySources(raw) {
@@ -9824,7 +9958,7 @@ function pickStringFromArn(value, location) {
 			const arg = obj["Fn::GetAtt"];
 			if (Array.isArray(arg) && arg.length === 2 && typeof arg[0] === "string" && arg[1] === "Arn") {
 				const logicalId = arg[0];
-				getLogger().warn(`${location}: uses Fn::GetAtt against logical ID '${logicalId}'. ${getEmbedConfig().cliName} start-api cannot resolve the deployed user pool ARN — synthesizing an unreachable placeholder so JWKS pass-through admits every token. For real signature verification, set 'providerArns: [pool.userPoolArn]' explicitly on the CDK construct.`);
+				getLogger().warn(`${location}: uses Fn::GetAtt against logical ID ${displayIdent(logicalId)}. ${getEmbedConfig().cliName} start-api cannot resolve the deployed user pool ARN — synthesizing an unreachable placeholder so JWKS pass-through admits every token. For real signature verification, set 'providerArns: [pool.userPoolArn]' explicitly on the CDK construct.`);
 				return `arn:aws:cognito-idp:us-east-1:000000000000:userpool/us-east-1_${getEmbedConfig().binaryName}placeholder${logicalId}`;
 			}
 		}
@@ -9866,7 +10000,7 @@ function attachAuthorizers(stacks, routes) {
 			if (err instanceof AuthorizerLambdaUnresolvableError) {
 				out.push({ route: {
 					...route,
-					unsupported: { reason: `${route.declaredAt}: authorizer Lambda Arn unresolvable — ${err.reason}` }
+					unsupported: { reason: `${displayStackName(route.declaredAt)}: authorizer Lambda Arn unresolvable — ${err.reason}` }
 				} });
 				continue;
 			}
@@ -9906,7 +10040,7 @@ function detectRestV1Authorizer(methodResource, methodLogicalId, stack) {
 	};
 	const authorizerId = props["AuthorizerId"];
 	const refLogicalId = pickRefLogicalId(authorizerId);
-	if (!refLogicalId) throw new RouteDiscoveryError(`${stack.stackName}/${methodLogicalId}: AuthorizationType='${stringifyValue(authType)}' but AuthorizerId is missing or not a {Ref:...}.`);
+	if (!refLogicalId) throw new RouteDiscoveryError(`${displayStackName(stack.stackName)}/${displayIdent(methodLogicalId)}: AuthorizationType=${displayIdent(stringifyValue(authType))} but AuthorizerId is missing or not a {Ref:...}.`);
 	return resolveRestV1Authorizer(refLogicalId, stack.template, stack.stackName, `${stack.stackName}/${methodLogicalId}`);
 }
 function detectHttpApiAuthorizer(routeResource, routeLogicalId, stack) {
@@ -9915,7 +10049,7 @@ function detectHttpApiAuthorizer(routeResource, routeLogicalId, stack) {
 	if (authType === void 0 || authType === "NONE") return void 0;
 	const authorizerId = props["AuthorizerId"];
 	const refLogicalId = pickRefLogicalId(authorizerId);
-	if (!refLogicalId) throw new RouteDiscoveryError(`${stack.stackName}/${routeLogicalId}: AuthorizationType='${stringifyValue(authType)}' but AuthorizerId is missing or not a {Ref:...}.`);
+	if (!refLogicalId) throw new RouteDiscoveryError(`${displayStackName(stack.stackName)}/${displayIdent(routeLogicalId)}: AuthorizationType=${displayIdent(stringifyValue(authType))} but AuthorizerId is missing or not a {Ref:...}.`);
 	const scopesRaw = props["AuthorizationScopes"];
 	return resolveHttpApiAuthorizer(refLogicalId, Array.isArray(scopesRaw) ? scopesRaw.filter((s) => typeof s === "string") : void 0, stack.template, stack.stackName, `${stack.stackName}/${routeLogicalId}`);
 }
@@ -11011,7 +11145,7 @@ async function handleRequest$2(req, res, state, opts) {
 		try {
 			outcome = await runAuthorizerPass(authorizer, snapshot, matchCtx, state, opts, baseEvent["requestContext"]);
 		} catch (err) {
-			logger.error(`Authorizer ${authorizer.logicalId} threw for ${match.route.declaredAt}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.error(`Authorizer ${displayIdent(authorizer.logicalId)} threw for ${displayStackName(match.route.declaredAt)}: ${err instanceof Error ? err.message : String(err)}`);
 			applyCors();
 			writeAuthRejection(res, match.route.apiVersion, "policy-deny", authorizer.kind);
 			return;
@@ -11036,7 +11170,7 @@ async function handleRequest$2(req, res, state, opts) {
 			applyCors();
 			writeIntegrationOutcome(res, outcome);
 		} catch (err) {
-			logger.error(`REST v1 ${match.route.restV1Integration.kind} dispatch failed for ${match.route.declaredAt}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.error(`REST v1 ${match.route.restV1Integration.kind} dispatch failed for ${displayStackName(match.route.declaredAt)}: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				applyCors();
 				writeError$1(res, 502);
@@ -11048,7 +11182,7 @@ async function handleRequest$2(req, res, state, opts) {
 	try {
 		handle = await state.pool.acquire(match.route.lambdaLogicalId);
 	} catch (err) {
-		logger.error(`Failed to acquire container for ${match.route.lambdaLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+		logger.error(`Failed to acquire container for ${displayIdent(match.route.lambdaLogicalId)}: ${err instanceof Error ? err.message : String(err)}`);
 		applyCors();
 		writeError$1(res, 502);
 		return;
@@ -11067,7 +11201,7 @@ async function handleRequest$2(req, res, state, opts) {
 			}
 			return;
 		} catch (err) {
-			logger.error(`RIE streaming invoke failed for ${match.route.lambdaLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+			logger.error(`RIE streaming invoke failed for ${displayIdent(match.route.lambdaLogicalId)}: ${err instanceof Error ? err.message : String(err)}`);
 			if (!res.headersSent) {
 				applyCors();
 				writeError$1(res, 502);
@@ -11084,7 +11218,7 @@ async function handleRequest$2(req, res, state, opts) {
 		applyCors();
 		res.end(translated.body);
 	} catch (err) {
-		logger.error(`RIE invoke failed for ${match.route.lambdaLogicalId}: ${err instanceof Error ? err.message : String(err)}`);
+		logger.error(`RIE invoke failed for ${displayIdent(match.route.lambdaLogicalId)}: ${err instanceof Error ? err.message : String(err)}`);
 		if (!res.headersSent) {
 			applyCors();
 			writeError$1(res, 502);
@@ -11277,7 +11411,7 @@ async function runAuthorizerPass(authorizer, snapshot, matchCtx, state, opts, re
 	}
 	if (authorizer.kind === "iam") {
 		if (!opts.sigV4CredentialsLoader) {
-			getLogger().debug(`AWS_IAM authorizer for ${matchCtx.route.declaredAt}: no SigV4 credentials loader configured — denying.`);
+			getLogger().debug(`AWS_IAM authorizer for ${displayStackName(matchCtx.route.declaredAt)}: no SigV4 credentials loader configured — denying.`);
 			return {
 				result: { allow: false },
 				denyKind: "policy-deny"
@@ -11487,7 +11621,7 @@ async function handleServiceIntegrationRequest(req, res, match, bodyBuf, opts, a
 	};
 	const outcome = resolveServiceIntegrationParameters(svc.requestParameters, ctx);
 	if (outcome.kind === "error") {
-		getLogger().warn(`[${route.declaredAt}] ${outcome.reason}`);
+		getLogger().warn(`[${displayStackName(route.declaredAt)}] ${outcome.reason}`);
 		const body = JSON.stringify({
 			message: "Invalid integration mapping",
 			reason: outcome.reason
@@ -11638,17 +11772,17 @@ function groupRoutesByServer(routes) {
 			identifier = r.lambdaLogicalId;
 			serverKey = `function-url:${stackPrefix}${identifier}`;
 			kind = "function-url";
-			displayName = `${identifier} (Function URL)`;
+			displayName = `${displayIdent(identifier)} (Function URL)`;
 		} else if (r.source === "http-api") {
 			identifier = r.apiLogicalId ?? "<unknown>";
 			serverKey = `http-api:${stackPrefix}${identifier}`;
 			kind = "http-api";
-			displayName = `${identifier} (HTTP API v2)`;
+			displayName = `${displayIdent(identifier)} (HTTP API v2)`;
 		} else {
 			identifier = r.apiLogicalId ?? "<unknown>";
 			serverKey = `rest-v1:${stackPrefix}${identifier}`;
 			kind = "rest-v1";
-			displayName = `${identifier} (REST API v1)`;
+			displayName = `${displayIdent(identifier)} (REST API v1)`;
 		}
 		const existing = byKey.get(serverKey);
 		if (existing) existing.routes.push(rwa);
@@ -11764,10 +11898,10 @@ async function materializeLayerFromArn(layer, options = {}) {
 	let credentials;
 	if (options.roleArn) try {
 		credentials = await assumeRoleForLayer(options.roleArn, layer.region, options);
-		logger.debug(`Layer ${layer.arn}: assumed role ${options.roleArn} for GetLayerVersion`);
+		logger.debug(`Layer ${displayUntrustedValue(layer.arn)}: assumed role ${options.roleArn} for GetLayerVersion`);
 	} catch (err) {
 		if (err instanceof LayerMaterializationError) throw err;
-		throw new LayerMaterializationError(`Layer ${layer.arn}: STS AssumeRole(${flattenToOneLine(options.roleArn)}) failed: ${layerFailureDetail(err, "STS AssumeRole (--layer-role-arn)")}. Check the role trust policy permits your principal and sts:AssumeRole is allowed.`);
+		throw new LayerMaterializationError(`Layer ${displayUntrustedValue(layer.arn)}: STS AssumeRole(${flattenToOneLine(options.roleArn)}) failed: ${layerFailureDetail(err, "STS AssumeRole (--layer-role-arn)")}. Check the role trust policy permits your principal and sts:AssumeRole is allowed.`);
 	}
 	let presignedUrl;
 	try {
@@ -11775,13 +11909,13 @@ async function materializeLayerFromArn(layer, options = {}) {
 	} catch (err) {
 		if (err instanceof LayerMaterializationError) throw err;
 		const hint = looksLikeAccessDenied(err) ? " GetLayerVersion access denied; check the credentials / role can read the layer (grant lambda:GetLayerVersion on the layer ARN, or pass --layer-role-arn <arn> to assume a role in the layer account)." : "";
-		throw new LayerMaterializationError(`Layer ${layer.arn}: GetLayerVersion failed in region ${layer.region}: ${layerFailureDetail(err, "Lambda GetLayerVersion")}.${hint}`);
+		throw new LayerMaterializationError(`Layer ${displayUntrustedValue(layer.arn)}: GetLayerVersion failed in region ${layer.region}: ${layerFailureDetail(err, "Lambda GetLayerVersion")}.${hint}`);
 	}
 	let zipBytes;
 	try {
 		zipBytes = await downloadPresignedZip(presignedUrl, options);
 	} catch (err) {
-		throw new LayerMaterializationError(`Layer ${layer.arn}: failed to download layer ZIP from the presigned URL: ${sanitizeServiceExceptionMessage(errMsg(err))}.`);
+		throw new LayerMaterializationError(`Layer ${displayUntrustedValue(layer.arn)}: failed to download layer ZIP from the presigned URL: ${sanitizeServiceExceptionMessage(errMsg(err))}.`);
 	}
 	const dir = await mkdtemp(join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-arn-layer-${layer.name}-${layer.version}-`));
 	try {
@@ -11793,7 +11927,7 @@ async function materializeLayerFromArn(layer, options = {}) {
 				force: true
 			});
 		} catch {}
-		throw new LayerMaterializationError(`Layer ${layer.arn}: failed to unzip layer contents into '${dir}': ${errMsg(err)}.`);
+		throw new LayerMaterializationError(`Layer ${displayUntrustedValue(layer.arn)}: failed to unzip layer contents into '${dir}': ${errMsg(err)}.`);
 	}
 	return dir;
 }
@@ -11801,7 +11935,7 @@ async function fetchLayerContentUrl(layer, credentials, options) {
 	const client = (options.lambdaClientFactory ?? await defaultLambdaClientFactory())(layer.region, credentials);
 	try {
 		const versionSuffix = /^(.*):(\d+)$/.exec(layer.arn);
-		if (!versionSuffix) throw new LayerMaterializationError(`Layer ${layer.arn}: not a layer-version ARN (no ':<version>' suffix to strip). Expected arn:<partition>:lambda:<region>:<account>:layer:<name>:<version>.`);
+		if (!versionSuffix) throw new LayerMaterializationError(`Layer ${displayUntrustedValue(layer.arn)}: not a layer-version ARN (no ':<version>' suffix to strip). Expected arn:<partition>:lambda:<region>:<account>:layer:<name>:<version>.`);
 		const versionLessArn = versionSuffix[1];
 		const command = await buildGetLayerVersionCommand(versionLessArn, Number(layer.version));
 		const url = (await client.send(command))?.Content?.Location;
@@ -11899,14 +12033,14 @@ async function unzipBufferToDirectory(zipBytes, destDir) {
 		cursor += 46 + fileNameLength + extraFieldLength + fileCommentLength;
 		parsed++;
 		const targetPath = resolve(destAbsolute, normalize(fileName));
-		if (!targetPath.startsWith(destAbsolute + (destAbsolute.endsWith("/") ? "" : "/"))) throw new Error(`Refusing to extract entry '${fileName}' — path escapes the destination directory`);
-		if ((externalAttrs >>> 16 & 61440) === 40960) throw new Error(`Refusing to extract symlink entry '${fileName}' from layer ZIP (security)`);
+		if (!targetPath.startsWith(destAbsolute + (destAbsolute.endsWith("/") ? "" : "/"))) throw new Error(`Refusing to extract entry ${displayUntrustedValue(fileName)} — path escapes the destination directory`);
+		if ((externalAttrs >>> 16 & 61440) === 40960) throw new Error(`Refusing to extract symlink entry ${displayUntrustedValue(fileName)} from layer ZIP (security)`);
 		if (fileName.endsWith("/")) {
 			await mkdir(targetPath, { recursive: true });
 			continue;
 		}
 		await mkdir(dirname(targetPath), { recursive: true });
-		if (view.getUint32(localHeaderOffset, true) !== 67324752) throw new Error(`Corrupt ZIP: missing Local File Header for '${fileName}'`);
+		if (view.getUint32(localHeaderOffset, true) !== 67324752) throw new Error(`Corrupt ZIP: missing Local File Header for ${displayUntrustedValue(fileName)}`);
 		const lfhFileNameLength = view.getUint16(localHeaderOffset + 26, true);
 		const lfhExtraFieldLength = view.getUint16(localHeaderOffset + 28, true);
 		const dataOffset = localHeaderOffset + 30 + lfhFileNameLength + lfhExtraFieldLength;
@@ -11914,8 +12048,8 @@ async function unzipBufferToDirectory(zipBytes, destDir) {
 		let payload;
 		if (compressionMethod === 0) payload = compressedData;
 		else if (compressionMethod === 8) payload = await inflateRaw(compressedData);
-		else throw new Error(`Unsupported ZIP compression method ${compressionMethod} for entry '${fileName}' (only STORE and DEFLATE supported)`);
-		if (payload.length !== uncompressedSize && compressionMethod !== 0) throw new Error(`ZIP entry '${fileName}': inflate produced ${payload.length} bytes, expected ${uncompressedSize}`);
+		else throw new Error(`Unsupported ZIP compression method ${compressionMethod} for entry ${displayUntrustedValue(fileName)} (only STORE and DEFLATE supported)`);
+		if (payload.length !== uncompressedSize && compressionMethod !== 0) throw new Error(`ZIP entry ${displayUntrustedValue(fileName)}: inflate produced ${payload.length} bytes, expected ${uncompressedSize}`);
 		await pipeline(Readable.from(payload), createWriteStream(targetPath));
 	}
 }
@@ -12253,32 +12387,18 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 			interactivePicked.value = true;
 		}
 		const cfnStackFallback = typeof options.fromCfnStack === "string" ? options.fromCfnStack : void 0;
-		const targetStackPrefix = deriveSynthStackPrefix(effectiveTargets);
-		const targetStacks = pickTargetStacks(stacks, options.stack, cfnStackFallback, targetStackPrefix, options.allStacks || shouldSynthAllStacks(effectiveTargets, options.stack, cfnStackFallback));
+		const targetStackPrefix = deriveSynthStackPrefix(effectiveTargets, stacks);
+		const targetStacks = pickTargetStacks(stacks, options.stack, cfnStackFallback, targetStackPrefix, options.allStacks || shouldSynthAllStacks(effectiveTargets, options.stack, cfnStackFallback, stacks));
 		if (targetStacks.length === 0) throw new Error("No stacks matched. Pass --stack <name> (or --from-cfn-stack <name>) or run from a single-stack app.");
 		const routedStackNames = targetStacks.map((s) => s.stackName);
 		tryEmitFromCfnRedundancyTipOnce(options.fromCfnStack, routedStackNames, fromCfnTipEmitted, (routedStackName) => {
-			logger.info(`tip: --from-cfn-stack value matches the routed stack name (${routedStackName}); you can omit the value: \`${getEmbedConfig().cliName} start-api ... --from-cfn-stack\` (bare flag) resolves to the same value.`);
+			logger.info(`tip: --from-cfn-stack value matches the routed stack name (${displayStackName(routedStackName)}); you can omit the value: \`${getEmbedConfig().cliName} start-api ... --from-cfn-stack\` (bare flag) resolves to the same value.`);
 		});
 		const routes = discoverRoutes(targetStacks);
 		const wsDiscovery = discoverWebSocketApis(targetStacks);
 		if (wsDiscovery.errors.length > 0) for (const e of wsDiscovery.errors) logger.warn(`WebSocket discovery: ${e}`);
 		let webSocketApis = wsDiscovery.apis;
 		if (routes.length === 0 && webSocketApis.length === 0) throw new Error(`No supported API routes were discovered. ${getEmbedConfig().cliName} start-api supports AWS::ApiGateway::* (REST v1), AWS::ApiGatewayV2::* (HTTP + WebSocket), and AWS::Lambda::Url (Function URL) with AWS_PROXY integrations only.`);
-		const stageMap = /* @__PURE__ */ new Map();
-		for (const stack of targetStacks) {
-			const m = buildStageMap(stack.template, options.stage);
-			for (const [k, v] of m) stageMap.set(k, v);
-		}
-		if (options.stage) {
-			const missingApis = /* @__PURE__ */ new Set();
-			for (const r of routes) {
-				if (!r.apiLogicalId) continue;
-				if (!stageMap.has(r.apiLogicalId)) missingApis.add(r.apiLogicalId);
-			}
-			for (const apiId of missingApis) logger.warn(`--stage '${options.stage}' did not match any Stage on API '${apiId}'; routes on that API will get stageVariables: null.`);
-		}
-		attachStageContext(routes, stageMap);
 		let routesWithAuth = attachAuthorizers(targetStacks, routes);
 		if (apiFilters.length > 0) {
 			const { filtered, filteredWebSocketApis, unmatched } = resolveApiTargetSubset(routesWithAuth, apiFilters, targetStacks.map((s) => s.stackName), webSocketApis);
@@ -12293,23 +12413,40 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 			routesWithAuth = filtered;
 			webSocketApis = filteredWebSocketApis;
 		}
+		const servedRoutes = routesWithAuth.map((r) => r.route);
+		const servedStacks = stacksServing(targetStacks, servedRoutes, webSocketApis);
+		const stageMap = /* @__PURE__ */ new Map();
+		for (const stack of servedStacks) {
+			const m = buildStageMap(stack.template, options.stage);
+			for (const [k, v] of m) stageMap.set(k, v);
+		}
+		if (options.stage) {
+			const missingApis = /* @__PURE__ */ new Set();
+			for (const r of servedRoutes) {
+				if (!r.apiLogicalId) continue;
+				if (!stageMap.has(r.apiLogicalId)) missingApis.add(r.apiLogicalId);
+			}
+			for (const apiId of missingApis) logger.warn(`--stage '${options.stage}' did not match any Stage on API ${displayIdent(apiId)}; routes on that API will get stageVariables: null.`);
+		}
+		attachStageContext(servedRoutes, stageMap);
 		const corsConfigByApiId = /* @__PURE__ */ new Map();
-		for (const stack of targetStacks) {
+		for (const stack of servedStacks) {
 			const fromCloudFront = buildCorsConfigFromCloudFrontChain(stack.template);
 			for (const [k, v] of fromCloudFront) corsConfigByApiId.set(k, v);
 			const direct = buildCorsConfigByApiId(stack.template);
 			for (const [k, v] of direct) corsConfigByApiId.set(k, v);
 		}
-		const stateByStack = isCfnFlagPresent(options) || hasExtraStateProviderActive(options, extraStateProviders) ? await loadStateForRoutedStacks(targetStacks, routes, routesWithAuth, options, extraStateProviders) : /* @__PURE__ */ new Map();
+		assertServedLogicalIdsUnambiguous(servedStacks, servedRoutes, routesWithAuth, webSocketApis);
+		const stateByStack = isCfnFlagPresent(options) || hasExtraStateProviderActive(options, extraStateProviders) ? await loadStateForRoutedStacks(servedStacks, servedRoutes, routesWithAuth, options, extraStateProviders) : /* @__PURE__ */ new Map();
 		const profileCredentials = options.profile ? await resolveProfileCredentials(options.profile) : void 0;
 		if (options.profile && profileCredentials && !profileCredsFile) profileCredsFile = await writeProfileCredentialsFile(options.profile, profileCredentials);
-		const lambdaIds = uniqueLambdaIds(routes, routesWithAuth, webSocketApis);
+		const lambdaIds = uniqueLambdaIds(servedRoutes, routesWithAuth, webSocketApis);
 		const specs = /* @__PURE__ */ new Map();
 		for (let i = 0; i < lambdaIds.length; i++) {
 			const logicalId = lambdaIds[i];
 			const spec = await buildContainerSpec({
 				logicalId,
-				stacks: targetStacks,
+				stacks: servedStacks,
 				overrides,
 				assumeRole: normalizedAssumeRole,
 				containerHost: options.containerHost,
@@ -12338,7 +12475,7 @@ async function localStartApiCommand(targets, options, extraStateProviders) {
 			specs,
 			corsConfigByApiId,
 			webSocketApis,
-			stacks: targetStacks
+			stacks: servedStacks
 		};
 	};
 	const buildPool = (specs) => {
@@ -12648,10 +12785,11 @@ function createWatchPredicates(args) {
 function pickTargetStacks(stacks, pattern, cfnStackFallback, targetFallback, allStacks) {
 	if (allStacks) return stacks;
 	const effective = pattern ?? cfnStackFallback ?? targetFallback;
+	if (effective !== void 0 && typeof effective !== "string") return [effective];
 	if (effective) return matchStacks(stacks, [effective]);
 	if (stacks.length === 1) return stacks;
 	if (stacks.length === 0) return [];
-	throw new Error(`Multi-stack app: pass --stack <name>, --from-cfn-stack <name>, a stack-qualified target like "<StackName>/<construct>", or --all-stacks to serve every stack. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
+	throw new Error(`Multi-stack app: pass --stack <name>, --from-cfn-stack <name>, a stack-qualified target like "<StackName>/<construct>", or --all-stacks to serve every stack. Available stacks: ${describeStacks(stacks)}.`);
 }
 function allStacksConflicts(options, targets, apiFilters) {
 	if (!options.allStacks) return [];
@@ -12677,20 +12815,25 @@ function resolveApiTargetSubset(routes, identifiers, stackNames, webSocketApis =
 		unmatched: identifiers.filter((id) => filterRoutesByApiIdentifiers(routes, [id]).length === 0 && filterWebSocketApisByIdentifiers(webSocketApis, [id]).length === 0)
 	};
 }
-function deriveSynthStackPrefix(targets) {
+function targetStackHint(target, stacks) {
+	const slash = target.indexOf("/");
+	if (slash === -1) return void 0;
+	return stackForConstructPath(target, stacks) ?? target.slice(0, slash);
+}
+function deriveSynthStackPrefix(targets, stacks) {
 	if (targets.length === 0) return void 0;
-	const prefixes = /* @__PURE__ */ new Set();
+	const hints = /* @__PURE__ */ new Set();
 	for (const t of targets) {
-		const slash = t.indexOf("/");
-		if (slash === -1) return void 0;
-		prefixes.add(t.slice(0, slash));
+		const hint = targetStackHint(t, stacks);
+		if (hint === void 0) return void 0;
+		hints.add(hint);
 	}
-	return prefixes.size === 1 ? [...prefixes][0] : void 0;
+	return hints.size === 1 ? [...hints][0] : void 0;
 }
-function shouldSynthAllStacks(targets, stackPattern, cfnStackFallback) {
+function shouldSynthAllStacks(targets, stackPattern, cfnStackFallback, stacks) {
 	if (targets.length === 0) return false;
 	if (stackPattern !== void 0 || cfnStackFallback !== void 0) return false;
-	return deriveSynthStackPrefix(targets) === void 0;
+	return deriveSynthStackPrefix(targets, stacks) === void 0;
 }
 function shouldPromptBareMultiSelect(apiFilters, allStacks, isTty) {
 	return apiFilters.length === 0 && !allStacks && isTty;
@@ -12709,6 +12852,34 @@ function tryEmitFromCfnRedundancyTipOnce(fromCfnStack, routedStackNames, emitted
 	emit(routedStackName);
 	emittedRef.value = true;
 }
+function stacksServing(stacks, routes, webSocketApis) {
+	const names = /* @__PURE__ */ new Set();
+	for (const r of routes) {
+		if (r.apiStackName === void 0) return [...stacks];
+		names.add(r.apiStackName);
+	}
+	for (const api of webSocketApis) names.add(api.apiStackName);
+	return stacks.filter((s) => names.has(s.stackName));
+}
+function stacksDeclaring(logicalId, stacks, type) {
+	return stacks.filter((stack) => {
+		const resource = stack.template.Resources?.[logicalId];
+		return resource !== void 0 && (type === void 0 || resource.Type === type);
+	});
+}
+function assertServedLogicalIdsUnambiguous(stacks, routes, routesWithAuth, webSocketApis = []) {
+	if (stacks.length < 2) return;
+	const checks = [];
+	for (const id of uniqueLambdaIds(routes, routesWithAuth, webSocketApis)) checks.push([id, "AWS::Lambda::Function"]);
+	const apiIds = /* @__PURE__ */ new Set();
+	for (const { route } of routesWithAuth) if (route.source !== "function-url" && route.apiLogicalId) apiIds.add(route.apiLogicalId);
+	for (const api of webSocketApis) apiIds.add(api.apiLogicalId);
+	for (const id of apiIds) checks.push([id, void 0]);
+	for (const [logicalId, type] of checks) {
+		const owners = stacksDeclaring(logicalId, stacks, type);
+		if (owners.length > 1) throw new Error(`Logical ID ${displayUntrustedValue(logicalId)} is declared by ${owners.length} of the served stacks (${describeStacks(owners)}), and ${getEmbedConfig().cliName} start-api cannot serve two resources under one logical ID. Serve one stack at a time: pass --stack '<stack display path>' or a stack-qualified target.`);
+	}
+}
 function uniqueLambdaIds(routes, routesWithAuth, webSocketApis = []) {
 	const seen = /* @__PURE__ */ new Set();
 	const out = [];
@@ -12804,16 +12975,16 @@ function resolveStartApiAssumeRoleArn(args) {
 	const roleProp = (lambdaResource.Properties ?? {})["Role"];
 	if (typeof roleProp === "string") {
 		if (isIamRoleArn(roleProp)) return roleProp;
-		getLogger().warn(`--assume-role: the template Role for '${logicalId}' is not a well-formed IAM role ARN: ${describeRejectedRoleArn(roleProp)}. Ignoring it.`);
+		getLogger().warn(`--assume-role: the template Role for ${displayIdent(logicalId)} is not a well-formed IAM role ARN: ${describeRejectedRoleArn(roleProp)}. Ignoring it.`);
 	}
 	if (stateBundle) {
 		const fromState = resolveExecutionRoleArnFromState(stateBundle.state, logicalId);
 		if (fromState) {
-			getLogger().info(`--assume-role: auto-resolved execution role for '${logicalId}' from state: ${flattenToOneLine(fromState)}`);
+			getLogger().info(`--assume-role: auto-resolved execution role for ${displayIdent(logicalId)} from state: ${flattenToOneLine(fromState)}`);
 			return fromState;
 		}
 	}
-	getLogger().warn(`--assume-role: could not auto-resolve the execution role ARN for '${logicalId}'. Pair --assume-role with --from-cfn-stack (or a host-provided state-source extension) so the deployed Role's ARN can be looked up, OR pin the ARN explicitly with --assume-role ${logicalId}=<arn>. Falling back to the developer's shell credentials for this Lambda.`);
+	getLogger().warn(`--assume-role: could not auto-resolve the execution role ARN for ${displayIdent(logicalId)}. Pair --assume-role with --from-cfn-stack (or a host-provided state-source extension) so the deployed Role's ARN can be looked up, OR pin the ARN explicitly with --assume-role ${logicalId}=<arn>. Falling back to the developer's shell credentials for this Lambda.`);
 }
 async function buildContainerSpec(args) {
 	const { logicalId, stacks, overrides, assumeRole, containerHost, debugPort, stsRegion, inlineTmpDirs, layerTmpDirs, stateByStack, skipPull, profile, layerRoleArn, profileCredentials, profileCredsFile, profileRegion, stackRegionOverride } = args;
@@ -12869,7 +13040,7 @@ async function buildContainerSpec(args) {
 			unresolved,
 			sensitiveKeys: [...audit.sensitiveKeys, ...deployedSecretKeys]
 		};
-		for (const { key, reason } of unresolved) getLogger().warn(`Lambda ${logicalId}: state source could not substitute env var ${key} (${reason}). Override it via --env-vars or it will be dropped.`);
+		for (const { key, reason } of unresolved) getLogger().warn(`Lambda ${displayIdent(logicalId)}: state source could not substitute env var ${displayIdent(key)} (${reason}). Override it via --env-vars or it will be dropped.`);
 	}
 	const lambdaCdkPath = readCdkPathOrUndefined(lambda.resource);
 	const envResult = resolveEnvVars$1(logicalId, lambdaCdkPath, templateEnv, overrides);
@@ -12978,7 +13149,7 @@ async function resolveContainerImageForStartApi(lambda, skipPull, profile, optio
 		assetOutdir: localBuild.assetOutdir,
 		...options?.noBuild !== void 0 && { noBuild: options.noBuild }
 	}) };
-	if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
+	if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda ${displayIdent(lambda.logicalId)} has no matching asset in cdk.out, and Code.ImageUri ${displayUntrustedValue(String(lambda.imageUri))} is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
 	logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull...`);
 	return { imageRef: await pullEcrImage(lambda.imageUri, {
 		skipPull,
@@ -12991,7 +13162,7 @@ async function resolveLocalBuildPlan$1(lambda) {
 	const manifestPath = lambda.stack.assetManifestPath;
 	if (!manifestPath) return void 0;
 	const cdkOutDir = path$1.dirname(manifestPath);
-	const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, lambda.stack.stackName);
+	const manifest = await new AssetManifestLoader().loadStackManifest(lambda.stack, cdkOutDir);
 	if (!manifest) return void 0;
 	const entry = getDockerImageBySourceHash(manifest, lambda.imageUri);
 	if (!entry) return void 0;
@@ -13034,9 +13205,10 @@ async function materializeLambdaLayers$1(layers, layerTmpDirs, layerRoleArn) {
 	return dir;
 }
 function resolveLambdaByLogicalId(logicalId, stacks) {
-	for (const stack of stacks) {
-		const resource = stack.template.Resources?.[logicalId];
-		if (!resource || resource.Type !== "AWS::Lambda::Function") continue;
+	const owners = stacksDeclaring(logicalId, stacks, "AWS::Lambda::Function");
+	if (owners.length > 1) throw new Error(`Lambda ${displayUntrustedValue(logicalId)} is declared by ${owners.length} stacks (${describeStacks(owners)}); pass --stack '<stack display path>' to pick one.`);
+	for (const stack of owners) {
+		const resource = stack.template.Resources[logicalId];
 		const props = resource.Properties ?? {};
 		const memoryMb = typeof props["MemorySize"] === "number" ? props["MemorySize"] : 128;
 		const timeoutSec = typeof props["Timeout"] === "number" ? props["Timeout"] : 3;
@@ -13053,8 +13225,8 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 		});
 		const runtime = typeof props["Runtime"] === "string" ? props["Runtime"] : "";
 		const handler = typeof props["Handler"] === "string" ? props["Handler"] : "";
-		if (!runtime) throw new Error(`Lambda '${logicalId}' has no Runtime property and no Code.ImageUri. ${getEmbedConfig().cliName} start-api cannot tell if this is a ZIP or a container Lambda.`);
-		if (!handler) throw new Error(`Lambda '${logicalId}' has no Handler property.`);
+		if (!runtime) throw new Error(`Lambda ${displayIdent(logicalId)} has no Runtime property and no Code.ImageUri. ${getEmbedConfig().cliName} start-api cannot tell if this is a ZIP or a container Lambda.`);
+		if (!handler) throw new Error(`Lambda ${displayIdent(logicalId)} has no Handler property.`);
 		const inlineCode = typeof code["ZipFile"] === "string" ? code["ZipFile"] : void 0;
 		let codePath = null;
 		if (!inlineCode) codePath = resolveAssetCodePath(stack, logicalId, resource);
@@ -13077,7 +13249,7 @@ function resolveLambdaByLogicalId(logicalId, stacks) {
 			...ephemeralStorageMb !== void 0 && { ephemeralStorageMb }
 		};
 	}
-	throw new Error(`No AWS::Lambda::Function resource named '${logicalId}' found in target stacks. This is likely a synthesis bug — the route-discovery phase resolved a route to this logical ID.`);
+	throw new Error(`No AWS::Lambda::Function resource named ${displayIdent(logicalId)} found in target stacks. This is likely a synthesis bug — the route-discovery phase resolved a route to this logical ID.`);
 }
 function extractImageUri(value, logicalId, stackName, resources, region) {
 	if (typeof value === "string" && value.length > 0) return value;
@@ -13090,10 +13262,10 @@ function extractImageUri(value, logicalId, stackName, resources, region) {
 			const pseudoParameters = derivePseudoParametersFromRegion(region);
 			const joinResolved = tryResolveImageFnJoin(value, resources, pseudoParameters ? { pseudoParameters } : void 0);
 			if (joinResolved.kind === "resolved") return joinResolved.uri;
-			if (joinResolved.kind === "needs-state") throw new Error(`Lambda '${logicalId}' in ${stackName} references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — deploy the stack first, rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
-			if (joinResolved.kind === "unsupported-join") throw new Error(`Lambda '${logicalId}' in ${stackName} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. ${getEmbedConfig().cliName} recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
+			if (joinResolved.kind === "needs-state") throw new Error(`Lambda ${displayIdent(logicalId)} in ${displayStackName(stackName)} references same-stack ECR repository ${displayIdent(joinResolved.repoLogicalId)} via Fn::Join. ${getEmbedConfig().cliName} cannot resolve the repository URI without state — deploy the stack first, rebuild via lambda.DockerImageCode.fromImageAsset, or pin a public image.`);
+			if (joinResolved.kind === "unsupported-join") throw new Error(`Lambda ${displayIdent(logicalId)} in ${displayStackName(stackName)} has an unsupported Fn::Join Code.ImageUri shape: ${joinResolved.reason}. ${getEmbedConfig().cliName} recognizes the canonical CDK 2.x lambda.DockerImageCode.fromEcr Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
 			const accountIdHint = pseudoParameters ? ` (likely \${AWS::AccountId}, which ${getEmbedConfig().binaryName} cannot derive without a state source or STS)` : ` (${getEmbedConfig().binaryName} could not derive AWS pseudo parameters because stack.region was undefined)`;
-			throw new Error(`Lambda '${logicalId}' in ${stackName} has an Fn::Join Code.ImageUri that ${getEmbedConfig().cliName} cannot resolve${accountIdHint}. Workarounds: deploy first and run with a state-source flag (e.g. --from-cfn-stack or a host-provided extension), or pin a fully-literal public image URI.`);
+			throw new Error(`Lambda ${displayIdent(logicalId)} in ${displayStackName(stackName)} has an Fn::Join Code.ImageUri that ${getEmbedConfig().cliName} cannot resolve${accountIdHint}. Workarounds: deploy first and run with a state-source flag (e.g. --from-cfn-stack or a host-provided extension), or pin a fully-literal public image URI.`);
 		}
 	}
 }
@@ -13110,7 +13282,7 @@ function resolveImageLambda(args) {
 		const first = arches[0];
 		if (first === "arm64") architecture = "arm64";
 		else if (first === "x86_64") architecture = "x86_64";
-		else throw new Error(`Lambda '${logicalId}' has unsupported Architectures value '${String(first)}'. ${getEmbedConfig().cliName} start-api supports x86_64 and arm64.`);
+		else throw new Error(`Lambda ${displayIdent(logicalId)} has unsupported Architectures value ${displayIdent(String(first))}. ${getEmbedConfig().cliName} start-api supports x86_64 and arm64.`);
 	}
 	const ephemeralStorageMb = extractEphemeralStorageMb(props, logicalId);
 	return {
@@ -13142,8 +13314,8 @@ function printRouteTable(routes) {
 	const pathWidth = Math.max(...sorted.map((r) => r.pathPattern.length), 8);
 	process.stdout.write("Discovered routes:\n");
 	for (const r of sorted) {
-		const sourceLabel = r.source === "http-api" ? "HTTP API" : r.source === "rest-v1" ? `REST v1, stage '${r.stage}'` : "Function URL";
-		const target = r.mockCors ? "[MOCK CORS preflight]" : r.unsupported ? "[501 Not Implemented]" : r.serviceIntegration ? `[${r.serviceIntegration.subtype}]` : r.restV1Integration ? formatRestV1IntegrationLabel(r.restV1Integration) : r.lambdaLogicalId;
+		const sourceLabel = r.source === "http-api" ? "HTTP API" : r.source === "rest-v1" ? `REST v1, stage ${displayIdent(r.stage)}` : "Function URL";
+		const target = r.mockCors ? "[MOCK CORS preflight]" : r.unsupported ? "[501 Not Implemented]" : r.serviceIntegration ? `[${displayIdent(r.serviceIntegration.subtype)}]` : r.restV1Integration ? formatRestV1IntegrationLabel(r.restV1Integration) : r.lambdaLogicalId;
 		process.stdout.write(`  ${r.method.padEnd(methodWidth)}  ${r.pathPattern.padEnd(pathWidth)}  -> ${target}  (${sourceLabel})\n`);
 	}
 	process.stdout.write("\n");
@@ -13151,14 +13323,14 @@ function printRouteTable(routes) {
 function formatRestV1IntegrationLabel(integration) {
 	switch (integration.kind) {
 		case "mock": return "[MOCK]";
-		case "http-proxy": return `[HTTP_PROXY ${integration.uri}]`;
-		case "http": return `[HTTP ${integration.uri}]`;
-		case "aws-lambda": return `${integration.lambdaLogicalId} [AWS]`;
+		case "http-proxy": return `[HTTP_PROXY ${displayUntrustedValue(String(integration.uri))}]`;
+		case "http": return `[HTTP ${displayUntrustedValue(String(integration.uri))}]`;
+		case "aws-lambda": return `${displayIdent(integration.lambdaLogicalId)} [AWS]`;
 	}
 }
 function materializeInlineCode$2(handler, source, fileExtension, tmpDirsOut) {
 	const lastDot = handler.lastIndexOf(".");
-	if (lastDot <= 0) throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
+	if (lastDot <= 0) throw new Error(`Handler ${displayUntrustedValue(handler)} is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
 	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-start-api-`));
 	tmpDirsOut.add(dir);
@@ -13378,7 +13550,7 @@ async function loadStateForRoutedStacks(stacks, routes, routesWithAuth, options,
 				if (ssmParameters.secureStringLogicalIds.length > 0) bundle.ssmSecureStringLogicalIds = ssmParameters.secureStringLogicalIds;
 			}
 			out.set(stackName, bundle);
-			logger.debug(`${provider.label}: loaded state for ${stackName} (${loaded.region})`);
+			logger.debug(`${provider.label}: loaded state for ${displayStackName(stackName)} (${loaded.region})`);
 		} finally {
 			provider.dispose();
 		}
@@ -13545,7 +13717,7 @@ async function localInvokeCommand(target, options, extraStateProviders) {
 			onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} invoke requires a <target> (a Lambda display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_INVOKE_TARGET_REQUIRED")
 		}), stacks);
 		const targetLabel = lambda.kind === "zip" ? lambda.runtime : "container image";
-		logger.info(`Target: ${lambda.stack.stackName}/${lambda.logicalId} (${targetLabel})`);
+		logger.info(`Target: ${displayStackName(`${lambda.stack.stackName}/${lambda.logicalId}`)} (${targetLabel})`);
 		imagePlan = await resolveImagePlan(lambda, options);
 		const containerEnv = await resolveLambdaContainerEnv(lambda, options, profileCredentials, extraStateProviders);
 		const dockerEnv = containerEnv.env;
@@ -13717,7 +13889,7 @@ async function resolveContainerImagePlan$1(lambda, options) {
 		assetOutdir: localBuild.assetOutdir
 	});
 	else {
-		if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
+		if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda ${displayIdent(lambda.logicalId)} has no matching asset in cdk.out, and Code.ImageUri ${displayUntrustedValue(String(lambda.imageUri))} is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app (so cdk.out includes the build context) or deploy the image to ECR first.`);
 		logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull (same-acct/region only)...`);
 		imageRef = await pullEcrImage(lambda.imageUri, {
 			skipPull: options.pull === false,
@@ -13742,7 +13914,7 @@ async function resolveLocalBuildPlan(lambda) {
 	const manifestPath = lambda.stack.assetManifestPath;
 	if (!manifestPath) return void 0;
 	const cdkOutDir = dirname(manifestPath);
-	const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, lambda.stack.stackName);
+	const manifest = await new AssetManifestLoader().loadStackManifest(lambda.stack, cdkOutDir);
 	if (!manifest) return void 0;
 	const entry = getDockerImageBySourceHash(manifest, lambda.imageUri);
 	if (!entry) return void 0;
@@ -13959,7 +14131,7 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 	for (const key of keysNotFromTemplate(templateEnv, envResult.resolved)) plaintextKeys.add(key);
 	const dynamic = await resolveDynamicReferencesInEnv(envResult.resolved, {
 		region: firstUsableRegion(ownerRegion, options.stackRegion, lambda.stack.region, options.region, profileCredentials?.region),
-		label: `Lambda ${lambda.logicalId}`,
+		label: `Lambda ${displayIdent(lambda.logicalId)}`,
 		skipKeys: plaintextKeys,
 		resolver: dynamicRefs
 	});
@@ -14020,7 +14192,7 @@ async function resolveLambdaContainerEnvWith(lambda, options, profileCredentials
 }
 function materializeInlineCode$1(handler, source, fileExtension) {
 	const lastDot = handler.lastIndexOf(".");
-	if (lastDot <= 0) throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
+	if (lastDot <= 0) throw new Error(`Handler ${displayUntrustedValue(handler)} is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
 	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-invoke-`));
 	const filePath = path$1.join(dir, `${modulePath}${fileExtension}`);
@@ -14049,13 +14221,13 @@ async function resolveAssumeRoleArnForLambda(assumeRole, stateForRoleHint, state
 	const fnPhysicalId = stateForRoleHint.resources[lambdaLogicalId]?.physicalId;
 	if (stateProvider?.resolveLambdaExecutionRoleArn && fnPhysicalId) {
 		const liveArn = await stateProvider.resolveLambdaExecutionRoleArn(fnPhysicalId);
-		if (liveArn !== void 0 && !isIamRoleArn(liveArn)) logger.warn(`--assume-role: GetFunctionConfiguration for '${lambdaLogicalId}' produced a value that is not a well-formed IAM role ARN: ${describeRejectedRoleArn(liveArn)}. Ignoring it.`);
+		if (liveArn !== void 0 && !isIamRoleArn(liveArn)) logger.warn(`--assume-role: GetFunctionConfiguration for ${displayIdent(lambdaLogicalId)} produced a value that is not a well-formed IAM role ARN: ${describeRejectedRoleArn(liveArn)}. Ignoring it.`);
 		else if (liveArn) {
 			logger.info(`--assume-role: auto-resolved execution role from GetFunctionConfiguration: ${flattenToOneLine(liveArn)}`);
 			return liveArn;
 		}
 	}
-	logger.warn(`--assume-role: could not resolve the execution role ARN for '${lambdaLogicalId}'. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
+	logger.warn(`--assume-role: could not resolve the execution role ARN for ${displayIdent(lambdaLogicalId)}. Pass the ARN explicitly: --assume-role <arn>. Falling back to the developer's shell credentials.`);
 }
 function resolveExecutionRoleArnFromState(state, logicalId, roleProperty = "Role") {
 	const lambda = state.resources[logicalId];
@@ -14064,7 +14236,7 @@ function resolveExecutionRoleArnFromState(state, logicalId, roleProperty = "Role
 	const roleRef = lambda.properties?.[roleProperty] ?? lambda.observedProperties?.[roleProperty];
 	if (typeof roleRef === "string") {
 		if (isIamRoleArn(roleRef)) return roleRef;
-		logger.warn(`Deployed state for '${logicalId}' carries a ${roleProperty} that is not a well-formed IAM role ARN: ${describeRejectedRoleArn(roleRef)}. Ignoring it.`);
+		logger.warn(`Deployed state for ${displayIdent(logicalId)} carries a ${displayIdent(roleProperty)} that is not a well-formed IAM role ARN: ${describeRejectedRoleArn(roleRef)}. Ignoring it.`);
 		return;
 	}
 	if (typeof roleRef === "object" && roleRef !== null) {
@@ -14072,7 +14244,7 @@ function resolveExecutionRoleArnFromState(state, logicalId, roleProperty = "Role
 		if (refLogicalId) {
 			const cached = state.resources[refLogicalId]?.attributes?.["Arn"];
 			if (isIamRoleArn(cached)) return cached;
-			if (typeof cached === "string" && cached.length > 0) logger.warn(`The cached Arn attribute of '${refLogicalId}' is not a well-formed IAM role ARN: ${describeRejectedRoleArn(cached)}. Ignoring it.`);
+			if (typeof cached === "string" && cached.length > 0) logger.warn(`The cached Arn attribute of ${displayIdent(refLogicalId)} is not a well-formed IAM role ARN: ${describeRejectedRoleArn(cached)}. Ignoring it.`);
 		}
 	}
 }
@@ -14213,7 +14385,7 @@ const SUPPORTED_CODE_RUNTIMES = Object.keys(RUNTIME_BASE_IMAGES);
 async function buildAgentCoreCodeImage(options) {
 	const logger = getLogger();
 	const base = RUNTIME_BASE_IMAGES[options.runtime];
-	if (!base) throw new LocalInvokeBuildError(`AgentCore CodeConfiguration runtime '${options.runtime}' is not supported for local execution. Supported runtimes: ${SUPPORTED_CODE_RUNTIMES.join(", ")}.`);
+	if (!base) throw new LocalInvokeBuildError(`AgentCore CodeConfiguration runtime ${displayIdent(options.runtime)} is not supported for local execution. Supported runtimes: ${SUPPORTED_CODE_RUNTIMES.join(", ")}.`);
 	const isNode = options.runtime.startsWith("NODE");
 	await warnIfDependenciesNotVendored(options.sourceDir, options.runtime, isNode, logger);
 	const dockerfile = renderCodeDockerfile(base, options.entryPoint, isNode);
@@ -14221,7 +14393,7 @@ async function buildAgentCoreCodeImage(options) {
 	const platform = options.architecture === "x86_64" ? "linux/amd64" : "linux/arm64";
 	if (options.noBuild === true) {
 		logger.info(`Skipping docker build (--no-build). Verifying ${tag} is in local registry...`);
-		if (!await isImageInLocalCache(tag)) throw new LocalInvokeBuildError(`image '${tag}' not in local registry and --no-build is set; remove --no-build or run the build manually first.`);
+		if (!await isImageInLocalCache(tag)) throw new LocalInvokeBuildError(`image ${displayIdent(tag)} not in local registry and --no-build is set; remove --no-build or run the build manually first.`);
 		return tag;
 	}
 	logger.info(`Building agent image from source (runtime=${options.runtime}, platform=${platform})...`);
@@ -14242,7 +14414,7 @@ async function buildAgentCoreCodeImage(options) {
 		], { progressLabel: `Building agent image (runtime=${options.runtime})` });
 	} catch (err) {
 		const stderr = err.stderr?.trim();
-		throw new LocalInvokeBuildError(`docker build failed for AgentCore code artifact (${displayUntrustedValue(options.sourceDir)})${stderr ? `: ${stderr}` : ""}`);
+		throw new LocalInvokeBuildError(`docker build failed for AgentCore code artifact (${displayUntrustedValue(options.sourceDir)})${stderr ? `: ${displayToolOutput(stderr)}` : ""}`);
 	} finally {
 		await rm(buildDir, {
 			recursive: true,
@@ -14352,7 +14524,7 @@ function formatRef(location) {
 function resolveSafeEntryPath(root, entry) {
 	const dest = normalize(join(root, entry));
 	const rootWithSep = root.endsWith(sep) ? root : root + sep;
-	if (dest !== root && !dest.startsWith(rootWithSep)) throw new CdkLocalError(`Refusing to extract a fromS3 bundle entry that escapes the target dir: '${entry}'.`, "LOCAL_INVOKE_AGENTCORE_S3_BUNDLE_ZIP_SLIP");
+	if (dest !== root && !dest.startsWith(rootWithSep)) throw new CdkLocalError(`Refusing to extract a fromS3 bundle entry that escapes the target dir: ${displayUntrustedValue(entry)}.`, "LOCAL_INVOKE_AGENTCORE_S3_BUNDLE_ZIP_SLIP");
 	return dest;
 }
 function defaultFetchObject$1(options) {
@@ -14928,7 +15100,7 @@ async function invokeAgentCoreWs(host, port, event, options) {
 //#region src/cli/commands/local-invoke-agentcore.ts
 function parseTimeoutMs(raw) {
 	const parsed = Number(raw);
-	if (!Number.isInteger(parsed) || parsed <= 0) throw new CdkLocalError(`--timeout must be a positive integer number of milliseconds (got '${raw}').`, "LOCAL_INVOKE_AGENTCORE_TIMEOUT_INVALID");
+	if (!Number.isInteger(parsed) || parsed <= 0) throw new InvalidArgumentError(`--timeout must be a positive integer number of milliseconds (got '${raw}').`);
 	return parsed;
 }
 async function localInvokeAgentCoreCommand(target, options, extraStateProviders) {
@@ -14998,7 +15170,7 @@ async function localInvokeAgentCoreCommand(target, options, extraStateProviders)
 			loaded: void 0
 		};
 		const resolved = resolveAgentCoreTarget(resolvedTarget, stacks, imageContext);
-		logger.info(`Target: ${resolved.stack.stackName}/${resolved.logicalId} (${resolved.protocol})`);
+		logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.logicalId}`)} (${resolved.protocol})`);
 		const isMcp = resolved.protocol === "MCP";
 		const isA2a = resolved.protocol === "A2A";
 		if (resolved.protocol === "AGUI") logger.info("AGUI runtime: routing through the HTTP /invocations + /ws path (AG-UI wire is SSE / WebSocket on port 8080).");
@@ -15160,10 +15332,10 @@ async function resolveInboundAuthorization(resolved, options) {
 	const header = options.bearerToken ? `Bearer ${options.bearerToken}` : void 0;
 	if (!authorizer) return header;
 	if (options.verifyAuth === false) {
-		logger.warn(`Runtime '${resolved.logicalId}' declares a customJwtAuthorizer, but --no-verify-auth was set — skipping inbound JWT verification (local-dev escape hatch).`);
+		logger.warn(`Runtime ${displayIdent(resolved.logicalId)} declares a customJwtAuthorizer, but --no-verify-auth was set — skipping inbound JWT verification (local-dev escape hatch).`);
 		return header;
 	}
-	if (!header) throw new CdkLocalError(`Runtime '${resolved.logicalId}' requires an inbound JWT (customJwtAuthorizer). Pass --bearer-token <jwt>, or --no-verify-auth to skip verification for local dev.`, "LOCAL_INVOKE_AGENTCORE_AUTH_REQUIRED");
+	if (!header) throw new CdkLocalError(`Runtime ${displayIdent(resolved.logicalId)} requires an inbound JWT (customJwtAuthorizer). Pass --bearer-token <jwt>, or --no-verify-auth to skip verification for local dev.`, "LOCAL_INVOKE_AGENTCORE_AUTH_REQUIRED");
 	if (!(await verifyJwtViaDiscovery({
 		discoveryUrl: authorizer.discoveryUrl,
 		...authorizer.allowedAudience && { allowedAudience: authorizer.allowedAudience },
@@ -15178,7 +15350,7 @@ async function resolveAgentCoreSigV4Context(options, resolved, loaded, stateProv
 	if (!options.sigv4) return void 0;
 	if (options.bearerToken) throw new CdkLocalError(`--sigv4 and --bearer-token are mutually exclusive: pick one inbound auth.`, "LOCAL_INVOKE_AGENTCORE_AUTH_CONFLICT");
 	if (resolved.jwtAuthorizer) {
-		getLogger().warn(`Runtime '${resolved.logicalId}' declares a customJwtAuthorizer; --sigv4 ignored (JWT path takes precedence).`);
+		getLogger().warn(`Runtime ${displayIdent(resolved.logicalId)} declares a customJwtAuthorizer; --sigv4 ignored (JWT path takes precedence).`);
 		return;
 	}
 	const region = options.region ?? options.stackRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? resolved.stack.region;
@@ -15249,11 +15421,11 @@ async function resolveAgentCoreImage(resolved, options, loaded, stateProvider) {
 	const architecture = platformToArchitecture(options.platform);
 	if (resolved.codeArtifact) return resolveAgentCoreCodeImage(resolved, resolved.codeArtifact, options, architecture, loaded, stateProvider);
 	const containerUri = resolved.containerUri;
-	if (containerUri === void 0) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' has neither a container image nor a code artifact to run.`, "LOCAL_INVOKE_AGENTCORE_NO_ARTIFACT");
+	if (containerUri === void 0) throw new CdkLocalError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} has neither a container image nor a code artifact to run.`, "LOCAL_INVOKE_AGENTCORE_NO_ARTIFACT");
 	const manifestPath = resolved.stack.assetManifestPath;
 	if (manifestPath) {
 		const cdkOutDir = dirname(manifestPath);
-		const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, resolved.stack.stackName);
+		const manifest = await new AssetManifestLoader().loadStackManifest(resolved.stack, cdkOutDir);
 		if (manifest) {
 			const entry = getDockerImageBySourceHash(manifest, containerUri);
 			if (entry) return buildContainerImage(entry.asset, cdkOutDir, {
@@ -15278,13 +15450,13 @@ async function resolveAgentCoreImage(resolved, options, loaded, stateProvider) {
 async function resolveAgentCoreCodeImage(resolved, code, options, architecture, loaded, stateProvider) {
 	if (code.s3Source) return resolveAgentCoreCodeImageFromS3(resolved, code, code.s3Source, options, architecture, loaded, stateProvider);
 	const manifestPath = resolved.stack.assetManifestPath;
-	if (!manifestPath) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' uses a code artifact, but its stack has no asset manifest in cdk.out to read the bundle source from.`, "LOCAL_INVOKE_AGENTCORE_CODE_NO_MANIFEST");
+	if (!manifestPath) throw new CdkLocalError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} uses a code artifact, but its stack has no asset manifest in cdk.out to read the bundle source from.`, "LOCAL_INVOKE_AGENTCORE_CODE_NO_MANIFEST");
 	const cdkOutDir = dirname(manifestPath);
 	const loader = new AssetManifestLoader();
-	const manifest = await loader.loadManifest(cdkOutDir, resolved.stack.stackName);
+	const manifest = await loader.loadStackManifest(resolved.stack, cdkOutDir);
 	const fileAssets = manifest ? loader.getFileAssets(manifest) : void 0;
 	const asset = fileAssets ? fileAssets.get(code.codeAssetHash) ?? findFileAssetByObjectKey$1(fileAssets, code.codeAssetHash) : void 0;
-	if (!asset) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' code bundle (asset ${code.codeAssetHash}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
+	if (!asset) throw new CdkLocalError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} code bundle (asset ${displayIdent(code.codeAssetHash)}) was not found in the cdk.out asset manifest. ${getEmbedConfig().cliName} invoke-agentcore runs a local from-source build of a fromCodeAsset bundle — re-synthesize the app so the asset is staged in cdk.out and retry. (A fromS3 bundle is downloaded from S3 instead; this runtime has no literal Code.S3.Bucket.)`, "LOCAL_INVOKE_AGENTCORE_CODE_ASSET_NOT_FOUND");
 	const sourceDir = loader.getAssetSourcePath(cdkOutDir, asset, {
 		assetOutdir: assetPathDirs(resolved.stack).assetOutdir,
 		subject: `AgentCore Runtime ${displayUntrustedValue(resolved.logicalId)} code bundle`,
@@ -15301,7 +15473,7 @@ async function resolveAgentCoreCodeImage(resolved, code, options, architecture,
 }
 async function resolveAgentCoreCodeImageFromS3(resolved, code, s3Source, options, architecture, loaded, stateProvider) {
 	const logger = getLogger();
-	if (typeof s3Source.bucket !== "string" || s3Source.bucket.length === 0) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' fromS3 bundle reached the image step with no literal bucket. This is a cdk-local bug — please report it.`, "LOCAL_INVOKE_AGENTCORE_FROMS3_BUCKET_UNRESOLVED");
+	if (typeof s3Source.bucket !== "string" || s3Source.bucket.length === 0) throw new CdkLocalError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} fromS3 bundle reached the image step with no literal bucket. This is a cdk-local bug — please report it.`, "LOCAL_INVOKE_AGENTCORE_FROMS3_BUCKET_UNRESOLVED");
 	const location = {
 		bucket: s3Source.bucket,
 		key: s3Source.key,
@@ -15408,7 +15580,7 @@ async function resolveFromS3BucketIntrinsic(resolved, stateProvider, loaded, ima
 	const s3Source = resolved.codeArtifact?.s3Source;
 	if (!s3Source || s3Source.bucketIntrinsic === void 0) return;
 	if (s3Source.bucket !== void 0) return;
-	if (!stateProvider || !loaded) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' fromS3 bundle's Code.S3.Bucket is an unresolved intrinsic (${describeIntrinsic(s3Source.bucketIntrinsic)}). Pass --from-cfn-stack so its physical bucket name can be resolved against the deployed stack state.`, "LOCAL_INVOKE_AGENTCORE_FROMS3_BUCKET_INTRINSIC_NO_STATE");
+	if (!stateProvider || !loaded) throw new CdkLocalError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} fromS3 bundle's Code.S3.Bucket is an unresolved intrinsic (${displayUntrustedValue(describeIntrinsic(s3Source.bucketIntrinsic))}). Pass --from-cfn-stack so its physical bucket name can be resolved against the deployed stack state.`, "LOCAL_INVOKE_AGENTCORE_FROMS3_BUCKET_INTRINSIC_NO_STATE");
 	const subContext = {
 		resources: imageContext?.stateResources ?? loaded.resources,
 		consumerRegion: loaded.region
@@ -15418,8 +15590,8 @@ async function resolveFromS3BucketIntrinsic(resolved, stateProvider, loaded, ima
 	const crossStackResolver = await stateProvider.buildCrossStackResolver(loaded.region);
 	if (crossStackResolver) subContext.crossStackResolver = crossStackResolver;
 	const result = await substituteAgainstStateAsync(s3Source.bucketIntrinsic, subContext);
-	if (result.kind !== "literal") throw new CdkLocalError(`Could not resolve AgentCore Runtime '${resolved.logicalId}' fromS3 Code.S3.Bucket intrinsic (${describeIntrinsic(s3Source.bucketIntrinsic)}) against the --from-cfn-stack state: ${result.reason}. Confirm the referenced resource / export exists in the deployed stack.`, "LOCAL_INVOKE_AGENTCORE_FROMS3_BUCKET_INTRINSIC_UNRESOLVED");
-	if (typeof result.value !== "string" || result.value.length === 0) throw new CdkLocalError(`AgentCore Runtime '${resolved.logicalId}' fromS3 Code.S3.Bucket intrinsic resolved to a ${typeof result.value} value, not a bucket name string. (${describeIntrinsic(s3Source.bucketIntrinsic)})`, "LOCAL_INVOKE_AGENTCORE_FROMS3_BUCKET_INTRINSIC_NOT_STRING");
+	if (result.kind !== "literal") throw new CdkLocalError(`Could not resolve AgentCore Runtime ${displayIdent(resolved.logicalId)} fromS3 Code.S3.Bucket intrinsic (${displayUntrustedValue(describeIntrinsic(s3Source.bucketIntrinsic))}) against the --from-cfn-stack state: ${result.reason}. Confirm the referenced resource / export exists in the deployed stack.`, "LOCAL_INVOKE_AGENTCORE_FROMS3_BUCKET_INTRINSIC_UNRESOLVED");
+	if (typeof result.value !== "string" || result.value.length === 0) throw new CdkLocalError(`AgentCore Runtime ${displayIdent(resolved.logicalId)} fromS3 Code.S3.Bucket intrinsic resolved to a ${typeof result.value} value, not a bucket name string. (${displayUntrustedValue(describeIntrinsic(s3Source.bucketIntrinsic))})`, "LOCAL_INVOKE_AGENTCORE_FROMS3_BUCKET_INTRINSIC_NOT_STRING");
 	s3Source.bucket = result.value;
 	getLogger().info(`Resolved fromS3 Code.S3.Bucket from state: ${describeIntrinsic(s3Source.bucketIntrinsic)} -> ${result.value}`);
 }
@@ -15508,7 +15680,7 @@ async function resolveAssumeRoleArn(options, resolved, loaded, stateProvider) {
 	if (options.assumeRole !== true) return void 0;
 	if (resolved.roleArn !== void 0) {
 		if (isIamRoleArn(resolved.roleArn)) return resolved.roleArn;
-		getLogger().warn(`--assume-role: the template RoleArn for '${resolved.logicalId}' is not a well-formed IAM role ARN: ${describeRejectedRoleArn(resolved.roleArn)}. Ignoring it.`);
+		getLogger().warn(`--assume-role: the template RoleArn for ${displayIdent(resolved.logicalId)} is not a well-formed IAM role ARN: ${describeRejectedRoleArn(resolved.roleArn)}. Ignoring it.`);
 	}
 	if (loaded) {
 		const fromState = resolveExecutionRoleArnFromState(loaded, resolved.logicalId, "RoleArn");
@@ -15519,7 +15691,7 @@ async function resolveAssumeRoleArn(options, resolved, loaded, stateProvider) {
 		const runtimePhysicalId = loaded.resources[resolved.logicalId]?.physicalId;
 		if (stateProvider?.resolveAgentCoreRuntimeRoleArn && runtimePhysicalId) {
 			const liveArn = await stateProvider.resolveAgentCoreRuntimeRoleArn(runtimePhysicalId);
-			if (liveArn !== void 0 && !isIamRoleArn(liveArn)) getLogger().warn(`--assume-role: GetAgentRuntime for '${resolved.logicalId}' produced a value that is not a well-formed IAM role ARN: ${describeRejectedRoleArn(liveArn)}. Ignoring it.`);
+			if (liveArn !== void 0 && !isIamRoleArn(liveArn)) getLogger().warn(`--assume-role: GetAgentRuntime for ${displayIdent(resolved.logicalId)} produced a value that is not a well-formed IAM role ARN: ${describeRejectedRoleArn(liveArn)}. Ignoring it.`);
 			else if (liveArn) {
 				getLogger().info(`--assume-role: auto-resolved execution role from GetAgentRuntime: ${flattenToOneLine(liveArn)}`);
 				return liveArn;
@@ -15869,7 +16041,7 @@ async function loadAgentCoreAssetContext(args) {
 	if (!newCandidate) return void 0;
 	if (resolved.codeArtifact) {
 		if (resolved.codeArtifact.s3Source) return void 0;
-		const manifest = await assetLoader.loadManifest(cdkOutDir, newCandidate.stackName);
+		const manifest = await assetLoader.loadStackManifest(newCandidate, cdkOutDir);
 		if (!manifest) return void 0;
 		const asset = assetLoader.getFileAssets(manifest).get(resolved.codeArtifact.codeAssetHash);
 		if (!asset) return void 0;
@@ -15886,7 +16058,7 @@ async function loadAgentCoreAssetContext(args) {
 		};
 	}
 	if (resolved.containerUri === void 0) return void 0;
-	const manifest = await assetLoader.loadManifest(cdkOutDir, newCandidate.stackName);
+	const manifest = await assetLoader.loadStackManifest(newCandidate, cdkOutDir);
 	if (!manifest) return void 0;
 	const dockerImageEntry = getDockerImageBySourceHash(manifest, resolved.containerUri);
 	if (!dockerImageEntry) return void 0;
@@ -15917,7 +16089,7 @@ async function deriveOldAssetHash(args) {
 	if (resolved.containerUri === void 0) return void 0;
 	const candidate = pickAgentCoreCandidateStack(resolvedTarget, stacks);
 	if (!candidate) return void 0;
-	const manifest = await assetLoader.loadManifest(cdkOutDir, candidate.stackName);
+	const manifest = await assetLoader.loadStackManifest(candidate, cdkOutDir);
 	if (!manifest) return void 0;
 	return getDockerImageBySourceHash(manifest, resolved.containerUri)?.hash;
 }
@@ -16081,7 +16253,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 		names = stdout.split("\n").map((n) => n.trim()).filter((n) => n.length > 0);
 	} catch (err) {
 		const e = err;
-		logger.debug(`docker network ls (sweep) failed: ${e.stderr || e.message || String(err)}`);
+		logger.debug(`docker network ls (sweep) failed: ${displayToolOutput(e.stderr || e.message || String(err))}`);
 		return [];
 	}
 	const swept = [];
@@ -16098,7 +16270,7 @@ async function sweepOrphanedSvcNetworks(prefix) {
 			attached = stdout.split(/\s+/).map((c) => c.trim()).filter((c) => c.length > 0);
 		} catch (err) {
 			const e = err;
-			logger.debug(`docker network inspect ${name} (sweep) failed: ${e.stderr || e.message || String(err)}`);
+			logger.debug(`docker network inspect ${name} (sweep) failed: ${displayToolOutput(e.stderr || e.message || String(err))}`);
 			continue;
 		}
 		const sidecarName = `${name}-metadata`;
@@ -16127,7 +16299,7 @@ async function createNetworkAndSidecar(args) {
 		]);
 	} catch (err) {
 		const e = err;
-		throw new DockerRunnerError(`docker network create failed: ${e.stderr?.trim() || e.message || String(err)}. Hint: another ${getEmbedConfig().productName} run may already own subnet ${cidr}; wait for it to finish, or remove the leftover network with \`docker network ls\` + \`docker network rm\`. \`${getEmbedConfig().cliName} start-service\` shares one network across every service in the run; bare \`${getEmbedConfig().cliName} run-task\` uses a per-task network so only one run can be active at a time.`);
+		throw new DockerRunnerError(`docker network create failed: ${displayToolOutput(e.stderr?.trim() || e.message || String(err))}. Hint: another ${getEmbedConfig().productName} run may already own subnet ${cidr}; wait for it to finish, or remove the leftover network with \`docker network ls\` + \`docker network rm\`. \`${getEmbedConfig().cliName} start-service\` shares one network across every service in the run; bare \`${getEmbedConfig().cliName} run-task\` uses a per-task network so only one run can be active at a time.`);
 	}
 	const sidecarArgs = [
 		"run",
@@ -16160,7 +16332,7 @@ async function createNetworkAndSidecar(args) {
 		return stdout.trim();
 	} catch (err) {
 		await destroyNetworkOnly(networkName);
-		throw new DockerRunnerError(`Failed to start metadata-endpoints sidecar: ${err.stderr?.trim() || describeExitWithoutArgv(err)}`);
+		throw new DockerRunnerError(`Failed to start metadata-endpoints sidecar: ${displayToolOutput(err.stderr?.trim() || describeExitWithoutArgv(err))}`);
 	}
 }
 async function createTaskNetwork(options = {}) {
@@ -16209,7 +16381,7 @@ async function destroyNetworkOnly(networkName) {
 		logger.debug(`Removed docker network ${networkName}`);
 	} catch (err) {
 		const e = err;
-		logger.debug(`docker network rm ${networkName} failed: ${e.stderr || e.message || String(err)}`);
+		logger.debug(`docker network rm ${networkName} failed: ${displayToolOutput(e.stderr || e.message || String(err))}`);
 	}
 }
 
@@ -16240,7 +16412,7 @@ async function resolveEcsSecrets(entries, options = {}) {
 	try {
 		return await Promise.all(entries.map(async (entry) => {
 			const value = await resolveOne(entry, secretsClient, ssmClient);
-			logger.debug(`Resolved secret ${entry.containerName}.${entry.name} (${entry.valueFrom})`);
+			logger.debug(`Resolved secret ${displayIdent(entry.containerName)}.${displayIdent(entry.name)} (${displayUntrustedValue(entry.valueFrom)})`);
 			return {
 				...entry,
 				value
@@ -16283,20 +16455,20 @@ async function resolveSecretsManager(entry, shape, client) {
 	try {
 		secretString = (await client.send(new GetSecretValueCommand({ SecretId: shape.baseArn }))).SecretString;
 	} catch (err) {
-		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}): ${describeAwsFailureForWarn(err, "SecretsManager GetSecretValue")}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve Secrets Manager secret for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayUntrustedValue(shape.baseArn)}): ${describeAwsFailureForWarn(err, "SecretsManager GetSecretValue")}`);
 	}
-	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container '${entry.containerName}' / env '${entry.name}' (${shape.baseArn}). Binary secrets are not supported.`);
+	if (secretString === void 0) throw new EcsSecretsResolutionError(`Secrets Manager returned no SecretString for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayUntrustedValue(shape.baseArn)}). Binary secrets are not supported.`);
 	if (shape.jsonKey === void 0) return secretString;
 	let parsed;
 	try {
 		parsed = JSON.parse(secretString);
 	} catch (err) {
 		const kind = err instanceof Error ? err.name : "unknown";
-		throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but the secret value is not valid JSON (${kind}). The parser detail is withheld because it would echo the secret plaintext.`);
+		throw new EcsSecretsResolutionError(`Container ${displayIdent(entry.containerName)} secret ${displayIdent(entry.name)} specified json-key ${displayIdent(shape.jsonKey)} but the secret value is not valid JSON (${kind}). The parser detail is withheld because it would echo the secret plaintext.`);
 	}
-	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but the secret root is not a JSON object.`);
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new EcsSecretsResolutionError(`Container ${displayIdent(entry.containerName)} secret ${displayIdent(entry.name)} specified json-key ${displayIdent(shape.jsonKey)} but the secret root is not a JSON object.`);
 	const value = parsed[shape.jsonKey];
-	if (value === void 0) throw new EcsSecretsResolutionError(`Container '${entry.containerName}' secret '${entry.name}' specified json-key '${shape.jsonKey}' but no such key exists in the secret JSON.`);
+	if (value === void 0) throw new EcsSecretsResolutionError(`Container ${displayIdent(entry.containerName)} secret ${displayIdent(entry.name)} specified json-key ${displayIdent(shape.jsonKey)} but no such key exists in the secret JSON.`);
 	return typeof value === "string" ? value : JSON.stringify(value);
 }
 async function resolveSsm(entry, shape, client) {
@@ -16305,11 +16477,11 @@ async function resolveSsm(entry, shape, client) {
 			Name: shape.name,
 			WithDecryption: true
 		}))).Parameter?.Value;
-		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter '${shape.name}' returned no Value for container '${entry.containerName}' / env '${entry.name}'.`);
+		if (value === void 0) throw new EcsSecretsResolutionError(`SSM parameter ${displayUntrustedValue(shape.name)} returned no Value for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)}.`);
 		return value;
 	} catch (err) {
 		if (err instanceof EcsSecretsResolutionError) throw err;
-		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container '${entry.containerName}' / env '${entry.name}' (${shape.name}): ${describeAwsFailureForWarn(err, "SSM GetParameter (ECS secret)")}`);
+		throw new EcsSecretsResolutionError(`Failed to resolve SSM parameter for container ${displayIdent(entry.containerName)} / env ${displayIdent(entry.name)} (${displayUntrustedValue(shape.name)}): ${describeAwsFailureForWarn(err, "SSM GetParameter (ECS secret)")}`);
 	}
 }
 
@@ -16374,7 +16546,7 @@ function mergeHostGatewayAddHostFlags(addHostFlags, hostGatewayExtraHosts) {
 }
 async function runEcsTask(task, options, state) {
 	const logger = getLogger();
-	if (task.containers.length === 0) throw new EcsTaskRunnerError(`Task '${task.taskDefinitionLogicalId}' has no containers — nothing to run.`);
+	if (task.containers.length === 0) throw new EcsTaskRunnerError(`Task ${displayIdent(task.taskDefinitionLogicalId)} has no containers — nothing to run.`);
 	for (const w of task.warnings) logger.warn(w);
 	const startOrder = topoSort(buildDependencyGraph(task.containers), task.containers);
 	const finchRefusals = [];
@@ -16465,7 +16637,7 @@ async function runEcsTask(task, options, state) {
 	const dockerCmds = /* @__PURE__ */ new Map();
 	for (const container of task.containers) {
 		const image = imagePlan.get(container.name);
-		if (!image) throw new EcsTaskRunnerError(`Internal: no resolved image for container '${container.name}'.`);
+		if (!image) throw new EcsTaskRunnerError(`Internal: no resolved image for container ${displayIdent(container.name)}.`);
 		const dynamic = dynamicEnvByContainer.get(container.name);
 		const built = buildDockerRunArgs({
 			task,
@@ -16505,7 +16677,7 @@ async function runEcsTask(task, options, state) {
 		const container = task.containers.find((c) => c.name === containerName);
 		await awaitDependencies(container, startedByName);
 		const { args, sensitiveEnv } = dockerCmds.get(container.name);
-		logger.info(`Starting container '${container.name}' (image=${imagePlan.get(container.name)})`);
+		logger.info(`Starting container ${displayIdent(container.name)} (image=${displayIdent(imagePlan.get(container.name))})`);
 		let id;
 		warnFinchArgvExposure(Object.keys(sensitiveEnv));
 		try {
@@ -16516,7 +16688,7 @@ async function runEcsTask(task, options, state) {
 			id = stdout.trim();
 		} catch (err) {
 			const e = err;
-			throw new DockerRunnerError(`docker run failed for container '${container.name}': ${e.stderr?.trim() || describeExitWithoutArgv(err)}`);
+			throw new DockerRunnerError(`docker run failed for container ${displayIdent(container.name)}: ${displayToolOutput(e.stderr?.trim() || describeExitWithoutArgv(err))}`);
 		}
 		state.startedContainers.push({
 			name: container.name,
@@ -16526,7 +16698,7 @@ async function runEcsTask(task, options, state) {
 			id,
 			container
 		});
-		if (!options.detach) state.logStoppers.push(attachContainerLogStreamer(`[${container.name}] `, id));
+		if (!options.detach) state.logStoppers.push(attachContainerLogStreamer(`[${displayIdent(container.name)}] `, id));
 	}
 	if (options.detach) return {
 		exitCode: 0,
@@ -16535,7 +16707,7 @@ async function runEcsTask(task, options, state) {
 	options.onReady?.();
 	const essential = task.containers.find((c) => c.essential) ?? task.containers[0];
 	const essentialId = startedByName.get(essential.name)?.id;
-	if (!essentialId) throw new EcsTaskRunnerError(`Essential container '${essential.name}' did not start.`);
+	if (!essentialId) throw new EcsTaskRunnerError(`Essential container ${displayIdent(essential.name)} did not start.`);
 	return {
 		exitCode: await waitForContainerExit(essentialId),
 		essentialContainerName: essential.name,
@@ -16578,7 +16750,7 @@ function topoSort(g, containers) {
 async function awaitDependencies(container, started) {
 	for (const dep of container.dependsOn) {
 		const entry = started.get(dep.containerName);
-		if (!entry) throw new EcsTaskRunnerError(`Container '${container.name}' depends on '${dep.containerName}' but the latter never started.`);
+		if (!entry) throw new EcsTaskRunnerError(`Container ${displayIdent(container.name)} depends on ${displayIdent(dep.containerName)} but the latter never started.`);
 		switch (dep.condition) {
 			case "START": break;
 			case "COMPLETE":
@@ -16586,7 +16758,7 @@ async function awaitDependencies(container, started) {
 				break;
 			case "SUCCESS": {
 				const code = await waitForContainerExit(entry.id);
-				if (code !== 0) throw new EcsTaskRunnerError(`Container '${container.name}' requires dependency '${dep.containerName}' to exit 0, but it exited ${code}.`);
+				if (code !== 0) throw new EcsTaskRunnerError(`Container ${displayIdent(container.name)} requires dependency ${displayIdent(dep.containerName)} to exit 0, but it exited ${code}.`);
 				break;
 			}
 			case "HEALTHY":
@@ -16609,18 +16781,18 @@ async function waitForContainerHealthy(containerId, displayName) {
 			]);
 			const status = stdout.trim();
 			if (status !== lastStatus) {
-				logger.debug(`Container '${displayName}' health status: ${status}`);
+				logger.debug(`Container ${displayIdent(displayName)} health status: ${status}`);
 				lastStatus = status;
 			}
 			if (status === "healthy") return;
-			if (status === "unhealthy") throw new EcsTaskRunnerError(`Container '${displayName}' health status is 'unhealthy'; aborting before dependents start.`);
+			if (status === "unhealthy") throw new EcsTaskRunnerError(`Container ${displayIdent(displayName)} health status is 'unhealthy'; aborting before dependents start.`);
 		} catch (err) {
 			if (err instanceof EcsTaskRunnerError) throw err;
-			logger.debug(`docker inspect on '${displayName}' failed: ${err instanceof Error ? err.message : String(err)}`);
+			logger.debug(`docker inspect on ${displayIdent(displayName)} failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		await sleep$1(1e3);
 	}
-	throw new EcsTaskRunnerError(`Container '${displayName}' did not become healthy within 5 minutes.`);
+	throw new EcsTaskRunnerError(`Container ${displayIdent(displayName)} did not become healthy within 5 minutes.`);
 }
 async function waitForContainerExit(containerId) {
 	try {
@@ -16651,12 +16823,12 @@ async function prepareImages(task, out, options) {
 		const overrideTag = options.imageOverrideByContainer?.get(container.name);
 		if (overrideTag !== void 0) {
 			out.set(container.name, overrideTag);
-			logger.debug(`Container '${container.name}' image=${overrideTag} (--image-override)`);
+			logger.debug(`Container ${displayIdent(container.name)} image=${displayIdent(overrideTag)} (--image-override)`);
 			continue;
 		}
 		const image = await prepareOneImage(task, container, options);
 		out.set(container.name, image);
-		logger.debug(`Container '${container.name}' image=${image}`);
+		logger.debug(`Container ${displayIdent(container.name)} image=${displayIdent(image)}`);
 	}
 }
 async function prepareOneImage(task, container, options) {
@@ -16673,30 +16845,30 @@ async function prepareOneImage(task, container, options) {
 		});
 		case "cdk-asset": {
 			const cdkOutDir = task.stack.assetManifestPath ? dirname(task.stack.assetManifestPath) : void 0;
-			if (!cdkOutDir) throw new EcsTaskRunnerError(`Container '${container.name}' uses a CDK asset image but the stack has no asset manifest. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
-			const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, task.stack.stackName);
-			if (!manifest) throw new EcsTaskRunnerError(`No asset manifest at ${cdkOutDir} for stack ${task.stack.stackName}.`);
+			if (!cdkOutDir) throw new EcsTaskRunnerError(`Container ${displayIdent(container.name)} uses a CDK asset image but the stack has no asset manifest. Re-synthesize the app (without \`--output <stale-dir>\`) and retry.`);
+			const manifest = await new AssetManifestLoader().loadStackManifest(task.stack, cdkOutDir);
+			if (!manifest) throw new EcsTaskRunnerError(`No asset manifest at ${displayUntrustedValue(cdkOutDir)} for stack ${displayStackName(task.stack.stackName)}.`);
 			const dockerImages = manifest.dockerImages ?? {};
 			const entries = Object.entries(dockerImages);
 			let asset;
 			if (image.assetHash && dockerImages[image.assetHash]) asset = dockerImages[image.assetHash];
 			else if (entries.length === 1) asset = entries[0][1];
-			if (!asset) throw new EcsTaskRunnerError(`Container '${container.name}' references a CDK asset image but no matching entry was found in cdk.out. Re-synthesize the CDK app and retry.`);
+			if (!asset) throw new EcsTaskRunnerError(`Container ${displayIdent(container.name)} references a CDK asset image but no matching entry was found in cdk.out. Re-synthesize the CDK app and retry.`);
 			const tag = `${getEmbedConfig().resourceNamePrefix}-run-task-${(image.assetHash ?? "single").slice(0, 16)}`;
 			if (options.skipBuild === true) {
 				const logger = getLogger().child("ecs-runner");
-				if (image.assetHash === void 0) throw new LocalInvokeBuildError(`Cannot honor --no-build for ECS container '${container.name}': the asset has no stable assetHash (synthetic tag '${tag}' may collide with unrelated prior runs). Drop --no-build, or re-synthesize with an explicit assetHash on the ContainerImage.fromAsset call.`);
-				logger.info(`Skipping docker build (--no-build) for container '${container.name}'; verifying ${tag} is in local registry...`);
-				if (!await isImageInLocalCache(tag)) throw new LocalInvokeBuildError(`image '${tag}' not in local registry and --no-build is set (ECS container '${container.name}'); remove --no-build or run \`docker build\` manually first.`);
-				logger.debug(`Local tag ${tag} is cached; skipping build for container '${container.name}'.`);
+				if (image.assetHash === void 0) throw new LocalInvokeBuildError(`Cannot honor --no-build for ECS container ${displayIdent(container.name)}: the asset has no stable assetHash (synthetic tag ${displayIdent(tag)} may collide with unrelated prior runs). Drop --no-build, or re-synthesize with an explicit assetHash on the ContainerImage.fromAsset call.`);
+				logger.info(`Skipping docker build (--no-build) for container ${displayIdent(container.name)}; verifying ${displayIdent(tag)} is in local registry...`);
+				if (!await isImageInLocalCache(tag)) throw new LocalInvokeBuildError(`image ${displayIdent(tag)} not in local registry and --no-build is set (ECS container ${displayIdent(container.name)}); remove --no-build or run \`docker build\` manually first.`);
+				logger.debug(`Local tag ${displayIdent(tag)} is cached; skipping build for container ${displayIdent(container.name)}.`);
 				return tag;
 			}
 			const actualTag = await buildDockerImage(asset, cdkOutDir, {
 				tag,
 				assetOutdir: assetPathDirs(task.stack).assetOutdir,
 				...options.platformOverride !== void 0 && { platform: options.platformOverride },
-				wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for ECS container '${container.name}' (${displayUntrustedValue(asset.source.directory ?? asset.source.executable?.[0] ?? "")}): ${stderr}`),
-				progressLabel: `Building container image for '${container.name}'`
+				wrapError: (stderr) => new LocalInvokeBuildError(`docker build failed for ECS container ${displayIdent(container.name)} (${displayUntrustedValue(asset.source.directory ?? asset.source.executable?.[0] ?? "")}): ${stderr}`),
+				progressLabel: `Building container image for ${displayIdent(container.name)}`
 			});
 			if (actualTag !== tag) try {
 				await runDockerStreaming([
@@ -16706,7 +16878,7 @@ async function prepareOneImage(task, container, options) {
 				]);
 			} catch (err) {
 				const e = err;
-				throw new LocalInvokeBuildError(`docker tag failed re-tagging '${actualTag}' → '${tag}' for ECS container '${container.name}': ${e.stderr?.trim() || e.message || String(err)}`);
+				throw new LocalInvokeBuildError(`docker tag failed re-tagging ${displayIdent(actualTag)} → ${displayIdent(tag)} for ECS container ${displayIdent(container.name)}: ${displayToolOutput(e.stderr?.trim() || e.message || String(err))}`);
 			}
 			return tag;
 		}
@@ -16731,10 +16903,10 @@ async function realizeDockerVolumes(volumes, state) {
 		try {
 			await execFileAsync$2(getDockerCmd(), args);
 			state.dockerVolumeNames.push(dockerVolumeName);
-			logger.debug(`Created docker volume ${dockerVolumeName} for task volume '${v.name}'`);
+			logger.debug(`Created docker volume ${displayIdent(dockerVolumeName)} for task volume ${displayIdent(v.name)}`);
 		} catch (err) {
 			const e = err;
-			throw new DockerRunnerError(`docker volume create failed for '${v.name}': ${e.stderr?.trim() || describeExitWithoutArgv(err)}`);
+			throw new DockerRunnerError(`docker volume create failed for ${displayIdent(v.name)}: ${displayToolOutput(e.stderr?.trim() || describeExitWithoutArgv(err))}`);
 		}
 		out.set(v.name, {
 			...v,
@@ -16796,7 +16968,7 @@ async function resolvePrivilegedHostPortRemaps(opts) {
 		seen.add(cp);
 		const freePort = await allocate();
 		remaps[cp] = freePort;
-		getLogger().child("ecs").warn(`Container '${container.name}' container port ${cp} declares a privileged host port ${declaredHostPort}, which cannot be published locally (macOS Docker Desktop rejects privileged-port publishing; a host port < 1024 needs root). Auto-remapped to host port ${freePort}. Pass --host-port ${cp}=<hostPort> to pin a specific host port.`);
+		getLogger().child("ecs").warn(`Container ${displayIdent(container.name)} container port ${cp} declares a privileged host port ${declaredHostPort}, which cannot be published locally (macOS Docker Desktop rejects privileged-port publishing; a host port < 1024 needs root). Auto-remapped to host port ${freePort}. Pass --host-port ${cp}=<hostPort> to pin a specific host port.`);
 	}
 	return remaps;
 }
@@ -16829,7 +17001,7 @@ function buildDockerRunArgs(opts) {
 		const hostPort = opts.hostPortOverrides?.[pm.containerPort] ?? declaredHostPort;
 		const overridden = hostPort !== declaredHostPort;
 		const overrideNote = opts.autoRemappedContainerPorts?.has(pm.containerPort) ?? false ? " (privileged-port auto-remap)" : overridden ? " (--host-port override)" : "";
-		getLogger().child("ecs").info(`Container '${container.name}' container port ${pm.containerPort} published on ${formatAuthority(containerHost, hostPort)}${overrideNote}. Reach it at ${formatAuthority(containerHost, hostPort)}.`);
+		getLogger().child("ecs").info(`Container ${displayIdent(container.name)} container port ${pm.containerPort} published on ${formatAuthority(containerHost, hostPort)}${overrideNote}. Reach it at ${formatAuthority(containerHost, hostPort)}.`);
 		args.push("-p", `${containerHost}:${hostPort}:${pm.containerPort}/${pm.protocol}`);
 		publishedEndpoints.push({
 			containerName: container.name,
@@ -16923,7 +17095,7 @@ function shellJoin(parts) {
 function resolveEcsServiceTarget(target, stacks, context, options) {
 	if (stacks.length === 0) throw new EcsTaskResolutionError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$2(parsed, stacks);
+	const stack = pickStack$2(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	let serviceLogicalId;
 	let serviceResource;
@@ -16940,15 +17112,15 @@ function resolveEcsServiceTarget(target, stacks, context, options) {
 		serviceLogicalId = parsed.pathOrId;
 	}
 	if (!serviceLogicalId || !serviceResource) throw notFoundError(target, stack, resources, parsed);
-	if (serviceResource.Type === "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`Resource '${serviceLogicalId}' in ${stack.stackName} is an ECS TaskDefinition, not a Service. Use \`${getEmbedConfig().cliName} run-task\` for one-shot tasks; \`${getEmbedConfig().cliName} start-service\` is Service-only.`);
-	if (serviceResource.Type !== "AWS::ECS::Service") throw new EcsTaskResolutionError(`Resource '${serviceLogicalId}' in ${stack.stackName} is ${serviceResource.Type}, not an AWS::ECS::Service.`);
+	if (serviceResource.Type === "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`Resource ${displayIdent(serviceLogicalId)} in ${stack.stackName} is an ECS TaskDefinition, not a Service. Use \`${getEmbedConfig().cliName} run-task\` for one-shot tasks; \`${getEmbedConfig().cliName} start-service\` is Service-only.`);
+	if (serviceResource.Type !== "AWS::ECS::Service") throw new EcsTaskResolutionError(`Resource ${displayIdent(serviceLogicalId)} in ${stack.stackName} is ${displayIdent(serviceResource.Type)}, not an AWS::ECS::Service.`);
 	return extractServiceProperties(stack, serviceLogicalId, serviceResource, stacks, context, options);
 }
 function extractServiceProperties(stack, serviceLogicalId, resource, stacks, context, options) {
 	const props = resource.Properties ?? {};
 	const warnings = [];
 	const taskDefRef = props["TaskDefinition"];
-	if (taskDefRef === void 0 || taskDefRef === null) throw new EcsTaskResolutionError(`ECS Service '${serviceLogicalId}' in ${stack.stackName} has no TaskDefinition property.`);
+	if (taskDefRef === void 0 || taskDefRef === null) throw new EcsTaskResolutionError(`ECS Service ${displayIdent(serviceLogicalId)} in ${stack.stackName} has no TaskDefinition property.`);
 	const taskDefLogicalId = resolveTaskDefinitionReference(taskDefRef, stack, serviceLogicalId);
 	const task = resolveEcsTaskTarget(`${stack.stackName}:${taskDefLogicalId}`, stacks, context);
 	const desiredCount = parseDesiredCount(props["DesiredCount"], serviceLogicalId);
@@ -16957,7 +17129,7 @@ function extractServiceProperties(stack, serviceLogicalId, resource, stacks, con
 	const serviceDisplayName = deriveServiceDisplayName(props["ServiceName"], serviceLogicalId, resource.Metadata);
 	if (!options?.suppressLoadBalancerWarning && Array.isArray(props["LoadBalancers"]) && props["LoadBalancers"].length > 0) {
 		const { cliName } = getEmbedConfig();
-		warnings.push(`ECS Service '${serviceLogicalId}' declares LoadBalancers, but \`${cliName} start-service\` runs the replicas only; no local listener fronts them. Reach the containers via their published ports, or run \`${cliName} start-alb <Stack>/<Alb>\` to boot the same replicas behind a local front-door that round-robins the listener rules.`);
+		warnings.push(`ECS Service ${displayIdent(serviceLogicalId)} declares LoadBalancers, but \`${cliName} start-service\` runs the replicas only; no local listener fronts them. Reach the containers via their published ports, or run \`${cliName} start-alb <Stack>/<Alb>\` to boot the same replicas behind a local front-door that round-robins the listener rules.`);
 	}
 	const serviceConnect = extractServiceConnect(props["ServiceConnectConfiguration"], task);
 	const out = {
@@ -16995,7 +17167,10 @@ function extractServiceConnect(raw, task) {
 		const portName = typeof e["PortName"] === "string" ? e["PortName"] : void 0;
 		if (!portName) throw new EcsTaskResolutionError(`ServiceConnectConfiguration.Services[] entry has no PortName: ${JSON.stringify(entry)}. Every Service entry must reference a producer-side PortMappings[].Name.`);
 		const containerPort = portByName.get(portName);
-		if (containerPort === void 0) throw new EcsTaskResolutionError(`ServiceConnectConfiguration.Services[].PortName='${portName}' does not match any PortMappings[].Name on the producer TaskDef (available: ${[...portByName.keys()].join(", ") || "(none)"}).`);
+		if (containerPort === void 0) {
+			const available = [...portByName.keys()].join(", ") || "(none)";
+			throw new EcsTaskResolutionError(`ServiceConnectConfiguration.Services[].PortName=${displayIdent(portName)} does not match any PortMappings[].Name on the producer TaskDef (available: ${available}).`);
+		}
 		const clientAliases = [];
 		if (Array.isArray(e["ClientAliases"])) for (const ca of e["ClientAliases"]) {
 			if (!ca || typeof ca !== "object") continue;
@@ -17027,7 +17202,7 @@ function extractServiceRegistries(raw, serviceLogicalId, warnings) {
 		const registryArn = e["RegistryArn"];
 		let cloudMapServiceLogicalId;
 		if (typeof registryArn === "string") {
-			warnings.push(`ECS Service '${serviceLogicalId}' ServiceRegistries[] entry has a literal-string RegistryArn ('${registryArn}'); ${getEmbedConfig().productName} cannot resolve external Cloud Map services locally. Skipping this registration; peer services will not discover this endpoint through the in-process registry. Use Fn::GetAtt: [<CloudMapServiceLogicalId>, "Arn"] instead so ${getEmbedConfig().productName} can resolve the namespace + service name from the synthesized template.`);
+			warnings.push(`ECS Service ${displayIdent(serviceLogicalId)} ServiceRegistries[] entry has a literal-string RegistryArn (${displayUntrustedValue(registryArn)}); ${getEmbedConfig().productName} cannot resolve external Cloud Map services locally. Skipping this registration; peer services will not discover this endpoint through the in-process registry. Use Fn::GetAtt: [<CloudMapServiceLogicalId>, "Arn"] instead so ${getEmbedConfig().productName} can resolve the namespace + service name from the synthesized template.`);
 			continue;
 		}
 		if (registryArn && typeof registryArn === "object" && !Array.isArray(registryArn)) {
@@ -17051,18 +17226,18 @@ function resolveTaskDefinitionReference(taskDefRef, stack, serviceLogicalId) {
 		const refValue = taskDefRef["Ref"];
 		if (typeof refValue === "string") {
 			const target = (stack.template.Resources ?? {})[refValue];
-			if (!target) throw new EcsTaskResolutionError(`ECS Service '${serviceLogicalId}' references TaskDefinition '${refValue}' but no such resource exists in ${stack.stackName}.`);
-			if (target.Type !== "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`ECS Service '${serviceLogicalId}' references '${refValue}' as TaskDefinition but it is of type ${target.Type}, not AWS::ECS::TaskDefinition.`);
+			if (!target) throw new EcsTaskResolutionError(`ECS Service ${displayIdent(serviceLogicalId)} references TaskDefinition ${displayIdent(refValue)} but no such resource exists in ${stack.stackName}.`);
+			if (target.Type !== "AWS::ECS::TaskDefinition") throw new EcsTaskResolutionError(`ECS Service ${displayIdent(serviceLogicalId)} references ${displayIdent(refValue)} as TaskDefinition but it is of type ${displayIdent(target.Type)}, not AWS::ECS::TaskDefinition.`);
 			return refValue;
 		}
 	}
-	throw new EcsTaskResolutionError(`ECS Service '${serviceLogicalId}' has an unsupported TaskDefinition reference shape: ${JSON.stringify(taskDefRef)}. ${getEmbedConfig().cliName} start-service v1 supports only Ref to a same-stack AWS::ECS::TaskDefinition; cross-stack TaskDefinitions are deferred.`);
+	throw new EcsTaskResolutionError(`ECS Service ${displayIdent(serviceLogicalId)} has an unsupported TaskDefinition reference shape: ${JSON.stringify(taskDefRef)}. ${getEmbedConfig().cliName} start-service v1 supports only Ref to a same-stack AWS::ECS::TaskDefinition; cross-stack TaskDefinitions are deferred.`);
 }
 function parseDesiredCount(raw, serviceLogicalId) {
 	if (raw === void 0 || raw === null) return 1;
 	if (typeof raw === "number" && Number.isFinite(raw) && raw >= 0) return Math.floor(raw);
 	if (typeof raw === "string" && /^\d+$/.test(raw)) return parseInt(raw, 10);
-	throw new EcsTaskResolutionError(`ECS Service '${serviceLogicalId}' has an unsupported DesiredCount value: ${JSON.stringify(raw)}. Must be a non-negative integer.`);
+	throw new EcsTaskResolutionError(`ECS Service ${displayIdent(serviceLogicalId)} has an unsupported DesiredCount value: ${JSON.stringify(raw)}. Must be a non-negative integer.`);
 }
 function parseHealthCheckGrace(raw, _serviceLogicalId) {
 	if (raw === void 0 || raw === null) return 30;
@@ -17092,15 +17267,14 @@ function deriveServiceDisplayName(rawServiceName, serviceLogicalId, metadata) {
 	}
 	return serviceLogicalId;
 }
-function pickStack$2(parsed, stacks) {
-	if (parsed.stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		throw new EcsTaskResolutionError(`Target has no stack prefix, and the assembly contains ${stacks.length} stacks: ${stacks.map((s) => s.stackName).join(", ")}. Pass the target as 'Stack/Path' or 'Stack:LogicalId'.`);
+function pickStack$2(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new EcsTaskResolutionError(`Target has no stack prefix, and the assembly contains ${stacks.length} stacks: ${describeStacks(stacks)}. Pass the target as 'Stack/Path' or 'Stack:LogicalId'.`);
+		case "not-found": throw new EcsTaskResolutionError(`No stack matches '${selection.pattern}'. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new EcsTaskResolutionError(`Multiple stacks match '${selection.pattern}': ${describeStacks(selection.matched)}. Refine the pattern, or use the stack's display path (path form).`);
 	}
-	const matched = matchStacks(stacks, [parsed.stackPattern]);
-	if (matched.length === 0) throw new EcsTaskResolutionError(`No stack matches '${parsed.stackPattern}'. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
-	if (matched.length > 1) throw new EcsTaskResolutionError(`Multiple stacks match '${parsed.stackPattern}': ${matched.map((s) => s.stackName).join(", ")}. Refine the pattern.`);
-	return matched[0];
 }
 function notFoundError(target, stack, resources, parsed) {
 	const services = [];
@@ -17117,10 +17291,10 @@ function notFoundError(target, stack, resources, parsed) {
 	const width = Math.max(...services.map((s) => s.displayPath.length));
 	let msg = `Target '${target}' did not match any ECS Service in ${stack.stackName}.\n\n`;
 	msg += `Available services in ${stack.stackName} (CDK path and logical ID):\n`;
-	for (const s of services) msg += `  ${s.displayPath.padEnd(width)}  (${s.logicalId})\n`;
+	for (const s of services) msg += `  ${s.displayPath.padEnd(width)}  (${displayIdent(s.logicalId)})\n`;
 	if (parsed.isPath) {
 		const tail = parsed.pathOrId.includes("/") ? parsed.pathOrId.slice(parsed.pathOrId.lastIndexOf("/") + 1) : parsed.pathOrId;
-		if (services.some((s) => s.logicalId === tail)) msg += `\n'${tail}' is a logical ID, but the 'Stack/Path' form matches CDK construct paths. To target it by logical ID, use the colon form: '${stack.stackName}:${tail}'.`;
+		if (services.some((s) => s.logicalId === tail)) msg += `\n${displayIdent(tail)} is a logical ID, but the 'Stack/Path' form matches CDK construct paths. To target it by logical ID, use the colon form: ${displayStackName(`${stack.stackName}:${tail}`)}.`;
 	}
 	return new EcsTaskResolutionError(msg.trimEnd());
 }
@@ -17201,8 +17375,8 @@ async function startEcsService(service, options, runState) {
 	const logger = getLogger().child("ecs-service");
 	for (const w of service.warnings) logger.warn(w);
 	const replicaCount = computeReplicaCount(service.desiredCount, options.maxTasks);
-	if (replicaCount < service.desiredCount) logger.warn(`Service '${service.serviceName}' template DesiredCount=${service.desiredCount} exceeds --max-tasks=${options.maxTasks}; running ${replicaCount} replica(s) locally. Raise --max-tasks to lift the cap, or accept the reduced concurrency for local dev.`);
-	logger.info(`Starting ECS service '${service.serviceName}' with ${replicaCount} replica(s) (restartPolicy=${options.restartPolicy})`);
+	if (replicaCount < service.desiredCount) logger.warn(`Service ${displayIdent(service.serviceName)} template DesiredCount=${service.desiredCount} exceeds --max-tasks=${options.maxTasks}; running ${replicaCount} replica(s) locally. Raise --max-tasks to lift the cap, or accept the reduced concurrency for local dev.`);
+	logger.info(`Starting ECS service ${displayIdent(service.serviceName)} with ${replicaCount} replica(s) (restartPolicy=${options.restartPolicy})`);
 	for (let i = 0; i < replicaCount; i++) {
 		const instance = {
 			index: i,
@@ -17221,7 +17395,7 @@ async function startEcsService(service, options, runState) {
 			await bootPromise;
 		} catch (err) {
 			instance.lastError = err instanceof Error ? err : new Error(String(err));
-			throw new EcsServiceRunnerError(`Failed to boot replica ${i} of service '${service.serviceName}': ${instance.lastError.message}`);
+			throw new EcsServiceRunnerError(`Failed to boot replica ${i} of service ${displayIdent(service.serviceName)}: ${instance.lastError.message}`);
 		} finally {
 			instance.inFlightBoot = void 0;
 		}
@@ -17258,7 +17432,7 @@ var ServiceController = class {
 	async doShutdown() {
 		this.runState.shuttingDown = true;
 		const logger = getLogger().child("ecs-service");
-		logger.info(`Shutting down service '${this.service.serviceName}'...`);
+		logger.info(`Shutting down service ${displayIdent(this.service.serviceName)}...`);
 		for (const r of this.runState.replicas) r.shuttingDown = true;
 		const inFlightBoots = this.runState.replicas.map((r) => r.inFlightBoot).filter((p) => p !== void 0);
 		if (inFlightBoots.length > 0) {
@@ -17334,10 +17508,10 @@ async function bootReplica(service, options, instance, bootOpts = {}) {
 		...containerNameAliasOmitted.size > 0 ? { containerNameAliasOmitted } : {},
 		...ephemeralPublishContainerPorts.length > 0 ? { ephemeralPublishContainerPorts } : {}
 	};
-	logger.info(`Booting replica ${instance.index} (${perReplicaCluster})`);
+	logger.info(`Booting replica ${instance.index} (${displayIdent(perReplicaCluster)})`);
 	await runEcsTask(service.task, perReplicaTaskOptions, instance.state);
 	if (options.streamLogs !== false) for (const started of instance.state.startedContainers) {
-		const prefix = `[svc=${service.serviceDisplayName} r=${instance.index} c=${started.name}] `;
+		const prefix = `[svc=${displayStackName(service.serviceDisplayName)} r=${instance.index} c=${displayIdent(started.name)}] `;
 		instance.state.logStoppers.push(attachContainerLogStreamer(prefix, started.id, { expectRestart: () => instance.softReloadInProgress === true }));
 	}
 	if (options.discovery && !bootOpts.deferPublish) await publishReplicaToCloudMap(service, instance, options.discovery, ownerKeyPrefix);
@@ -17362,13 +17536,13 @@ async function publishGatedReplica(service, options, instance, deadline, isShutt
 			const port = container.portMappings[0]?.containerPort;
 			if (port !== void 0) {
 				if (await waitForContainerListening(started.id, port, deadline) === "exited") {
-					getLogger().child("ecs-service").debug(`${label}: '${name}' exited before listening; leaving its aliases withheld.`);
+					getLogger().child("ecs-service").debug(`${label}: ${displayIdent(name)} exited before listening; leaving its aliases withheld.`);
 					continue;
 				}
 			}
 			if (isShuttingDown()) return;
 			const ip = await getContainerNetworkIp(started.id, network.networkName);
-			if (!ip) throw new EcsServiceRunnerError(`${label}: no docker IP for '${name}' on ${network.networkName}; cannot attach its Service Connect aliases.`);
+			if (!ip) throw new EcsServiceRunnerError(`${label}: no docker IP for ${displayIdent(name)} on ${network.networkName}; cannot attach its Service Connect aliases.`);
 			const aliases = [name];
 			for (const a of fullAliases.get(name) ?? []) if (!aliases.includes(a)) aliases.push(a);
 			await dockerNetworkDisconnectImpl(network.networkName, started.id);
@@ -17417,7 +17591,7 @@ async function publishReplicaToCloudMap(service, instance, discovery, ownerKeyPr
 	if (service.serviceConnect) {
 		const ns = service.serviceConnect.namespaceName;
 		const index = discovery.cloudMapIndexByStack.get(service.stack.stackName);
-		if (index && !index.namespacesByName.has(ns)) logger.warn(`ECS Service '${service.serviceLogicalId}' ServiceConnectConfiguration.Namespace='${ns}' does not match any AWS::ServiceDiscovery::PrivateDnsNamespace declared in stack ${service.stack.stackName}. Publishing under the literal name anyway; peer services using the same literal will still discover this endpoint.`);
+		if (index && !index.namespacesByName.has(ns)) logger.warn(`ECS Service ${displayIdent(service.serviceLogicalId)} ServiceConnectConfiguration.Namespace=${displayIdent(ns)} does not match any AWS::ServiceDiscovery::PrivateDnsNamespace declared in stack ${displayStackName(service.stack.stackName)}. Publishing under the literal name anyway; peer services using the same literal will still discover this endpoint.`);
 		let i = 0;
 		for (const entry of service.serviceConnect.services) {
 			const ownerKey = `${ownerKeyPrefix}:sc:${i}`;
@@ -17434,20 +17608,20 @@ async function publishReplicaToCloudMap(service, instance, discovery, ownerKeyPr
 	if (service.serviceRegistries.length > 0) {
 		const index = discovery.cloudMapIndexByStack.get(service.stack.stackName);
 		if (!index) {
-			logger.warn(`ECS Service '${service.serviceLogicalId}' declares ServiceRegistries[] but ${getEmbedConfig().productName} has no Cloud Map index for stack ${service.stack.stackName}. Skipping registration.`);
+			logger.warn(`ECS Service ${displayIdent(service.serviceLogicalId)} declares ServiceRegistries[] but ${getEmbedConfig().productName} has no Cloud Map index for stack ${displayStackName(service.stack.stackName)}. Skipping registration.`);
 			return;
 		}
 		let j = 0;
 		for (const reg of service.serviceRegistries) {
 			const cm = index.servicesByLogicalId.get(reg.cloudMapServiceLogicalId);
 			if (!cm) {
-				logger.warn(`ECS Service '${service.serviceLogicalId}' ServiceRegistries[].cloudMapServiceLogicalId='${reg.cloudMapServiceLogicalId}' did not resolve to an AWS::ServiceDiscovery::Service in stack ${service.stack.stackName}. Skipping this registration.`);
+				logger.warn(`ECS Service ${displayIdent(service.serviceLogicalId)} ServiceRegistries[].cloudMapServiceLogicalId=${displayIdent(reg.cloudMapServiceLogicalId)} did not resolve to an AWS::ServiceDiscovery::Service in stack ${displayStackName(service.stack.stackName)}. Skipping this registration.`);
 				continue;
 			}
 			let port = reg.containerPort;
 			if (port === void 0 && essential.portMappings.length > 0) port = essential.portMappings[0].containerPort;
 			if (port === void 0) {
-				logger.warn(`ECS Service '${service.serviceLogicalId}' ServiceRegistries[] entry for Cloud Map service '${cm.logicalId}' has no resolvable container port; skipping.`);
+				logger.warn(`ECS Service ${displayIdent(service.serviceLogicalId)} ServiceRegistries[] entry for Cloud Map service ${displayIdent(cm.logicalId)} has no resolvable container port; skipping.`);
 				continue;
 			}
 			const ownerKey = `${ownerKeyPrefix}:sr:${j}`;
@@ -17467,7 +17641,7 @@ async function publishReplicaToFrontDoor(service, instance, frontDoor, container
 	for (const target of frontDoor.pools) {
 		const started = instance.state.startedContainers.find((c) => c.name === target.targetContainerName);
 		if (!started) {
-			logger.warn(`ECS Service '${service.serviceLogicalId}' front-door: container '${target.targetContainerName}' did not start for replica ${instance.index}; the front-door cannot route to it.`);
+			logger.warn(`ECS Service ${displayIdent(service.serviceLogicalId)} front-door: container ${displayIdent(target.targetContainerName)} did not start for replica ${instance.index}; the front-door cannot route to it.`);
 			continue;
 		}
 		let hostPort;
@@ -17478,7 +17652,7 @@ async function publishReplicaToFrontDoor(service, instance, frontDoor, container
 			continue;
 		}
 		if (hostPort === void 0) {
-			logger.warn(`Replica ${instance.index}: container port ${target.targetContainerPort} on '${target.targetContainerName}' was not published on a host port; skipping front-door registration for this replica.`);
+			logger.warn(`Replica ${instance.index}: container port ${target.targetContainerPort} on ${displayIdent(target.targetContainerName)} was not published on a host port; skipping front-door registration for this replica.`);
 			continue;
 		}
 		target.pool.register(ownerKeyPrefix, {
@@ -17602,13 +17776,13 @@ async function softReloadReplica(args) {
 	}
 	const essentialContainers = newService.task.containers.filter((c) => c.essential);
 	const containersToCycle = essentialContainers.length > 0 ? essentialContainers : newService.task.containers.length > 0 ? [newService.task.containers[0]] : [];
-	if (containersToCycle.length === 0) throw new EcsServiceRunnerError(`softReloadReplica: service '${newService.serviceLogicalId}' has no containers to cycle.`);
+	if (containersToCycle.length === 0) throw new EcsServiceRunnerError(`softReloadReplica: service ${displayIdent(newService.serviceLogicalId)} has no containers to cycle.`);
 	const startedById = new Map(instance.state.startedContainers.map((c) => [c.name, c.id]));
 	const networkAliasesByContainer = buildNetworkAliasesByContainer(newService);
 	const targets = [];
 	for (const container of containersToCycle) {
 		const id = startedById.get(container.name);
-		if (!id) throw new EcsServiceRunnerError(`softReloadReplica: replica r${instance.index} has no started container named '${container.name}' (started: ${[...startedById.keys()].join(", ") || "none"}).`);
+		if (!id) throw new EcsServiceRunnerError(`softReloadReplica: replica r${instance.index} has no started container named ${displayIdent(container.name)} (started: ${[...startedById.keys()].map((k) => displayIdent(k, { listMember: true })).join(", ") || "none"}).`);
 		const aliases = [container.name];
 		for (const a of networkAliasesByContainer.get(container.name) ?? []) if (!aliases.includes(a)) aliases.push(a);
 		const port = container.portMappings[0]?.containerPort;
@@ -17637,13 +17811,13 @@ async function softReloadReplica(args) {
 			try {
 				workdir = await dockerInspectWorkdirImpl(target.id) || "/";
 			} catch (err) {
-				throw new EcsServiceRunnerError(`softReloadReplica: docker inspect of container '${target.name}' (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
+				throw new EcsServiceRunnerError(`softReloadReplica: docker inspect of container ${displayIdent(target.name)} (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
 			}
 			const workdirDest = workdir.endsWith("/") ? workdir : `${workdir}/`;
 			try {
 				await dockerCpImpl(`${sourceDirToCopy}/.`, `${target.id}:${workdirDest}`);
 			} catch (err) {
-				throw new EcsServiceRunnerError(`softReloadReplica: docker cp into '${target.name}' (${target.id}:${workdir}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
+				throw new EcsServiceRunnerError(`softReloadReplica: docker cp into ${displayIdent(target.name)} (${target.id}:${workdir}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
 			}
 		}
 		const sharedNetworkName = instance.state.network?.ownedByCaller ? instance.state.network.networkName : void 0;
@@ -17666,7 +17840,7 @@ async function softReloadReplica(args) {
 			}
 			await dockerStartImpl(target.id);
 		} catch (err) {
-			throw new EcsServiceRunnerError(`softReloadReplica: docker stop / start of '${target.name}' (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
+			throw new EcsServiceRunnerError(`softReloadReplica: docker stop / start of ${displayIdent(target.name)} (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
 		}
 		const aliasDeadline = Date.now() + shadowReadyTimeoutMs;
 		const ready = await waitForReplicaTcpReady(newService, instance, {
@@ -17683,7 +17857,7 @@ async function softReloadReplica(args) {
 				plan.attached = false;
 				await attachToSharedNetwork(target.id, plan, true);
 			} catch (err) {
-				throw new EcsServiceRunnerError(`softReloadReplica: restoring the network aliases of '${target.name}' (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
+				throw new EcsServiceRunnerError(`softReloadReplica: restoring the network aliases of ${displayIdent(target.name)} (${target.id}) failed: ${err instanceof Error ? err.message : String(err)}. This replica is unregistered from Cloud Map + the front-door pool until the next save triggers another reload.`);
 			}
 		}
 		const ownerKeyPrefix = replicaOwnerKeyPrefix(newService, instance);
@@ -17718,7 +17892,7 @@ async function softReloadReplica(args) {
 const defaultDockerInspectWorkdirImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -17731,7 +17905,7 @@ let dockerInspectWorkdirImpl = defaultDockerInspectWorkdirImpl;
 const defaultDockerCpImpl = async (src, dst) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"cp",
 		src,
@@ -17742,13 +17916,13 @@ let dockerCpImpl = defaultDockerCpImpl;
 const defaultDockerStopImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["stop", containerId]);
 };
 const defaultDockerStartImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), ["start", containerId]);
 };
 let dockerStopImpl = defaultDockerStopImpl;
@@ -17762,7 +17936,7 @@ async function detachFromSharedNetwork(target, networkName) {
 		ip = void 0;
 	}
 	if (!ip) {
-		logger.debug(`Soft-reload: no IP for '${target.name}' (${target.id}) on ${networkName}; restarting it in place without detaching its network aliases first.`);
+		logger.debug(`Soft-reload: no IP for ${displayIdent(target.name)} (${target.id}) on ${networkName}; restarting it in place without detaching its network aliases first.`);
 		return;
 	}
 	let publishesHostPorts;
@@ -17774,7 +17948,7 @@ async function detachFromSharedNetwork(target, networkName) {
 	try {
 		await dockerNetworkDisconnectImpl(networkName, target.id);
 	} catch (err) {
-		logger.debug(`Soft-reload: detaching '${target.name}' (${target.id}) from ${networkName} failed: ${err instanceof Error ? err.message : String(err)}. Restarting it in place.`);
+		logger.debug(`Soft-reload: detaching ${displayIdent(target.name)} (${target.id}) from ${networkName} failed: ${err instanceof Error ? err.message : String(err)}. Restarting it in place.`);
 		return;
 	}
 	return {
@@ -17809,7 +17983,7 @@ async function attachToSharedNetwork(containerId, plan, withAliases) {
 const defaultDockerNetworkConnectImpl = async (networkName, containerId, opts) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	const args = ["network", "connect"];
 	if (opts.ip) args.push("--ip", opts.ip);
 	for (const a of opts.aliases) args.push("--alias", a);
@@ -17820,7 +17994,7 @@ let dockerNetworkConnectImpl = defaultDockerNetworkConnectImpl;
 const defaultDockerInspectPublishesHostPortsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), [
 		"inspect",
 		"--format",
@@ -17859,7 +18033,7 @@ async function disconnectOldFromSharedNetwork(oldInstance, opts = {}) {
 const defaultDockerNetworkDisconnectImpl = async (networkName, containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	await promisify(execFile)(getDockerCmd(), [
 		"network",
 		"disconnect",
@@ -17950,7 +18124,7 @@ const LISTEN_PROBE_SCRIPT = [
 async function dockerExecListenProbe(containerId, port, timeoutMs = 1e4) {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	try {
 		await promisify(execFile)(getDockerCmd(), [
 			"exec",
@@ -18104,7 +18278,7 @@ function pickEssentialContainerId(instance, service) {
 const defaultWaitForExitImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	const { stdout } = await promisify(execFile)(getDockerCmd(), ["wait", containerId], { maxBuffer: 1024 * 1024 });
 	const code = parseInt(stdout.trim(), 10);
 	return Number.isFinite(code) ? code : -1;
@@ -18114,7 +18288,7 @@ const EXIT_LOG_TAIL_LINES = 50;
 const defaultReadContainerLogsImpl = async (containerId) => {
 	const { execFile } = await import("node:child_process");
 	const { promisify } = await import("node:util");
-	const { getDockerCmd } = await import("./docker-cmd-BSdu45mc.js").then((n) => n.t);
+	const { getDockerCmd } = await import("./docker-cmd-CoZdbeos.js").then((n) => n.t);
 	const { stdout, stderr } = await promisify(execFile)(getDockerCmd(), [
 		"logs",
 		"--tail",
@@ -18173,7 +18347,7 @@ var CloudMapRegistry = class {
 		const existing = this.aliasIndex.get(alias);
 		if (existing !== void 0) {
 			if (existing === targetFqdn) return;
-			getLogger().child("cloud-map-registry").warn(`ClientAlias DnsName collision: '${alias}' was already mapped to '${existing}'; keeping first-wins binding and ignoring new mapping to '${targetFqdn}'. Likely cause: two Service Connect services declared the same ClientAlias.DnsName.`);
+			getLogger().child("cloud-map-registry").warn(`ClientAlias DnsName collision: ${displayIdent(alias)} was already mapped to ${displayIdent(existing)}; keeping first-wins binding and ignoring new mapping to ${displayIdent(targetFqdn)}. Likely cause: two Service Connect services declared the same ClientAlias.DnsName.`);
 			return;
 		}
 		this.aliasIndex.set(alias, targetFqdn);
@@ -18269,18 +18443,18 @@ function buildCloudMapIndex(stack) {
 	const warnings = [];
 	const resources = stack.template.Resources ?? {};
 	for (const [logicalId, resource] of Object.entries(resources)) {
-		if (resource.Type === "AWS::ServiceDiscovery::PublicDnsNamespace") throw new EcsTaskResolutionError(`Stack ${stack.stackName}: AWS::ServiceDiscovery::PublicDnsNamespace '${logicalId}' is not supported by local emulation — public DNS defeats the "local" point. Use a PrivateDnsNamespace for ${getEmbedConfig().cliName} start-service.`);
-		if (resource.Type === "AWS::ServiceDiscovery::HttpNamespace") throw new EcsTaskResolutionError(`Stack ${stack.stackName}: AWS::ServiceDiscovery::HttpNamespace '${logicalId}' is not supported by local emulation — HttpNamespace uses the AWS Cloud Map DiscoverInstances API directly (no DNS), which would require shimming the AWS SDK inside every container. Use a PrivateDnsNamespace + DnsConfig instead.`);
+		if (resource.Type === "AWS::ServiceDiscovery::PublicDnsNamespace") throw new EcsTaskResolutionError(`Stack ${displayStackName(stack.stackName)}: AWS::ServiceDiscovery::PublicDnsNamespace ${displayIdent(logicalId)} is not supported by local emulation — public DNS defeats the "local" point. Use a PrivateDnsNamespace for ${getEmbedConfig().cliName} start-service.`);
+		if (resource.Type === "AWS::ServiceDiscovery::HttpNamespace") throw new EcsTaskResolutionError(`Stack ${displayStackName(stack.stackName)}: AWS::ServiceDiscovery::HttpNamespace ${displayIdent(logicalId)} is not supported by local emulation — HttpNamespace uses the AWS Cloud Map DiscoverInstances API directly (no DNS), which would require shimming the AWS SDK inside every container. Use a PrivateDnsNamespace + DnsConfig instead.`);
 		if (resource.Type !== "AWS::ServiceDiscovery::PrivateDnsNamespace") continue;
 		const props = resource.Properties ?? {};
 		const name = typeof props["Name"] === "string" ? props["Name"] : void 0;
-		if (!name) throw new EcsTaskResolutionError(`Stack ${stack.stackName}: PrivateDnsNamespace '${logicalId}' has no literal Name property. Intrinsic-valued names are not supported (cross-stack / dynamic namespace names require deploy-state resolution which is out of scope for v1).`);
+		if (!name) throw new EcsTaskResolutionError(`Stack ${displayStackName(stack.stackName)}: PrivateDnsNamespace ${displayIdent(logicalId)} has no literal Name property. Intrinsic-valued names are not supported (cross-stack / dynamic namespace names require deploy-state resolution which is out of scope for v1).`);
 		const entry = {
 			logicalId,
 			name
 		};
 		namespacesByLogicalId.set(logicalId, entry);
-		if (namespacesByName.has(name)) warnings.push(`Stack ${stack.stackName}: two PrivateDnsNamespace resources share Name='${name}' ('${namespacesByName.get(name).logicalId}' and '${logicalId}'). Local emulation routes registrations to the first; the second will silently shadow.`);
+		if (namespacesByName.has(name)) warnings.push(`Stack ${displayStackName(stack.stackName)}: two PrivateDnsNamespace resources share Name=${displayIdent(name)} (${displayIdent(namespacesByName.get(name).logicalId)} and ${displayIdent(logicalId)}). Local emulation routes registrations to the first; the second will silently shadow.`);
 		else namespacesByName.set(name, entry);
 	}
 	for (const [logicalId, resource] of Object.entries(resources)) {
@@ -18288,9 +18462,9 @@ function buildCloudMapIndex(stack) {
 		const props = resource.Properties ?? {};
 		const namespaceLogicalId = resolveNamespaceIdRef(props["NamespaceId"] ?? props["DnsConfig"]?.["NamespaceId"], stack.stackName, logicalId);
 		const ns = namespacesByLogicalId.get(namespaceLogicalId);
-		if (!ns) throw new EcsTaskResolutionError(`Stack ${stack.stackName}: AWS::ServiceDiscovery::Service '${logicalId}' references NamespaceId '${namespaceLogicalId}' but no PrivateDnsNamespace with that logical id exists in this stack. Cross-stack Cloud Map namespaces are not supported in v1.`);
+		if (!ns) throw new EcsTaskResolutionError(`Stack ${displayStackName(stack.stackName)}: AWS::ServiceDiscovery::Service ${displayIdent(logicalId)} references NamespaceId ${displayIdent(namespaceLogicalId)} but no PrivateDnsNamespace with that logical id exists in this stack. Cross-stack Cloud Map namespaces are not supported in v1.`);
 		const name = typeof props["Name"] === "string" ? props["Name"] : void 0;
-		if (!name) throw new EcsTaskResolutionError(`Stack ${stack.stackName}: AWS::ServiceDiscovery::Service '${logicalId}' has no literal Name property. Intrinsic-valued names are not supported in v1.`);
+		if (!name) throw new EcsTaskResolutionError(`Stack ${displayStackName(stack.stackName)}: AWS::ServiceDiscovery::Service ${displayIdent(logicalId)} has no literal Name property. Intrinsic-valued names are not supported in v1.`);
 		const dnsRecords = extractDnsRecords(props);
 		servicesByLogicalId.set(logicalId, {
 			logicalId,
@@ -18315,7 +18489,7 @@ function resolveNamespaceIdRef(raw, stackName, serviceLogicalId) {
 		const getAtt = obj["Fn::GetAtt"];
 		if (Array.isArray(getAtt) && typeof getAtt[0] === "string") return getAtt[0];
 	}
-	throw new EcsTaskResolutionError(`Stack ${stackName}: AWS::ServiceDiscovery::Service '${serviceLogicalId}' has an unsupported NamespaceId reference shape: ${JSON.stringify(raw)}. Accepted shapes are {Fn::GetAtt: [<NsLogicalId>, 'Id']} or {Ref: <NsLogicalId>} pointing at a same-stack PrivateDnsNamespace.`);
+	throw new EcsTaskResolutionError(`Stack ${displayStackName(stackName)}: AWS::ServiceDiscovery::Service ${displayIdent(serviceLogicalId)} has an unsupported NamespaceId reference shape: ${JSON.stringify(raw)}. Accepted shapes are {Fn::GetAtt: [<NsLogicalId>, 'Id']} or {Ref: <NsLogicalId>} pointing at a same-stack PrivateDnsNamespace.`);
 }
 function extractDnsRecords(serviceProps) {
 	const dnsConfig = serviceProps["DnsConfig"];
@@ -18857,8 +19031,8 @@ function handleLambdaRequest(req, res, lambda, opts) {
 					res.end(translated.body);
 					done();
 				} catch (err) {
-					logger.debug(`Lambda target '${lambda.label}' request failed: ${err instanceof Error ? err.message : String(err)}`);
-					if (!res.headersSent) writeError(res, 502, `Lambda target '${lambda.label}' behind ${opts.label} failed.`);
+					logger.debug(`Lambda target ${displayIdent(lambda.label)} request failed: ${err instanceof Error ? err.message : String(err)}`);
+					if (!res.headersSent) writeError(res, 502, `Lambda target ${displayIdent(lambda.label)} behind ${opts.label} failed.`);
 					else if (!res.writableEnded) res.destroy();
 					done();
 				}
@@ -18933,7 +19107,7 @@ function handleUpgrade(req, clientSocket, head, opts) {
 			return Promise.resolve();
 		}
 		if ("lambda" in picked) {
-			writeRawHttpError(clientSocket, 502, `WebSocket upgrade is not supported for Lambda target groups (${picked.lambda.label}).`);
+			writeRawHttpError(clientSocket, 502, `WebSocket upgrade is not supported for Lambda target groups (${displayIdent(picked.lambda.label)}).`);
 			return Promise.resolve();
 		}
 		return bridgeWebSocket(req, clientSocket, head, picked.pool, opts);
@@ -19462,7 +19636,7 @@ function forwardAwsEnv() {
 }
 function materializeInlineCode(handler, source, fileExtension) {
 	const lastDot = handler.lastIndexOf(".");
-	if (lastDot <= 0) throw new Error(`Handler '${handler}' is malformed: expected '<modulePath>.<exportName>'.`);
+	if (lastDot <= 0) throw new Error(`Handler ${displayIdent(handler)} is malformed: expected '<modulePath>.<exportName>'.`);
 	const modulePath = handler.substring(0, lastDot);
 	const dir = mkdtempSync(path$1.join(tmpdir(), `${getEmbedConfig().resourceNamePrefix}-alb-lambda-`));
 	const filePath = path$1.join(dir, `${modulePath}${fileExtension}`);
@@ -19507,7 +19681,7 @@ async function resolveContainerImagePlan(lambda, opts) {
 	let localBuilt = false;
 	if (manifestPath) {
 		const cdkOutDir = path$1.dirname(manifestPath);
-		const manifest = await new AssetManifestLoader().loadManifest(cdkOutDir, lambda.stack.stackName);
+		const manifest = await new AssetManifestLoader().loadStackManifest(lambda.stack, cdkOutDir);
 		const entry = manifest ? getDockerImageBySourceHash(manifest, lambda.imageUri) : void 0;
 		if (entry) {
 			imageRef = await buildContainerImage(entry.asset, cdkOutDir, {
@@ -19518,8 +19692,8 @@ async function resolveContainerImagePlan(lambda, opts) {
 		}
 	}
 	if (!localBuilt) {
-		if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda '${lambda.logicalId}' has no matching asset in cdk.out, and Code.ImageUri '${lambda.imageUri}' is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app or deploy the image to ECR first.`);
-		logger.info(`No matching cdk.out asset for ${lambda.imageUri}; falling back to ECR pull...`);
+		if (!parseEcrUri(lambda.imageUri)) throw new Error(`Container Lambda ${displayIdent(lambda.logicalId)} has no matching asset in cdk.out, and Code.ImageUri ${displayUntrustedValue(lambda.imageUri)} is not an ECR URI ${getEmbedConfig().binaryName} can authenticate against. Re-synthesize the CDK app or deploy the image to ECR first.`);
+		logger.info(`No matching cdk.out asset for ${displayUntrustedValue(lambda.imageUri)}; falling back to ECR pull...`);
 		imageRef = await pullEcrImage(lambda.imageUri, {
 			skipPull: opts.skipPull === true,
 			...opts.region !== void 0 && { region: opts.region },
@@ -19594,7 +19768,7 @@ function createFrontDoorLambdaRunner(lambda, opts) {
 			await starting;
 		},
 		async invoke(event, timeoutMs) {
-			if (!containerId || hostPort === void 0) throw new Error(`FrontDoorLambdaRunner('${lambda.logicalId}').invoke called before start() completed.`);
+			if (!containerId || hostPort === void 0) throw new Error(`FrontDoorLambdaRunner(${displayIdent(lambda.logicalId)}).invoke called before start() completed.`);
 			return (await invokeRie(opts.containerHost, hostPort, event, timeoutMs ?? defaultTimeoutMs)).payload;
 		},
 		async stop() {
@@ -19603,7 +19777,7 @@ function createFrontDoorLambdaRunner(lambda, opts) {
 			try {
 				stopLogStream?.();
 			} catch (err) {
-				logger.debug(`stopLogStream(${lambda.logicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
+				logger.debug(`stopLogStream(${displayIdent(lambda.logicalId)}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			}
 			if (containerId) {
 				try {
@@ -19879,9 +20053,9 @@ function canonicalizeImageOverrideKeys(rawFlags, pinnedAliases, knownTargets = [
 		if (exact.has(key)) return key;
 		const matches = targetsByAlias.get(key);
 		if (!matches) return key;
-		if (matches.size > 1) throw new ImageOverrideError(`${flag} key '${key}' matches more than one pinned target (${[...matches].join(", ")}). Name the target in full instead.`);
+		if (matches.size > 1) throw new ImageOverrideError(`${flag} key '${key}' matches more than one pinned target (${[...matches].map((m) => displayIdent(m, { listMember: true })).join(", ")}). Name the target in full instead.`);
 		const target = [...matches][0];
-		logger.debug(`${flag} key '${key}' resolved to pinned target '${target}'.`);
+		logger.debug(`${flag} key '${key}' resolved to pinned target ${displayStackName(target)}.`);
 		return target;
 	};
 	const explicit = /* @__PURE__ */ new Map();
@@ -19889,7 +20063,7 @@ function canonicalizeImageOverrideKeys(rawFlags, pinnedAliases, knownTargets = [
 	for (const [key, dockerfile] of rawFlags.explicit) {
 		const target = canonical(key, "--image-override");
 		const earlier = explicitKeyByTarget.get(target);
-		if (earlier !== void 0) throw new ImageOverrideError(`--image-override keys '${earlier}' and '${key}' both name the pinned target '${target}'. Name each service target at most once.`);
+		if (earlier !== void 0) throw new ImageOverrideError(`--image-override keys '${earlier}' and '${key}' both name the pinned target ${displayStackName(target)}. Name each service target at most once.`);
 		explicitKeyByTarget.set(target, key);
 		explicit.set(target, dockerfile);
 	}
@@ -19906,7 +20080,7 @@ function canonicalizeImageOverrideKeys(rawFlags, pinnedAliases, knownTargets = [
 			continue;
 		}
 		const conflict = (what) => {
-			throw new ImageOverrideError(`Per-service image-override flags give ${what} two different values for the pinned target '${target}' (one of them keyed '${key}'). Pass it once.`);
+			throw new ImageOverrideError(`Per-service image-override flags give ${what} two different values for the pinned target ${displayStackName(target)} (one of them keyed '${key}'). Pass it once.`);
 		};
 		for (const [k, v] of overlay.buildArgs) {
 			if (into.buildArgs.has(k) && into.buildArgs.get(k) !== v) conflict(`build arg '${k}'`);
@@ -19951,7 +20125,7 @@ async function resolveImageOverrides(args) {
 		const options = uncovered.map((t) => ({
 			value: t,
 			label: t,
-			...labels.get(t) ? { hint: labels.get(t) } : {}
+			...labels.get(t) ? { hint: displayUntrustedValue(labels.get(t)) } : {}
 		}));
 		const picked = await multiselect({
 			message: `Pick the pinned target(s) to bind to '${dockerfileRaw}' (space to toggle, enter to confirm; empty cancels):`,
@@ -19977,7 +20151,7 @@ async function resolveImageOverrides(args) {
 			}
 			const label = labels.get(target);
 			const value = await promptForOverridePath({
-				headline: `Detected pinned image on '${target}'` + (label ? ` (${label})` : "") + ".",
+				headline: `Detected pinned image on ${displayStackName(target)}` + (label ? ` (${displayUntrustedValue(String(label))})` : "") + ".",
 				discoveredDockerfiles
 			});
 			if (!value) continue;
@@ -20159,16 +20333,16 @@ async function runImageOverrideBuilds(overrides) {
 		for (const [id, src] of entry.buildSecrets.entries()) args.push("--secret", `id=${id},src=${src}`);
 		if (entry.targetStage !== void 0) args.push("--target", entry.targetStage);
 		args.push(".");
-		logger.info(`Building override image for '${target}' from '${entry.dockerfile}' (tag=${tag})...`);
+		logger.info(`Building override image for ${displayStackName(target)} from '${entry.dockerfile}' (tag=${tag})...`);
 		try {
 			await runDockerStreaming(args, {
 				cwd: entry.contextDir,
 				env: { BUILDX_NO_DEFAULT_ATTESTATIONS: "1" },
-				progressLabel: `Building override image for '${target}'`
+				progressLabel: `Building override image for ${displayStackName(target)}`
 			});
 		} catch (err) {
 			const e = err;
-			const wrapped = new ImageOverrideError(`docker build failed for --image-override '${target}' (Dockerfile=${entry.dockerfile}): ` + (e.stderr?.trim() || e.message || String(err)));
+			const wrapped = new ImageOverrideError(`docker build failed for --image-override ${displayStackName(target)} (Dockerfile=${entry.dockerfile}): ` + displayToolOutput(e.stderr?.trim() || e.message || String(err)));
 			for (const priorTag of builtTags) try {
 				await runDockerStreaming([
 					"image",
@@ -20354,8 +20528,8 @@ async function runEcsServiceEmulator(targets, options, strategy, extraStateProvi
 		})));
 		for (const entry of pinnedEntries) {
 			if (imageOverrideTags.has(entry.target)) continue;
-			const uriDisplay = entry.label ? `\`${entry.label}\`` : "a deployed registry";
-			logger.warn(`'${entry.target}': running image is pinned to a deployed registry (${uriDisplay}). To iterate on local source, either pass \`--image-override <dockerfile>\` (or \`<service>=<dockerfile>\`) to substitute a local build, or drop \`--from-cfn-stack\` and switch the CDK app to \`ContainerImage.fromAsset(...)\`.`);
+			const uriDisplay = entry.label ? displayUntrustedValue(entry.label) : "a deployed registry";
+			logger.warn(`${displayStackName(entry.target)}: running image is pinned to a deployed registry (${uriDisplay}). To iterate on local source, either pass \`--image-override <dockerfile>\` (or \`<service>=<dockerfile>\`) to substitute a local build, or drop \`--from-cfn-stack\` and switch the CDK app to \`ContainerImage.fromAsset(...)\`.`);
 			uncoveredPinnedTargets.push(entry.target);
 		}
 		enforceStrictOverrides(options.strictOverrides === true, uncoveredPinnedTargets);
@@ -20421,7 +20595,7 @@ async function reloadAllServices(args) {
 		const newTag = (await runImageOverrideBuilds(/* @__PURE__ */ new Map([[target, entry]]))).get(target);
 		if (newTag !== void 0) imageOverrideTags.set(target, newTag);
 	} catch (err) {
-		logger.warn(`Reload of '${target}': --image-override rebuild failed; keeping the previous local image. (${err instanceof Error ? err.message : String(err)})`);
+		logger.warn(`Reload of ${displayStackName(target)}: --image-override rebuild failed; keeping the previous local image. (${err instanceof Error ? err.message : String(err)})`);
 	}
 	const { boots: newBoots, warnings } = strategy.resolveBoots(stacks, resolvedTargets);
 	for (const w of warnings) logger.warn(w);
@@ -20437,12 +20611,12 @@ async function reloadAllServices(args) {
 	for (const pt of perTarget) {
 		const newBoot = newBootByTarget.get(pt.boot.target);
 		if (!newBoot) {
-			logger.warn(`Reload: target '${pt.boot.target}' no longer resolves to a service in the synthesized app; keeping the previous replica(s) serving.`);
+			logger.warn(`Reload: target ${displayStackName(pt.boot.target)} no longer resolves to a service in the synthesized app; keeping the previous replica(s) serving.`);
 			continue;
 		}
 		const controller = pt.controller;
 		if (!controller) {
-			logger.warn(`Reload: target '${pt.boot.target}' has no live controller (previous boot likely failed); skipping roll. \`^C\` and re-run start-service to recover.`);
+			logger.warn(`Reload: target ${displayStackName(pt.boot.target)} has no live controller (previous boot likely failed); skipping roll. \`^C\` and re-run start-service to recover.`);
 			continue;
 		}
 		let verdict = {
@@ -20458,16 +20632,16 @@ async function reloadAllServices(args) {
 				assetLoader,
 				logger
 			}));
-			logger.info(`Reload of '${newBoot.target}': verdict=${verdict.kind} (${verdict.reason}).`);
+			logger.info(`Reload of ${displayStackName(newBoot.target)}: verdict=${verdict.kind} (${verdict.reason}).`);
 		} catch (err) {
-			logger.warn(`Reload of '${newBoot.target}': classifier context unavailable (${err instanceof Error ? err.message : String(err)}); falling back to rebuild.`);
+			logger.warn(`Reload of ${displayStackName(newBoot.target)}: classifier context unavailable (${err instanceof Error ? err.message : String(err)}); falling back to rebuild.`);
 			verdict = {
 				kind: "rebuild",
 				reason: "classifier context unavailable; falling back to rebuild"
 			};
 		}
 		if (verdict.kind === "rebuild" && verdict.reason === "target image is not a CDK docker-image asset" && !isLocalCdkAssetImage(controller.service) && !imageOverrideTags.has(newBoot.target)) {
-			logger.info(`Reload skipped for '${newBoot.target}' (no-op): image pinned to deployed registry; no local rebuild possible.`);
+			logger.info(`Reload skipped for ${displayStackName(newBoot.target)} (no-op): image pinned to deployed registry; no local rebuild possible.`);
 			continue;
 		}
 		await rollOneTarget({
@@ -20491,41 +20665,41 @@ async function reloadAllServices(args) {
 async function loadAssetContextForTarget(args) {
 	const { target, controller, stacks, cdkOutDir, assetLoader, logger } = args;
 	const parsed = parseEcsTarget(target);
-	const candidate = pickCandidateStack$1(parsed.stackPattern, stacks);
+	const candidate = pickCandidateStack$1(target, stacks);
 	if (!candidate) {
-		logger.debug(`loadAssetContext: stack pattern '${parsed.stackPattern}' from target '${target}' not in the assembly. Classifier will see no asset context (rebuild).`);
+		logger.debug(`loadAssetContext: stack pattern '${parsed.stackPattern}' from target ${displayStackName(target)} not in the assembly. Classifier will see no asset context (rebuild).`);
 		return;
 	}
 	let newService;
 	try {
 		newService = resolveEcsServiceTarget(target, stacks, void 0, { suppressLoadBalancerWarning: true });
 	} catch (err) {
-		logger.debug(`loadAssetContext: resolveEcsServiceTarget threw for target '${target}' against the new stacks: ${err instanceof Error ? err.message : String(err)}. Classifier will see no asset context (rebuild).`);
+		logger.debug(`loadAssetContext: resolveEcsServiceTarget threw for target ${displayStackName(target)} against the new stacks: ${err instanceof Error ? err.message : String(err)}. Classifier will see no asset context (rebuild).`);
 		return;
 	}
 	const essential = newService.task.containers.find((c) => c.essential) ?? newService.task.containers[0];
 	if (!essential) {
-		logger.debug(`loadAssetContext: task definition for target '${target}' has no containers. Classifier will see no asset context (rebuild).`);
+		logger.debug(`loadAssetContext: task definition for target ${displayStackName(target)} has no containers. Classifier will see no asset context (rebuild).`);
 		return;
 	}
 	if (essential.image.kind !== "cdk-asset" || !essential.image.assetHash) {
 		const assetHashStr = essential.image.kind === "cdk-asset" ? essential.image.assetHash ?? "undefined" : "n/a";
-		logger.debug(`loadAssetContext: target '${target}' essential image is not a CDK asset (kind='${essential.image.kind}', assetHash=${assetHashStr}). Classifier will see no asset context (rebuild).`);
+		logger.debug(`loadAssetContext: target ${displayStackName(target)} essential image is not a CDK asset (kind='${essential.image.kind}', assetHash=${assetHashStr}). Classifier will see no asset context (rebuild).`);
 		return;
 	}
 	const newAssetHash = essential.image.assetHash;
-	const manifest = await assetLoader.loadManifest(cdkOutDir, candidate.stackName);
+	const manifest = await assetLoader.loadStackManifest(candidate, cdkOutDir);
 	if (!manifest) {
-		logger.debug(`loadAssetContext: asset manifest missing for stack '${candidate.stackName}' under '${cdkOutDir}'. Classifier will see no asset context (rebuild).`);
+		logger.debug(`loadAssetContext: asset manifest missing for stack ${displayStackName(candidate.stackName)} under ${displayUntrustedValue(cdkOutDir)}. Classifier will see no asset context (rebuild).`);
 		return;
 	}
 	const newDockerImage = manifest.dockerImages?.[newAssetHash];
 	if (!newDockerImage) {
-		logger.debug(`loadAssetContext: asset hash '${newAssetHash}' not present in stack '${candidate.stackName}' dockerImages. Classifier will see no asset context (rebuild).`);
+		logger.debug(`loadAssetContext: asset hash ${displayIdent(newAssetHash)} not present in stack ${displayStackName(candidate.stackName)} dockerImages. Classifier will see no asset context (rebuild).`);
 		return;
 	}
 	if (!newDockerImage.source.directory) {
-		logger.debug(`loadAssetContext: docker asset '${newAssetHash}' for stack '${candidate.stackName}' is executable-mode (no source.directory). Classifier will see no asset context (rebuild).`);
+		logger.debug(`loadAssetContext: docker asset ${displayIdent(newAssetHash)} for stack ${displayStackName(candidate.stackName)} is executable-mode (no source.directory). Classifier will see no asset context (rebuild).`);
 		return;
 	}
 	const newAssetSourceDir = resolveAssetSourcePath({
@@ -20555,7 +20729,7 @@ async function loadAssetContextForTarget(args) {
 }
 async function rollOneTarget(args) {
 	const { controller, newBoot, stacks, options, discovery, skipPull, extraStateProviders, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, verdict, imageOverrideTag, logger } = args;
-	const candidate = pickCandidateStack$1(parseEcsTarget(newBoot.target).stackPattern, stacks);
+	const candidate = pickCandidateStack$1(newBoot.target, stacks);
 	const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
 	try {
 		let resolved;
@@ -20566,22 +20740,22 @@ async function rollOneTarget(args) {
 			});
 		} catch (err) {
 			const reason = err instanceof Error ? err.message : String(err);
-			logger.error(`Reload of '${newBoot.target}' was rejected: ${reason}. Existing replica(s) keep serving.`);
+			logger.error(`Reload of ${displayStackName(newBoot.target)} was rejected: ${reason}. Existing replica(s) keep serving.`);
 			return;
 		}
 		const { service: newService, runnerOpts: newRunnerOpts } = resolved;
 		const oldReplicas = controller.runState.replicas.filter((r) => !r.shuttingDown);
 		if (oldReplicas.length === 0) {
-			logger.warn(`Reload of '${newBoot.target}': no live replicas to roll (all shutting down). \`^C\` and re-run start-service to recover.`);
+			logger.warn(`Reload of ${displayStackName(newBoot.target)}: no live replicas to roll (all shutting down). \`^C\` and re-run start-service to recover.`);
 			return;
 		}
-		if (newService.desiredCount !== oldReplicas.length) logger.warn(`Reload of '${newBoot.target}': service DesiredCount=${newService.desiredCount} does not match the ${oldReplicas.length} live replica(s); rolling existing replicas only — scale changes during --watch are not yet supported. \`^C\` and re-run start-service to apply the new replica count.`);
-		if (verdict.kind === "soft-reload") logger.info(`Reload of '${newBoot.target}': soft-reloading ${oldReplicas.length} replica(s) one at a time (docker cp source → restart → TCP-ready probe; no rebuild).`);
-		else logger.info(`Reload of '${newBoot.target}': rolling ${oldReplicas.length} replica(s) one at a time (start new shadow → swap registrations → stop old).`);
+		if (newService.desiredCount !== oldReplicas.length) logger.warn(`Reload of ${displayStackName(newBoot.target)}: service DesiredCount=${newService.desiredCount} does not match the ${oldReplicas.length} live replica(s); rolling existing replicas only — scale changes during --watch are not yet supported. \`^C\` and re-run start-service to apply the new replica count.`);
+		if (verdict.kind === "soft-reload") logger.info(`Reload of ${displayStackName(newBoot.target)}: soft-reloading ${oldReplicas.length} replica(s) one at a time (docker cp source → restart → TCP-ready probe; no rebuild).`);
+		else logger.info(`Reload of ${displayStackName(newBoot.target)}: rolling ${oldReplicas.length} replica(s) one at a time (start new shadow → swap registrations → stop old).`);
 		for (const oldInstance of oldReplicas) {
 			const idx = controller.runState.replicas.indexOf(oldInstance);
 			if (idx === -1) {
-				logger.warn(`Reload of '${newBoot.target}': replica r${oldInstance.index} (gen ${oldInstance.generation}) vanished before its roll; skipping.`);
+				logger.warn(`Reload of ${displayStackName(newBoot.target)}: replica r${oldInstance.index} (gen ${oldInstance.generation}) vanished before its roll; skipping.`);
 				continue;
 			}
 			try {
@@ -20599,7 +20773,7 @@ async function rollOneTarget(args) {
 				});
 			} catch (err) {
 				const reason = err instanceof Error ? err.message : String(err);
-				logger.error(`Reload of '${newBoot.target}' replica r${oldInstance.index}: ${reason}. The old replica keeps serving; remaining replicas will still be rolled.`);
+				logger.error(`Reload of ${displayStackName(newBoot.target)} replica r${oldInstance.index}: ${reason}. The old replica keeps serving; remaining replicas will still be rolled.`);
 			}
 		}
 	} finally {
@@ -20607,7 +20781,7 @@ async function rollOneTarget(args) {
 	}
 }
 async function bootOneTarget(boot, runState, stacks, options, discovery, skipPull, extraStateProviders, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag) {
-	const candidate = pickCandidateStack$1(parseEcsTarget(boot.target).stackPattern, stacks);
+	const candidate = pickCandidateStack$1(boot.target, stacks);
 	const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
 	try {
 		return await runOneTarget(boot, runState, stacks, options, discovery, skipPull, stateProvider, profileCredsFile, frontDoorPools, suppressLoadBalancerWarning, imageOverrideTag);
@@ -20625,8 +20799,8 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 	const quiet = opts.quiet === true;
 	const imageContext = await buildEcsImageResolutionContext$1(target, stacks, options, stateProvider);
 	const service = resolveEcsServiceTarget(target, stacks, imageContext, { suppressLoadBalancerWarning });
-	if (!quiet) logger.info(`Target: ${service.stack.stackName}/${service.serviceLogicalId} (service=${service.serviceName}, desiredCount=${service.desiredCount}, task=${service.task.taskDefinitionLogicalId})`);
-	if (!quiet && service.serviceConnect) logger.info(`Service Connect: namespace='${service.serviceConnect.namespaceName}', ${service.serviceConnect.services.length} service(s) registered for peer discovery.`);
+	if (!quiet) logger.info(`Target: ${displayStackName(`${service.stack.stackName}/${service.serviceLogicalId}`)} (service=${displayIdent(service.serviceName)}, desiredCount=${service.desiredCount}, task=${displayIdent(service.task.taskDefinitionLogicalId)})`);
+	if (!quiet && service.serviceConnect) logger.info(`Service Connect: namespace=${displayIdent(service.serviceConnect.namespaceName)}, ${service.serviceConnect.services.length} service(s) registered for peer discovery.`);
 	if (!quiet && service.serviceRegistries.length > 0) logger.info(`Cloud Map: ${service.serviceRegistries.length} ServiceRegistry binding(s).`);
 	const taskNeeds = detectEcsImageResolutionNeeds(stacks.find((s) => s.stackName === service.stack.stackName) ?? service.stack);
 	if (stateProvider && taskNeeds.needsCrossStackResolver) {
@@ -20658,7 +20832,7 @@ async function resolveServiceAndRunnerOpts(boot, stacks, options, discovery, ski
 	let assumedCredentials;
 	let resolvedRoleArn;
 	if (effectiveAssumeRole === true) {
-		if (!service.task.taskRoleArn) throw new LocalStartServiceError(`--assume-role passed without an ARN but service '${service.serviceLogicalId}' has no resolvable TaskRoleArn. Pass the ARN explicitly: --assume-role <arn>`);
+		if (!service.task.taskRoleArn) throw new LocalStartServiceError(`--assume-role passed without an ARN but service ${displayIdent(service.serviceLogicalId)} has no resolvable TaskRoleArn. Pass the ARN explicitly: --assume-role <arn>`);
 		resolvedRoleArn = await resolveTaskRoleArnForOptions$1(service.task.taskRoleArn, options);
 		assumedCredentials = await assumeTaskRole$1(resolvedRoleArn, options.region, options.profile);
 	} else if (typeof effectiveAssumeRole === "string") {
@@ -20884,14 +21058,14 @@ async function buildFrontDoor(plan, options, logger, extraStateProviders) {
 		}
 		for (const runner of lambdaRegistry.values()) {
 			bootingLambda = flattenToOneLine(runner.logicalId);
-			logger.info(`Booting Lambda target '${bootingLambda}' behind the ALB front-door...`);
+			logger.info(`Booting Lambda target ${displayIdent(bootingLambda)} behind the ALB front-door...`);
 			await runner.start();
 		}
 		bootingLambda = void 0;
 	} catch (err) {
 		await Promise.allSettled(servers.map((s) => s.close()));
 		await Promise.allSettled([...lambdaRegistry.values()].map((r) => r.stop()));
-		if (bootingLambda !== void 0) throw new LocalStartServiceError(`Failed to boot ALB Lambda target '${bootingLambda}': ${err instanceof Error ? err.message : String(err)}`);
+		if (bootingLambda !== void 0) throw new LocalStartServiceError(`Failed to boot ALB Lambda target ${displayIdent(bootingLambda)}: ${err instanceof Error ? err.message : String(err)}`);
 		throw new LocalStartServiceError(`Failed to start ALB front-door: ${err instanceof Error ? err.message : String(err)}. If a listener port is privileged (< 1024), remap it to a non-privileged host port with --lb-port <listenerPort>=<hostPort> (e.g. --lb-port 80=8080).`);
 	}
 	const frontDoorByService = /* @__PURE__ */ new Map();
@@ -20930,11 +21104,14 @@ function describeAction(action) {
 	return `weighted forward [${action.targets.map((t) => `${describeTargetShort(t)}@${t.weight}`).join(", ")}]`;
 }
 function describeTarget(t) {
-	if (t.kind === "lambda") return `Lambda ${t.lambda.logicalId} (invoke)`;
-	return `${t.serviceTarget} (container ${t.targetContainerName}:${t.targetContainerPort}) (round-robin)`;
+	if (t.kind === "lambda") return `Lambda ${displayIdent(t.lambda.logicalId)} (invoke)`;
+	return `${displayStackName(t.serviceTarget)} (container ${displayIdent(t.targetContainerName)}:${t.targetContainerPort}) (round-robin)`;
 }
 function describeTargetShort(t) {
-	return t.kind === "lambda" ? `Lambda ${t.lambda.logicalId}` : t.serviceTarget;
+	return t.kind === "lambda" ? `Lambda ${displayIdent(t.lambda.logicalId, { listMember: true })}` : displayIdent(t.serviceTarget, {
+		listMember: true,
+		maxCodePoints: STACK_REF_MAX_CODE_POINTS
+	});
 }
 function buildRuleSummary(rule) {
 	const conditions = [];
@@ -20975,7 +21152,7 @@ function describeRuleActionForSummary(action) {
 	return `forward weighted [${action.targets.map((t) => `${describeForwardTargetForSummary(t)}@${t.weight}`).join(", ")}]`;
 }
 function describeForwardTargetForSummary(t) {
-	return t.kind === "lambda" ? `<Lambda: ${t.lambda.logicalId}>` : `<ECS: ${t.serviceTarget}>`;
+	return t.kind === "lambda" ? `<Lambda: ${displayIdent(t.lambda.logicalId)}>` : `<ECS: ${displayStackName(t.serviceTarget)}>`;
 }
 async function resolvePlaceholderAccount$1(arn, region, profile, readFromCfnStack) {
 	if (!arn.includes("${AWS::AccountId}")) return arn;
@@ -21010,7 +21187,7 @@ async function assumeTaskRole$1(roleArn, region, profile) {
 }
 async function buildEcsImageResolutionContext$1(target, stacks, options, stateProvider, opts = {}) {
 	const logger = getLogger();
-	const candidate = pickCandidateStack$1(parseEcsTarget(target).stackPattern, stacks);
+	const candidate = pickCandidateStack$1(target, stacks);
 	if (!candidate) return void 0;
 	const needs = detectEcsImageResolutionNeeds(candidate);
 	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution) return;
@@ -21055,13 +21232,8 @@ async function buildEcsImageResolutionContext$1(target, stacks, options, statePr
 	}
 	return ctx;
 }
-function pickCandidateStack$1(stackPattern, stacks) {
-	if (stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		return;
-	}
-	const matched = matchStacks(stacks, [stackPattern]);
-	if (matched.length === 1) return matched[0];
+function pickCandidateStack$1(target, stacks) {
+	return candidateTargetStack(parseEcsTarget(target), target, stacks);
 }
 async function resolveCallerAccountId$1(region, profile, readFromCfnStack) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
@@ -21117,18 +21289,18 @@ function logEndpointsBanner(perTarget, frontDoorServers, logger) {
 }
 function parsePositiveInt(raw, flagName) {
 	const parsed = Number(raw);
-	if (!Number.isInteger(parsed) || parsed < 1) throw new LocalStartServiceError(`${flagName} must be a positive integer (got '${raw}').`);
+	if (!Number.isInteger(parsed) || parsed < 1) throw new InvalidArgumentError(`${flagName} must be a positive integer (got '${raw}').`);
 	return parsed;
 }
 const MAX_TASKS_SUBNET_RANGE_CAP = 83;
 function parseMaxTasks(raw) {
 	const parsed = parsePositiveInt(raw, "--max-tasks");
-	if (parsed > 83) throw new LocalStartServiceError(`--max-tasks ${parsed} exceeds the per-replica link-local /24 subnet allocator's range (${83}). Lower --max-tasks to <= ${83}.`);
+	if (parsed > 83) throw new InvalidArgumentError(`--max-tasks ${parsed} exceeds the per-replica link-local /24 subnet allocator's range (${83}). Lower --max-tasks to <= ${83}.`);
 	return parsed;
 }
 function parseRestartPolicy(raw) {
 	if (raw === "on-failure" || raw === "always" || raw === "none") return raw;
-	throw new LocalStartServiceError(`--restart-policy must be one of 'on-failure', 'always', or 'none' (got '${raw}').`);
+	throw new InvalidArgumentError(`--restart-policy must be one of 'on-failure', 'always', or 'none' (got '${raw}').`);
 }
 function parseShadowReadyTimeout(raw) {
 	return parsePositiveInt(raw, "--shadow-ready-timeout");
@@ -21151,7 +21323,7 @@ async function resolveAndBuildImageOverrides(args) {
 	const { perTarget, stacks, options, extraStateProviders, logger } = args;
 	const resolvedForPeek = [];
 	for (const target of perTarget) {
-		const candidate = pickCandidateStack$1(parseEcsTarget(target).stackPattern, stacks);
+		const candidate = pickCandidateStack$1(target, stacks);
 		const stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
 		let imageContext;
 		let service;
@@ -21159,7 +21331,7 @@ async function resolveAndBuildImageOverrides(args) {
 			imageContext = await buildEcsImageResolutionContext$1(target, stacks, options, stateProvider, { suppressStateWarning: true });
 			service = resolveEcsServiceTarget(target, stacks, imageContext, { suppressLoadBalancerWarning: true });
 		} catch (err) {
-			logger.debug(`--image-override peek failed for '${target}': ${err instanceof Error ? err.message : String(err)}.`);
+			logger.debug(`--image-override peek failed for ${displayStackName(target)}: ${err instanceof Error ? err.message : String(err)}.`);
 			continue;
 		} finally {
 			if (stateProvider) stateProvider.dispose();
@@ -21296,11 +21468,11 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 			noun: "ECS task definitions",
 			onMissing: () => new CdkLocalError(`${getEmbedConfig().cliName} run-task requires a <target> (an ECS task definition display path or logical ID). Run \`${getEmbedConfig().cliName} list\` to see them, or run it in a TTY to pick interactively.`, "LOCAL_RUN_TASK_TARGET_REQUIRED")
 		});
-		const candidate = pickCandidateStack(parseEcsTarget(resolvedTarget).stackPattern, stacks);
+		const candidate = pickCandidateStack(resolvedTarget, stacks);
 		stateProvider = createLocalStateProvider(options, candidate?.stackName ?? "", await resolveCfnFallbackRegion(options, candidate?.region), extraStateProviders);
 		const imageContext = await buildEcsImageResolutionContext(candidate, stateProvider, options);
 		const task = resolveEcsTaskTarget(resolvedTarget, stacks, imageContext);
-		logger.info(`Target: ${task.stack.stackName}/${task.taskDefinitionLogicalId} (family=${task.family}, containers=${task.containers.length})`);
+		logger.info(`Target: ${displayStackName(`${task.stack.stackName}/${task.taskDefinitionLogicalId}`)} (family=${displayIdent(task.family)}, containers=${task.containers.length})`);
 		const taskNeeds = detectEcsImageResolutionNeeds(stacks.find((s) => s.stackName === task.stack.stackName) ?? task.stack);
 		if (stateProvider && taskNeeds.needsCrossStackResolver) {
 			const consumerRegion = options.region ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? task.stack.region ?? "us-east-1";
@@ -21395,7 +21567,7 @@ async function localRunTaskCommand(target, options, extraStateProviders) {
 			sigintCount = 99;
 			return;
 		}
-		if (result.essentialContainerName) logger.info(`Essential container '${result.essentialContainerName}' exited with code ${result.exitCode}.`);
+		if (result.essentialContainerName) logger.info(`Essential container ${displayIdent(result.essentialContainerName)} exited with code ${result.exitCode}.`);
 		if (result.exitCode !== 0) process.exitCode = result.exitCode;
 	} finally {
 		if (sigintHandler) {
@@ -21488,13 +21660,8 @@ async function buildEcsImageResolutionContext(candidate, stateProvider, options)
 	else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass a state-source flag (e.g. --from-cfn-stack or a host-provided extension) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
 	return ctx;
 }
-function pickCandidateStack(stackPattern, stacks) {
-	if (stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		return;
-	}
-	const matched = matchStacks(stacks, [stackPattern]);
-	if (matched.length === 1) return matched[0];
+function pickCandidateStack(target, stacks) {
+	return candidateTargetStack(parseEcsTarget(target), target, stacks);
 }
 async function resolveCallerAccountId(region, profile, readFromCfnStack) {
 	const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
@@ -21646,15 +21813,15 @@ function resolveAlbFrontDoor(stack, albLogicalId) {
 		if (port === void 0) continue;
 		const protocol = typeof props["Protocol"] === "string" ? props["Protocol"] : "HTTP";
 		if (protocol !== "HTTP" && protocol !== "HTTPS") {
-			warnings.push(`Listener '${listenerLogicalId}' on port ${port} uses protocol ${protocol}; the local ALB front-door supports HTTP and HTTPS listeners only (TLS / NLB-style listeners are not served). Skipping it.`);
+			warnings.push(`Listener ${displayIdent(listenerLogicalId)} on port ${port} uses protocol ${displayIdent(protocol)}; the local ALB front-door supports HTTP and HTTPS listeners only (TLS / NLB-style listeners are not served). Skipping it.`);
 			continue;
 		}
-		if (protocol === "HTTPS" && Array.isArray(props["Certificates"]) && props["Certificates"].length > 0) warnings.push(`Listener '${listenerLogicalId}' on port ${port} declares ACM Certificates which are not retrievable locally. The front-door terminates TLS with --tls-cert/--tls-key or an auto-generated self-signed cert.`);
-		const defaultResolved = resolveAction(props["DefaultActions"], resources, tgToService, stackName, `Listener '${listenerLogicalId}' (port ${port}) default action`, warnings);
+		if (protocol === "HTTPS" && Array.isArray(props["Certificates"]) && props["Certificates"].length > 0) warnings.push(`Listener ${displayIdent(listenerLogicalId)} on port ${port} declares ACM Certificates which are not retrievable locally. The front-door terminates TLS with --tls-cert/--tls-key or an auto-generated self-signed cert.`);
+		const defaultResolved = resolveAction(props["DefaultActions"], resources, tgToService, stackName, `Listener ${displayIdent(listenerLogicalId)} (port ${port}) default action`, warnings);
 		const rules = [];
 		for (const { ruleLogicalId, ruleProps } of rulesByListener.get(listenerLogicalId) ?? []) {
 			const priority = parsePriority(ruleProps["Priority"]);
-			const ruleLabel = `Listener rule '${ruleLogicalId}' (priority ${priority})`;
+			const ruleLabel = `Listener rule ${displayIdent(ruleLogicalId)} (priority ${priority})`;
 			const parsed = parseRuleConditions(ruleProps["Conditions"], ruleLabel, warnings);
 			if (!parsed) continue;
 			const { pathPatterns, hostPatterns, httpHeaderConditions, httpRequestMethods, queryStringConditions, sourceIpCidrs } = parsed;
@@ -21711,7 +21878,7 @@ function resolveAction(actions, resources, tgToService, stackName, label, warnin
 		if (type === "forward") terminal = resolveForwardAction(a, resources, tgToService, stackName, label, warnings);
 		else if (type === "redirect") terminal = resolveRedirectAction(a, label, warnings);
 		else if (type === "fixed-response") terminal = resolveFixedResponseAction(a);
-		else if (typeof type === "string") warnings.push(`${label} uses an unsupported action type '${type}'. The local ALB front-door supports forward / redirect / fixed-response actions only. Skipping it.`);
+		else if (typeof type === "string") warnings.push(`${label} uses an unsupported action type ${displayIdent(type)}. The local ALB front-door supports forward / redirect / fixed-response actions only. Skipping it.`);
 		if (terminal) return authGuard ? {
 			action: terminal,
 			authGuard
@@ -21729,7 +21896,7 @@ function resolveForwardAction(action, resources, tgToService, stackName, label,
 	for (const { tgRef, weight } of refs) {
 		const tg = resources[tgRef];
 		if (!tg || tg.Type !== TARGET_GROUP_TYPE) {
-			warnings.push(`${label} forwards to target group '${tgRef}', but no ${TARGET_GROUP_TYPE} with that logical id exists in ${stackName}. Skipping that target group.`);
+			warnings.push(`${label} forwards to target group ${displayIdent(tgRef)}, but no ${TARGET_GROUP_TYPE} with that logical id exists in ${displayStackName(stackName)}. Skipping that target group.`);
 			continue;
 		}
 		const tgProps = tg.Properties ?? {};
@@ -21743,7 +21910,7 @@ function resolveForwardAction(action, resources, tgToService, stackName, label,
 		}
 		const backing = tgToService.get(tgRef);
 		if (!backing) {
-			warnings.push(`${label} forwards to target group '${tgRef}', which is not referenced by any ${SERVICE_TYPE}.LoadBalancers[] in ${stackName}; cdk-local has no ECS service to front behind it. Skipping that target group.`);
+			warnings.push(`${label} forwards to target group ${displayIdent(tgRef)}, which is not referenced by any ${SERVICE_TYPE}.LoadBalancers[] in ${displayStackName(stackName)}; cdk-local has no ECS service to front behind it. Skipping that target group.`);
 			continue;
 		}
 		targets.push({
@@ -21764,12 +21931,12 @@ function resolveForwardAction(action, resources, tgToService, stackName, label,
 function resolveLambdaForwardTarget(tgProps, tgRef, resources, stackName, label, warnings) {
 	const lambdaLogicalId = resolveLambdaTargetLogicalId(tgProps["Targets"]);
 	if (!lambdaLogicalId) {
-		warnings.push(`${label} forwards to a Lambda target group '${tgRef}', but its Targets[].Id is not an in-stack { "Fn::GetAtt": [<FnLogicalId>, "Arn"] } reference; the local ALB front-door supports an in-stack Lambda target only (literal / imported ARNs deferred). Skipping that target group.`);
+		warnings.push(`${label} forwards to a Lambda target group ${displayIdent(tgRef)}, but its Targets[].Id is not an in-stack { "Fn::GetAtt": [<FnLogicalId>, "Arn"] } reference; the local ALB front-door supports an in-stack Lambda target only (literal / imported ARNs deferred). Skipping that target group.`);
 		return;
 	}
 	const lambda = resources[lambdaLogicalId];
 	if (!lambda || lambda.Type !== LAMBDA_FUNCTION_TYPE$1) {
-		warnings.push(`${label} forwards to Lambda target group '${tgRef}', whose target resolves to '${lambdaLogicalId}', but no ${LAMBDA_FUNCTION_TYPE$1} with that logical id exists in ${stackName}. Skipping that target group.`);
+		warnings.push(`${label} forwards to Lambda target group ${displayIdent(tgRef)}, whose target resolves to ${displayIdent(lambdaLogicalId)}, but no ${LAMBDA_FUNCTION_TYPE$1} with that logical id exists in ${displayStackName(stackName)}. Skipping that target group.`);
 		return;
 	}
 	return {
@@ -21907,7 +22074,7 @@ function parseRuleConditions(conditions, ruleLabel, warnings) {
 			}
 			out.sourceIpCidrs.push(...values);
 		} else {
-			warnings.push(`${ruleLabel} uses unsupported condition field '${field}'. Skipping the rule.`);
+			warnings.push(`${ruleLabel} uses unsupported condition field ${displayIdent(field)}. Skipping the rule.`);
 			return;
 		}
 	}
@@ -22054,7 +22221,7 @@ function parseAuthenticateAction(action, type, label, warnings) {
 		}
 		const match = COGNITO_USERPOOL_ARN.exec(userPoolArn);
 		if (!match) {
-			warnings.push(`${label}: authenticate-cognito UserPoolArn '${userPoolArn}' is not in the expected arn:...:cognito-idp:<region>:<account>:userpool/<pool-id> shape; skipping guard.`);
+			warnings.push(`${label}: authenticate-cognito UserPoolArn ${displayUntrustedValue(userPoolArn)} is not in the expected arn:...:cognito-idp:<region>:<account>:userpool/<pool-id> shape; skipping guard.`);
 			return;
 		}
 		const region = match[1];
@@ -22109,7 +22276,7 @@ function parseLbPortOverrides(values) {
 function resolveAlbTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalStartServiceError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack$1(parsed.stackPattern, stacks, target);
+	const stack = pickStack$1(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
@@ -22131,15 +22298,14 @@ function resolveAlbTarget(target, stacks) {
 		albLogicalId: parsed.pathOrId
 	};
 }
-function pickStack$1(stackPattern, stacks, target) {
-	if (stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		throw new LocalStartServiceError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${stacks.map((s) => s.stackName).join(", ")}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
+function pickStack$1(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new LocalStartServiceError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${describeStacks(stacks)}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
+		case "not-found": throw new LocalStartServiceError(`No stack matches '${selection.pattern}'. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new LocalStartServiceError(`Multiple stacks match '${selection.pattern}': ${describeStacks(selection.matched)}. Refine the pattern, or use the stack's display path (path form).`);
 	}
-	const matched = matchStacks(stacks, [stackPattern]);
-	if (matched.length === 0) throw new LocalStartServiceError(`No stack matches '${stackPattern}'. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
-	if (matched.length > 1) throw new LocalStartServiceError(`Multiple stacks match '${stackPattern}': ${matched.map((s) => s.stackName).join(", ")}. Refine the pattern.`);
-	return matched[0];
 }
 function notFound$1(target, stack, resources) {
 	const albs = Object.entries(resources).filter(([, r]) => r.Type === "AWS::ElasticLoadBalancingV2::LoadBalancer").map(([logicalId]) => logicalId);
@@ -22267,7 +22433,7 @@ function createCloudFrontModule(sources) {
 	} };
 }
 function createUnboundCloudFrontModule(functionLogicalId) {
-	const fail = () => Promise.reject(/* @__PURE__ */ new Error(`CloudFront Function '${functionLogicalId}' reads from a KeyValueStore (cf.kvs()), but no KeyValueStore binding is available locally. Pass --from-cfn-stack to read the deployed store, or --kvs-file <id>=<file.json> to back it with a local JSON map.`));
+	const fail = () => Promise.reject(/* @__PURE__ */ new Error(`CloudFront Function ${displayIdent(functionLogicalId)} reads from a KeyValueStore (cf.kvs()), but no KeyValueStore binding is available locally. Pass --from-cfn-stack to read the deployed store, or --kvs-file <id>=<file.json> to back it with a local JSON map.`));
 	const handle = {
 		get: () => fail(),
 		exists: () => fail(),
@@ -22282,17 +22448,17 @@ function pickSource(sources, kvsId) {
 	const byId = sources.find((s) => s.kvsId === kvsId);
 	if (byId) return byId;
 	if (sources.length === 1) return sources[0];
-	throw new Error(`cf.kvs('${kvsId}'): no associated KeyValueStore matches this id locally (associated: ${sources.map((s) => s.kvsId ?? s.label).join(", ")}).`);
+	throw new Error(`cf.kvs(${displayIdent(kvsId)}): no associated KeyValueStore matches this id locally (associated: ${sources.map((s) => s.kvsId ?? s.label).join(", ")}).`);
 }
 function makeHandle(source) {
 	return {
 		async get(key, options) {
 			const value = await source.getValue(key);
-			if (value === void 0) throw new Error(`cf.kvs().get('${key}'): key not found in ${source.label}.`);
+			if (value === void 0) throw new Error(`cf.kvs().get(${displayIdent(key)}): key not found in ${source.label}.`);
 			if (options?.format === "json") try {
 				return JSON.parse(value);
 			} catch (err) {
-				throw new Error(`cf.kvs().get('${key}', { format: 'json' }): value is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
+				throw new Error(`cf.kvs().get(${displayIdent(key)}, { format: 'json' }): value is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
 			}
 			return value;
 		},
@@ -22365,7 +22531,7 @@ function compileCloudFrontFunction(logicalId, code, runtime) {
 	try {
 		script = new vm.Script(`${source}\n;handler(${EVENT_GLOBAL})`, { filename: `cloudfront-function-${logicalId}.js` });
 	} catch (err) {
-		throw new Error(`CloudFront Function '${logicalId}' failed to compile: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`CloudFront Function ${displayIdent(logicalId)} failed to compile: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	let hasHandler;
 	try {
@@ -22377,9 +22543,9 @@ function compileCloudFrontFunction(logicalId, code, runtime) {
 		const probeContext = vm.createContext(probeGlobals);
 		hasHandler = new vm.Script(`${source}\n;typeof handler === 'function'`).runInContext(probeContext, { timeout: FUNCTION_TIMEOUT_MS });
 	} catch (err) {
-		throw new Error(`CloudFront Function '${logicalId}' failed to compile: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`CloudFront Function ${displayIdent(logicalId)} failed to compile: ${err instanceof Error ? err.message : String(err)}`);
 	}
-	if (hasHandler !== true) throw new Error(`CloudFront Function '${logicalId}' does not declare a 'handler' function. A CloudFront Function must export \`function handler(event) { ... }\`.`);
+	if (hasHandler !== true) throw new Error(`CloudFront Function ${displayIdent(logicalId)} does not declare a 'handler' function. A CloudFront Function must export \`function handler(event) { ... }\`.`);
 	return {
 		logicalId,
 		runtime,
@@ -22399,12 +22565,12 @@ async function invokeCloudFrontFunction(fn, event) {
 	try {
 		result = fn.script.runInContext(context, { timeout: FUNCTION_TIMEOUT_MS });
 	} catch (err) {
-		throw new Error(`CloudFront Function '${fn.logicalId}' threw at request time: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`CloudFront Function ${displayIdent(fn.logicalId)} threw at request time: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	try {
 		return result instanceof Promise ? await result : result;
 	} catch (err) {
-		throw new Error(`CloudFront Function '${fn.logicalId}' threw at request time: ${err instanceof Error ? err.message : String(err)}`);
+		throw new Error(`CloudFront Function ${displayIdent(fn.logicalId)} threw at request time: ${err instanceof Error ? err.message : String(err)}`);
 	}
 }
 async function runViewerRequest(fn, event) {
@@ -22572,9 +22738,9 @@ function resolveCloudFrontDistribution(args) {
 	const { stack, logicalId } = args;
 	const template = stack.template;
 	const resource = (template.Resources ?? {})[logicalId];
-	if (!resource || resource.Type !== "AWS::CloudFront::Distribution") throw new Error(`Resource '${logicalId}' in stack ${stack.stackName} is not an ${CLOUDFRONT_DISTRIBUTION_TYPE}.`);
+	if (!resource || resource.Type !== "AWS::CloudFront::Distribution") throw new Error(`Resource ${displayIdent(logicalId)} in stack ${displayStackName(stack.stackName)} is not an ${CLOUDFRONT_DISTRIBUTION_TYPE}.`);
 	const distConfig = (resource.Properties ?? {})["DistributionConfig"];
-	if (!distConfig || typeof distConfig !== "object") throw new Error(`Distribution '${logicalId}' has no DistributionConfig.`);
+	if (!distConfig || typeof distConfig !== "object") throw new Error(`Distribution ${displayIdent(logicalId)} has no DistributionConfig.`);
 	const dc = distConfig;
 	const behaviors = resolveBehaviors(dc, compileDistributionFunctions(template), logicalId, template);
 	const origins = resolveOrigins(dc, template, stack, args.originOverrides ?? /* @__PURE__ */ new Map());
@@ -22596,7 +22762,7 @@ function compileDistributionFunctions(template) {
 		const props = resource.Properties ?? {};
 		const code = props["FunctionCode"];
 		if (typeof code !== "string") {
-			getLogger().warn(`CloudFront Function '${logicalId}' has a non-inline FunctionCode; cdk-local can only run inline function code. Skipping.`);
+			getLogger().warn(`CloudFront Function ${displayIdent(logicalId)} has a non-inline FunctionCode; cdk-local can only run inline function code. Skipping.`);
 			continue;
 		}
 		const config = props["FunctionConfig"];
@@ -22645,7 +22811,7 @@ function resolveBehaviors(dc, functions, distLogicalId, template) {
 		if (!b || typeof b !== "object") continue;
 		const behavior = b;
 		if (typeof behavior["PathPattern"] !== "string") {
-			getLogger().warn(`Distribution '${distLogicalId}': a cache behavior has no literal PathPattern; cdk-local cannot route it and is skipping it.`);
+			getLogger().warn(`Distribution ${displayIdent(distLogicalId)}: a cache behavior has no literal PathPattern; cdk-local cannot route it and is skipping it.`);
 			continue;
 		}
 		behaviors.push(resolveBehavior(behavior, behavior["PathPattern"], functions, distLogicalId, template));
@@ -22667,7 +22833,7 @@ function resolveBehavior(behavior, pathPattern, functions, distLogicalId, templa
 		const eventType = assoc["EventType"];
 		const fnLogicalId = pickFunctionLogicalIdFromArn(assoc["FunctionARN"] ?? assoc["FunctionArn"]);
 		if (!fnLogicalId) {
-			getLogger().warn(`Distribution '${distLogicalId}': a FunctionAssociation references a function ARN cdk-local could not resolve to a local AWS::CloudFront::Function; it will not run.`);
+			getLogger().warn(`Distribution ${displayIdent(distLogicalId)}: a FunctionAssociation references a function ARN cdk-local could not resolve to a local AWS::CloudFront::Function; it will not run.`);
 			continue;
 		}
 		const fn = functions.get(fnLogicalId);
@@ -22691,7 +22857,7 @@ function resolveLambdaEdgeAssociations(behavior, template, distLogicalId) {
 		const eventType = assoc["EventType"];
 		const functionLogicalId = pickLambdaEdgeFunctionLogicalId(assoc["LambdaFunctionARN"], template);
 		if (!functionLogicalId) {
-			getLogger().warn(`Distribution '${distLogicalId}': a Lambda@Edge association references a LambdaFunctionARN cdk-local could not resolve to a local AWS::Lambda::Function; it will not run.`);
+			getLogger().warn(`Distribution ${displayIdent(distLogicalId)}: a Lambda@Edge association references a LambdaFunctionARN cdk-local could not resolve to a local AWS::Lambda::Function; it will not run.`);
 			continue;
 		}
 		const entry = {
@@ -23445,7 +23611,7 @@ async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3
 		if (!assoc) continue;
 		const invoke = edgeInvokers.get(assoc.functionLogicalId);
 		if (!invoke) {
-			logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (it failed to boot at start-up, see the boot warning, or was added after start-up); skipping. Restart start-cloudfront.`);
+			logger.warn(`Lambda@Edge ${eventType} function ${displayIdent(assoc.functionLogicalId)} was not booted (it failed to boot at start-up, see the boot warning, or was added after start-up); skipping. Restart start-cloudfront.`);
 			continue;
 		}
 		if (assoc.includeBody && edgeInput.body === void 0) edgeInput = {
@@ -23541,7 +23707,7 @@ async function handleRequest$1(req, res, state, lambdaInvokers, edgeInvokers, s3
 async function runEdgeResponseStage(assoc, eventType, ctx, edgeInvokers, logger) {
 	const invoke = edgeInvokers.get(assoc.functionLogicalId);
 	if (!invoke) {
-		logger.warn(`Lambda@Edge ${eventType} function '${assoc.functionLogicalId}' was not booted (it failed to boot at start-up, see the boot warning, or was added after start-up); skipping. Restart start-cloudfront.`);
+		logger.warn(`Lambda@Edge ${eventType} function ${displayIdent(assoc.functionLogicalId)} was not booted (it failed to boot at start-up, see the boot warning, or was added after start-up); skipping. Restart start-cloudfront.`);
 		return;
 	}
 	return applyEdgeResponseResult(await invoke(buildEdgeResponseEvent({
@@ -23601,7 +23767,7 @@ function setHeadersSafely(res, headers, logger) {
 	for (const [name, value] of Object.entries(headers)) try {
 		res.setHeader(name, value.replace(/[\r\n]/g, ""));
 	} catch (err) {
-		logger.warn(`Skipping invalid response header '${name}': ${err instanceof Error ? err.message : String(err)}`);
+		logger.warn(`Skipping invalid response header ${displayIdent(name)}: ${flattenToOneLine(err instanceof Error ? err.message : String(err))}`);
 	}
 }
 async function serveFromOrigin(origin, args) {
@@ -23660,13 +23826,13 @@ async function serveFromOrigin(origin, args) {
 	};
 }
 function originUnavailableMessage(origin, behavior) {
-	if (!origin) return `Behavior ${behavior.pathPattern ?? "(default)"} targets unknown origin '${behavior.targetOriginId}'.\n`;
-	if (origin.kind === "lambda-url") return `Origin '${origin.originId}' is a Lambda Function URL origin whose backing function '${origin.functionLogicalId}' was not booted (it was added after start-up). Restart start-cloudfront.\n`;
-	if (origin.kind === "custom") return `Origin '${origin.originId}' is a custom (non-S3) origin (${origin.domainName}). cdkl start-cloudfront serves S3 origins and Lambda Function URL origins only.
+	if (!origin) return `Behavior ${behavior.pathPattern === void 0 ? "(default)" : displayUntrustedValue(behavior.pathPattern)} targets unknown origin ${displayIdent(behavior.targetOriginId)}.\n`;
+	if (origin.kind === "lambda-url") return `Origin ${displayIdent(origin.originId)} is a Lambda Function URL origin whose backing function ${displayIdent(origin.functionLogicalId)} was not booted (it was added after start-up). Restart start-cloudfront.\n`;
+	if (origin.kind === "custom") return `Origin ${displayIdent(origin.originId)} is a custom (non-S3) origin (${displayUntrustedValue(String(origin.domainName))}). cdkl start-cloudfront serves S3 origins and Lambda Function URL origins only.
 `;
-	if (origin.kind === "s3-deployed") return `Origin '${origin.originId}' is a deployed-S3 origin (bucket '${origin.bucketName}') whose reader was not booted (it was promoted after start-up). Restart start-cloudfront.
+	if (origin.kind === "s3-deployed") return `Origin ${displayIdent(origin.originId)} is a deployed-S3 origin (bucket ${displayIdent(origin.bucketName)}) whose reader was not booted (it was promoted after start-up). Restart start-cloudfront.
 `;
-	return `Origin '${origin.originId}' is an S3 origin with no resolvable local source. Point it at a directory with --origin ${origin.originId}=<dir>.\n`;
+	return `Origin ${displayIdent(origin.originId)} is an S3 origin with no resolvable local source. Point it at a directory with --origin ${origin.originId}=<dir>.\n`;
 }
 function matchBehavior(behaviors, uri) {
 	let fallback;
@@ -23875,7 +24041,7 @@ function createDeployedKvsDataSource(options) {
 				}))).Value;
 			} catch (err) {
 				if (isKeyNotFound(err)) return void 0;
-				throw new Error(`cf.kvs().get('${key}') against ${flattenToOneLine(options.kvsArn)} failed: ${describeAwsFailureForWarn(err, "CloudFront KeyValueStore GetKey")}`);
+				throw new Error(`cf.kvs().get(${displayIdent(key)}) against ${flattenToOneLine(options.kvsArn)} failed: ${describeAwsFailureForWarn(err, "CloudFront KeyValueStore GetKey")}`);
 			}
 		}
 	};
@@ -23892,7 +24058,7 @@ async function resolveDeployedKvsArnByName(name, options = {}) {
 			...item.Id !== void 0 && { id: item.Id }
 		};
 	} catch (err) {
-		getLogger().debug(`ListKeyValueStores lookup for '${name}' failed: ${flattenToOneLine(stringifyThrown(err))}`);
+		getLogger().debug(`ListKeyValueStores lookup for ${displayIdent(name)} failed: ${flattenToOneLine(stringifyThrown(err))}`);
 	}
 }
 function isKeyNotFound(err) {
@@ -23915,7 +24081,7 @@ async function resolveKvsModulesForDistribution(distribution, options) {
 			if (source) sources.push(source);
 			else {
 				const ref = assoc.kvsLogicalId ?? "<store>";
-				warnings.push(`CloudFront Function '${fn.logicalId}' reads KeyValueStore '${ref}', but no binding resolved it — cf.kvs() reads will fail. Pass --from-cfn-stack to read the deployed store, or --kvs-file ${ref}=<file.json> for a local map.`);
+				warnings.push(`CloudFront Function ${displayIdent(fn.logicalId)} reads KeyValueStore ${displayIdent(ref)}, but no binding resolved it — cf.kvs() reads will fail. Pass --from-cfn-stack to read the deployed store, or --kvs-file ${ref}=<file.json> for a local map.`);
 			}
 		}
 		if (sources.length > 0) fn.cloudfrontModule = createCloudFrontModule(sources);
@@ -23999,7 +24165,7 @@ function collectKvsStoreIdentities(template) {
 function normalizeKvsFileKeys(kvsFiles, template) {
 	if (kvsFiles.size === 0) return kvsFiles;
 	const stores = collectKvsStoreIdentities(template);
-	const candidates = () => stores.map((s) => s.constructPath ? `${s.logicalId} (${s.constructPath})` : s.logicalId).join(", ") || "(none in this distribution)";
+	const candidates = () => stores.map((s) => s.constructPath ? `${displayIdent(s.logicalId, { listMember: true })} (${displayStackName(s.constructPath)})` : displayIdent(s.logicalId, { listMember: true })).join(", ") || "(none in this distribution)";
 	const out = /* @__PURE__ */ new Map();
 	for (const [key, filePath] of kvsFiles) {
 		const matched = [
@@ -24008,7 +24174,7 @@ function normalizeKvsFileKeys(kvsFiles, template) {
 			stores.filter((s) => s.constructId === key)
 		].find((t) => t.length > 0) ?? [];
 		if (matched.length === 0) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' matched no AWS::CloudFront::KeyValueStore in the distribution. Pass a store's logical id, construct path, or bare construct id. Candidates: ${candidates()}.`);
-		if (matched.length > 1) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' is ambiguous — it matched ${matched.length} KeyValueStores (${matched.map((s) => s.logicalId).join(", ")}). Use the logical id or full construct path.`);
+		if (matched.length > 1) throw new LocalStartCloudFrontError(`--kvs-file key '${key}' is ambiguous — it matched ${matched.length} KeyValueStores (${matched.map((s) => displayIdent(s.logicalId, { listMember: true })).join(", ")}). Use the logical id or full construct path.`);
 		out.set(matched[0].logicalId, filePath);
 	}
 	return out;
@@ -24047,7 +24213,7 @@ async function attachKvsModules(distribution, stacks, options, profileCredential
 function resolveCloudFrontTarget(target, stacks) {
 	if (stacks.length === 0) throw new LocalStartCloudFrontError("No stacks found in the synthesized assembly.");
 	const parsed = parseEcsTarget(target);
-	const stack = pickStack(parsed.stackPattern, stacks, target);
+	const stack = pickStack(parsed, stacks, target);
 	const resources = stack.template.Resources ?? {};
 	if (parsed.isPath) {
 		const index = buildCdkPathIndex(stack.template);
@@ -24069,15 +24235,14 @@ function resolveCloudFrontTarget(target, stacks) {
 		logicalId: parsed.pathOrId
 	};
 }
-function pickStack(stackPattern, stacks, target) {
-	if (stackPattern === null) {
-		if (stacks.length === 1) return stacks[0];
-		throw new LocalStartCloudFrontError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${stacks.map((s) => s.stackName).join(", ")}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
+function pickStack(parsed, stacks, target) {
+	const selection = selectTargetStack(parsed, target, stacks);
+	switch (selection.kind) {
+		case "found": return selection.stack;
+		case "no-prefix": throw new LocalStartCloudFrontError(`Target '${target}' has no stack prefix, and the assembly contains ${stacks.length} stacks: ${describeStacks(stacks)}. Pass it as 'Stack/Path' or 'Stack:LogicalId'.`);
+		case "not-found": throw new LocalStartCloudFrontError(`No stack matches '${selection.pattern}'. Available stacks: ${describeStacks(stacks)}.`);
+		case "ambiguous": throw new LocalStartCloudFrontError(`Multiple stacks match '${selection.pattern}': ${describeStacks(selection.matched)}. Refine the pattern, or use the stack's display path (path form).`);
 	}
-	const matched = matchStacks(stacks, [stackPattern]);
-	if (matched.length === 0) throw new LocalStartCloudFrontError(`No stack matches '${stackPattern}'. Available stacks: ${stacks.map((s) => s.stackName).join(", ")}.`);
-	if (matched.length > 1) throw new LocalStartCloudFrontError(`Multiple stacks match '${stackPattern}': ${matched.map((s) => s.stackName).join(", ")}. Refine the pattern.`);
-	return matched[0];
 }
 function notFound(target, stack, resources) {
 	const dists = Object.entries(resources).filter(([, r]) => r.Type === CLOUDFRONT_DISTRIBUTION_TYPE).map(([logicalId]) => logicalId);
@@ -24106,7 +24271,7 @@ async function bootLambdaUrlOrigins(distribution, stacks, opts) {
 			await runner.start();
 		} catch (err) {
 			await Promise.all(runners.map((r) => r.stop().catch(() => void 0)));
-			throw new LocalStartCloudFrontError(`Failed to boot the Lambda Function URL origin's backing function '${functionLogicalId}': ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
+			throw new LocalStartCloudFrontError(`Failed to boot the Lambda Function URL origin's backing function ${displayIdent(functionLogicalId)}: ${err instanceof Error ? err.message : String(err)}`, err instanceof Error ? err : void 0);
 		}
 		runners.push(runner);
 		invokers.set(functionLogicalId, (event) => runner.invoke(event));
@@ -24146,7 +24311,7 @@ async function bootLambdaEdgeFunctions(distribution, stacks, opts) {
 		runners.push(runner);
 		invokers.set(functionLogicalId, (event) => runner.invoke(event));
 	} catch (err) {
-		logger.warn(`Could not boot Lambda@Edge function '${functionLogicalId}'; its stage will be skipped: ${err instanceof Error ? err.message : String(err)}`);
+		logger.warn(`Could not boot Lambda@Edge function ${displayIdent(functionLogicalId)}; its stage will be skipped: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	return {
 		invokers,
@@ -24174,8 +24339,8 @@ function buildLambdaBootOptions(options, profileCredentials, extraStateProviders
 }
 function warnUnsupported(distribution, extraStateProviders) {
 	const logger = getLogger();
-	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin '${origin.originId}' is a custom (non-S3, non-Lambda-Function-URL) origin (${origin.domainName}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
-	else if (origin.kind === "s3-unresolved") logger.warn(`Origin '${origin.originId}' is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass ${stateSourceFlagNames(extraStateProviders).join(" or ")} to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
+	for (const origin of distribution.origins.values()) if (origin.kind === "custom") logger.warn(`Origin ${displayIdent(origin.originId)} is a custom (non-S3, non-Lambda-Function-URL) origin (${displayUntrustedValue(String(origin.domainName))}); ${getEmbedConfig().cliName} start-cloudfront serves S3 origins and Lambda Function URL origins only. Requests routed to it return 502.`);
+	else if (origin.kind === "s3-unresolved") logger.warn(`Origin ${displayIdent(origin.originId)} is an S3 origin with no resolvable local source (no BucketDeployment found, or its source could not be located in the cloud assembly). Pass ${stateSourceFlagNames(extraStateProviders).join(" or ")} to serve the deployed bucket from real S3 on demand, or point it at a local directory with --origin ${origin.originId}=<dir>. Requests routed to it return 502.`);
 }
 function warnUnusedCacheOrigin(options, extraStateProviders) {
 	if (options.cacheOrigin === true && !isStateSourceActive(options, extraStateProviders)) {
@@ -24231,7 +24396,7 @@ async function resolveDeployedS3Origins(distribution, stacks, options, profileCr
 			originId: origin.originId,
 			bucketName
 		});
-		logger.info(`Origin '${origin.originId}': no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}, resolved via ${via}) on demand under ${stateFlag}.`);
+		logger.info(`Origin ${displayIdent(origin.originId)}: no local BucketDeployment source; serving from deployed S3 (bucket=${bucketName}, resolved via ${via}) on demand under ${stateFlag}.`);
 	}
 	return {
 		readers,
@@ -24320,7 +24485,7 @@ async function localStartCloudFrontCommand(target, options, extraStateProviders,
 		await Promise.all([...lambdaRunners, ...edgeRunners].map((r) => r.stop().catch(() => void 0)));
 		throw err;
 	}
-	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${initial.distribution.logicalId})\n`);
+	process.stdout.write(`CloudFront distribution serving on ${server.url}  (${displayIdent(initial.distribution.logicalId)})\n`);
 	process.stdout.write("^C to stop.\n");
 	let watcher;
 	let reloadChain = Promise.resolve();
@@ -24695,7 +24860,7 @@ function readAuthorizationHeader(headers) {
 //#region src/cli/commands/local-start-agentcore.ts
 function parsePort(raw) {
 	const n = Number(raw);
-	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new CdkLocalError(`--port must be an integer 0-65535, got '${raw}'.`, "INVALID_PORT");
+	if (!Number.isInteger(n) || n < 0 || n > 65535) throw new InvalidArgumentError(`--port must be an integer 0-65535, got '${raw}'.`);
 	return n;
 }
 function resolveAgentCoreServePlan(protocol) {
@@ -24812,7 +24977,7 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders,
 		loaded: void 0
 	};
 	const resolved = resolveAgentCoreTarget(resolvedTarget, stacks, imageContext);
-	logger.info(`Target: ${resolved.stack.stackName}/${resolved.logicalId} (${resolved.protocol})`);
+	logger.info(`Target: ${displayStackName(`${resolved.stack.stackName}/${resolved.logicalId}`)} (${resolved.protocol})`);
 	const plan = resolveAgentCoreServePlan(resolved.protocol);
 	const sigv4Context = await resolveAgentCoreSigV4Context(options, resolved, loadedState, stateProvider);
 	const authPlan = selectServeInboundAuth(resolved, options, sigv4Context !== void 0);
@@ -24885,12 +25050,12 @@ async function localStartAgentCoreCommand(target, options, extraStateProviders,
 		throw err;
 	}
 	if (server.wsUrl) {
-		logger.info(`Server listening on ${server.wsUrl}  (${resolved.logicalId} (AgentCore WebSocket))`);
+		logger.info(`Server listening on ${server.wsUrl}  (${displayIdent(resolved.logicalId)} (AgentCore WebSocket))`);
 		logger.info(`HTTP contract served on ${server.httpUrl} — POST ${server.httpUrl}/invocations, GET ${server.httpUrl}/ping`);
 	} else {
 		const contractPath = plan.routes[0]?.path ?? "/";
 		const contractUrl = `${server.httpUrl}${contractPath}`;
-		logger.info(`Server listening on ${server.httpUrl}  (${resolved.logicalId})`);
+		logger.info(`Server listening on ${server.httpUrl}  (${displayIdent(resolved.logicalId)})`);
 		logger.info(`${resolved.protocol} contract served on ${contractUrl} — POST ${contractUrl}`);
 	}
 	logger.info("Press ^C to shut down.");
@@ -25066,9 +25231,9 @@ function formatSection(title, command, entries, long) {
 	if (entries.length === 0) return [];
 	const lines = [`${title}  ->  ${command}`];
 	for (const entry of entries) {
-		const primary = entry.displayPath ?? entry.qualifiedId;
-		lines.push(entry.kind ? `  ${primary}  (${entry.kind})` : `  ${primary}`);
-		if (long && entry.displayPath) lines.push(`      ${entry.qualifiedId}`);
+		const shown = displayStackName(entry.displayPath ?? entry.qualifiedId);
+		lines.push(entry.kind ? `  ${shown}  (${entry.kind})` : `  ${shown}`);
+		if (long && entry.displayPath) lines.push(`      ${displayStackName(entry.qualifiedId)}`);
 	}
 	return lines;
 }
@@ -28846,13 +29011,15 @@ function runChild(spawnFn, nodeBin, argv, cwd, invocationId, target, bus, clock)
 	return new Promise((resolve, reject) => {
 		let child;
 		try {
+			const env = {
+				...process.env,
+				CDKL_LOG_LEVEL: "warn",
+				CDKL_LOG_STREAM: "stderr"
+			};
+			delete env["CDKL_PREFIX_CONTAINER_OUTPUT"];
 			child = spawnFn(nodeBin, argv, {
 				cwd,
-				env: {
-					...process.env,
-					CDKL_LOG_LEVEL: "warn",
-					CDKL_LOG_STREAM: "stderr"
-				}
+				env
 			});
 		} catch (err) {
 			reject(err instanceof Error ? err : new Error(String(err)));
@@ -29307,16 +29474,16 @@ const SERVE_SPECS = {
 		extraEndpointRe: /^HTTP contract served on (https?:\/\/\S+)/
 	}
 };
-const PUBLISHED_ENDPOINT_RE = /^Container '[^']*' container port \d+ published on ((?:\d{1,3}(?:\.\d{1,3}){3}|\[[0-9A-Fa-f:.]{2,45}\]):\d+)/;
+const PUBLISHED_ENDPOINT_RE = /^Container (?:[A-Za-z0-9:_@./+=,~-]+|"(?:[^"\\]|\\.)*")(?: \[cut: [^\]]*\])? container port \d+ published on ((?:\d{1,3}(?:\.\d{1,3}){3}|\[[0-9A-Fa-f:.]{2,45}\]):\d+)/;
 function parsePublishedHostEndpoint(line) {
 	const m = PUBLISHED_ENDPOINT_RE.exec(line);
 	return m ? `http://${m[1]}` : void 0;
 }
 function describeForeignEndpointRefusal(targetId, endpoint, what) {
-	const quoted = `'${describeEndpointForMessage(endpoint)}'`;
+	const quoted = displayUntrustedValue(describeEndpointForMessage(endpoint));
 	const outcome = "No endpoint was adopted and no capture proxy was started.";
-	if (!parsesAsUrl(endpoint)) return `refused an unparseable ${what} ${quoted} from '${targetId}': it is not a URL, so studio cannot tell where a request to it would go. ${outcome}`;
-	return `refused a non-loopback ${what} ${quoted} from '${targetId}': a serve child always listens on this machine, so studio will not send requests there. ${outcome}`;
+	if (!parsesAsUrl(endpoint)) return `refused an unparseable ${what} ${quoted} from ${displayStackName(targetId)}: it is not a URL, so studio cannot tell where a request to it would go. ${outcome}`;
+	return `refused a non-loopback ${what} ${quoted} from ${displayStackName(targetId)}: a serve child always listens on this machine, so studio will not send requests there. ${outcome}`;
 }
 function parsesAsUrl(value) {
 	try {
@@ -29425,7 +29592,7 @@ function createStudioServeManager(config) {
 		const spec = SERVE_SPECS[req.kind];
 		if (!spec) throw new Error(`Serving '${req.kind}' targets from studio is not supported (serve kinds: ${Object.keys(SERVE_SPECS).join(", ")}).`);
 		const existing = entries.get(req.targetId);
-		if (existing && existing.status !== "stopped" && existing.status !== "error") throw new Error(`'${req.targetId}' is already running.`);
+		if (existing && existing.status !== "stopped" && existing.status !== "error") throw new Error(`${displayStackName(req.targetId)} is already running.`);
 		const startedAt = clock();
 		let envDir;
 		const envVars = resolveEnvVars(req.kind, req.options);
@@ -29440,7 +29607,8 @@ function createStudioServeManager(config) {
 				cwd,
 				env: {
 					...process.env,
-					CDKL_LOG_STREAM: "stdout"
+					CDKL_LOG_STREAM: "stdout",
+					CDKL_PREFIX_CONTAINER_OUTPUT: "1"
 				}
 			});
 		} catch (err) {
@@ -29492,7 +29660,7 @@ function createStudioServeManager(config) {
 				stopChild(child, stopGraceMs, setTimeoutFn, clearTimeoutFn);
 				closeProxies(entry);
 				if (entries.get(req.targetId) === entry) entries.delete(req.targetId);
-				reject(/* @__PURE__ */ new Error(`'${req.targetId}' did not start within ${readyTimeoutMs}ms.`));
+				reject(/* @__PURE__ */ new Error(`${displayStackName(req.targetId)} did not start within ${readyTimeoutMs}ms.`));
 			}, readyTimeoutMs);
 			timer.unref?.();
 			const becomeRunning = () => {
@@ -29609,7 +29777,7 @@ function createStudioServeManager(config) {
 					settled = true;
 					clearTimeoutFn(timer);
 					if (entry.stopping) {
-						reject(/* @__PURE__ */ new Error(`'${req.targetId}' was stopped before it finished starting.`));
+						reject(/* @__PURE__ */ new Error(`${displayStackName(req.targetId)} was stopped before it finished starting.`));
 						return;
 					}
 					entry.status = "error";
@@ -29631,7 +29799,7 @@ function createStudioServeManager(config) {
 	}
 	async function stop(req) {
 		const entry = entries.get(req.targetId);
-		if (!entry) throw new Error(`'${req.targetId}' is not running.`);
+		if (!entry) throw new Error(`${displayStackName(req.targetId)} is not running.`);
 		entry.stopping = true;
 		entries.delete(req.targetId);
 		await Promise.all([closeProxies(entry), stopChild(entry.child, stopGraceMs, setTimeoutFn, clearTimeoutFn)]);
@@ -29944,10 +30112,7 @@ function resolveBootAssemblyDir(appCmd, output) {
 	if (isDir(outPath)) return outPath;
 }
 function resolveEcsServiceStack(targetId, stacks) {
-	const parsed = parseEcsTarget(targetId);
-	if (parsed.stackPattern === null) return stacks.length === 1 ? stacks[0] : void 0;
-	const matched = matchStacks(stacks, [parsed.stackPattern]);
-	return matched.length === 1 ? matched[0] : void 0;
+	return candidateTargetStack(parseEcsTarget(targetId), targetId, stacks);
 }
 async function prepareEcsImageContexts(args) {
 	const { serviceIds, stacks, options, logger } = args;
@@ -29974,7 +30139,7 @@ async function prepareEcsImageContexts(args) {
 			const ctx = await buildEcsImageResolutionContext(stack, stateProvider, options);
 			contextByStack.set(stack.stackName, ctx);
 		} catch (err) {
-			logger.warn(`studio: could not build deployed-state image context for stack '${stack.stackName}'; ECS services in it resolve against the synthed template only. ${describeAwsFailureForWarn(err, "deployed-state image context (CloudFormation + SSM)")}`);
+			logger.warn(`studio: could not build deployed-state image context for stack ${displayStackName(stack.stackName)}; ECS services in it resolve against the synthed template only. ${describeAwsFailureForWarn(err, "deployed-state image context (CloudFormation + SSM)")}`);
 			contextByStack.set(stack.stackName, void 0);
 		} finally {
 			stateProvider?.dispose();
@@ -29990,7 +30155,7 @@ function makePinClassifier(args) {
 			const context = stack ? contextByStack.get(stack.stackName) : void 0;
 			return !isLocalCdkAssetImage(resolveEcsServiceTarget(id, stacks, context));
 		} catch (err) {
-			logger.warn(`studio: could not classify image-pin status for ECS service '${id}'; leaving it unmarked (the image-override picker will not be offered).${pinClassifyStateHint(stateBound)} ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`studio: could not classify image-pin status for ECS service ${displayStackName(id)}; leaving it unmarked (the image-override picker will not be offered).${pinClassifyStateHint(stateBound)} ${err instanceof Error ? err.message : String(err)}`);
 			if (stateBound === false) onUnresolved?.(id);
 			return false;
 		}
@@ -30010,7 +30175,7 @@ function makeTaskPinClassifier(args) {
 			const representative = task.containers.find((c) => c.essential) ?? task.containers[0];
 			return representative !== void 0 && representative.image.kind !== "cdk-asset";
 		} catch (err) {
-			logger.warn(`studio: could not classify image-pin status for ECS task definition '${id}'; leaving it unmarked (the image-override picker will not be offered).${pinClassifyStateHint(stateBound)} ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`studio: could not classify image-pin status for ECS task definition ${displayStackName(id)}; leaving it unmarked (the image-override picker will not be offered).${pinClassifyStateHint(stateBound)} ${err instanceof Error ? err.message : String(err)}`);
 			if (stateBound === false) onUnresolved?.(id);
 			return false;
 		}
@@ -30041,7 +30206,7 @@ function makeAlbBackingPinnedResolver(args) {
 			}
 			return out;
 		} catch (err) {
-			logger.warn(`studio: could not resolve ALB '${albEntry.id}' backing services for the image-override picker; the alb composer will not offer one. ${err instanceof Error ? err.message : String(err)}`);
+			logger.warn(`studio: could not resolve ALB ${displayStackName(albEntry.id)} backing services for the image-override picker; the alb composer will not offer one. ${err instanceof Error ? err.message : String(err)}`);
 			return [];
 		}
 	};
@@ -30336,4 +30501,4 @@ function addStudioSpecificOptions(cmd) {
 
 //#endregion
 export { applyEdgeResponseResult as $, defaultCredentialsLoader as $n, resolveCfnFallbackRegion as $r, isLocalCdkAssetImage as $t, startAgentCoreHttpServer as A, LocalInvokeBuildError as Ai, renderCodeDockerfile as An, resolveHostGatewayExtraHosts as Ar, addRunTaskSpecificOptions as At, idFromArn as B, withoutKeys as Bi, createFileWatcher as Bn, buildContainerImage as Br, resolveEcsAssumeRoleOption as Bt, addListSpecificOptions as C, AgentCoreResolutionError as Ci, invokeAgentCore as Cn, pickResponseTemplate as Cr, parseLbPortOverrides as Ct, createLocalStartAgentCoreCommand as D, formatStateRemedy as Di, SUPPORTED_CODE_RUNTIMES as Dn, HOST_DOCKER_INTERNAL_GATEWAY as Dr, addStartServiceSpecificOptions as Dt, addStartAgentCoreSpecificOptions as E, derivePseudoParametersFromRegion as Ei, downloadAndExtractS3Bundle as En, VtlEvaluationError as Er, resolveAlbFrontDoor as Et, createLocalStartCloudFrontCommand as F, firstUsableRegion as Fi, addStartApiSpecificOptions as Fn, parseConnectionsPath as Fr, addImageOverrideOptions as Ft, classifyS3Error as G, recordAssumedRole as Gi, availableApiIdentifiers as Gn, substituteAgainstState as Gr, canonicalizeImageOverrideKeys as Gt, createDeployedKvsDataSource as H, assumedRoleRecorded as Hi, buildStageMap as Hn, resolveRuntimeFileExtension as Hr, runEcsServiceEmulator as Ht, normalizeKvsFileKeys as I, keysNotFromTemplate as Ii, createLocalStartApiCommand as In, buildConnectEvent as Ir, buildEcsImageResolutionContext$1 as It, startCloudFrontServer as J, workloadStsClientConfig as Ji, groupRoutesByServer as Jn, substituteEnvVarsFromStateAsync as Jr, parseImageOverrideFlags as Jt, createS3OriginReader as K, resetWorkloadIdentity as Ki, filterRoutesByApiIdentifier as Kn, substituteAgainstStateAsync as Kr, enforceImageOverrideOrphans as Kt, parseKvsFileOverrides as L, keysOverriddenBy as Li, createWatchPredicates as Ln, buildDisconnectEvent as Lr, ecsClusterOption as Lt, startAgentCoreWsBridge as M, DynamicReferenceResolver as Mi, classifySourceChange as Mn, ConnectionRegistry as Mr, MAX_TASKS_SUBNET_RANGE_CAP as Mt, LocalStartCloudFrontError as N, containsDynamicReference as Ni, addInvokeSpecificOptions as Nn, buildMgmtEndpointEnvUrl as Nr, addCommonEcsServiceOptions as Nt, buildAgentCoreServeAuthCheck as O, substituteImagePlaceholders as Oi, buildAgentCoreCodeImage as On, HOST_GATEWAY_MIN_VERSION as Or, createLocalStartServiceCommand as Ot, addStartCloudFrontSpecificOptions as P, deployedFillMayBeSecret as Pi, createLocalInvokeCommand as Pn, handleConnectionsRequest as Pr, addEcsAssumeRoleOptions as Pt, applyEdgeRequestResult as Q, isProxyEnvConfigured as Qi, resolveServiceIntegrationParameters as Qn, rejectExplicitCfnStackWithMultipleStacks as Qr, imageOverrideKeyAliases as Qt, parseOriginOverrides as R, parseDynamicReference as Ri, resolveApiTargetSubset as Rn, buildMessageEvent as Rr, parseMaxTasks as Rt, StudioEventBus as S, AGENTCORE_RUNTIME_TYPE as Si, AGENTCORE_SESSION_ID_HEADER as Sn, evaluateResponseParameters as Sr, createLocalStartAlbCommand as St, formatTargetListing as T, resolveAgentCoreTarget as Ti, waitForAgentCorePing as Tn, tryParseStatus as Tr, isApplicationLoadBalancer as Tt, resolveDeployedKvsArnByName as U, deployAccountStsClientConfig as Ui, materializeLayerFromArn as Un, resolveRuntimeImage as Ur, ImageOverrideError as Ut, resolveKvsModulesForDistribution as V, SECOND_ASSUME_MESSAGE as Vi, attachStageContext as Vn, resolveRuntimeCodeMountPath as Vr, resolveSharedSidecarCredentials as Vt, resolveDeployedOriginBucket as W, readEnvCallerCredentials as Wi, resolveEnvVars$1 as Wn, EcsTaskResolutionError as Wr, buildImageOverrideTag as Wt, serveFromStaticOrigin as X, resolveProfileCredentials as Xi, startApiServer as Xn, createLocalStateProvider as Xr, runImageOverrideBuilds as Xt, resolveErrorResponseCandidates as Y, buildStsClientConfig as Yi, readMtlsMaterialsFromDisk as Yn, LocalStateSourceError as Yr, resolveImageOverrides as Yt, serveLambdaUrlOrigin as Z, buildProxyClientConfig as Zi, resolveSelectionExpression as Zn, isCfnFlagPresent as Zr, describePinnedImageUri as Zt, filterStudioTargetGroups as _, resolveLambdaArnIntrinsic as _i, MCP_PROTOCOL_VERSION as _n, matchRoute as _r, createCloudFrontModule as _t, createLocalStudioCommand as a, resolveWatchConfig as ai, setShadowReadyTimeoutMs as an, verifyJwtViaDiscovery as ar, describeS3OriginDomain as at, renderStudioHtml as b, AGENTCORE_HTTP_PROTOCOL as bi, AGENTCORE_SIGV4_SERVICE as bn, buildHttpApiV2Event as br, addAlbSpecificOptions as bt, startStudioProxy as c, listTargets as ci, addInvokeAgentCoreSpecificOptions as cn, evaluateCachedLambdaPolicy as cr, pickFunctionUrlLogicalIdFromOrigin as ct, createStudioDispatcher as d, discoverWebSocketApisOrThrow as di, invokeAgentCoreWs as dn, attachAuthorizers as dr, pickTargetFunctionLogicalId as dt, resolveCfnRegion as ei, listPinnedTargets as en, buildCognitoJwksUrl as er, buildEdgeRequestEvent as et, filterStudioCustomResources as f, filterWebSocketApisByIdentifiers as fi, A2A_CONTAINER_PORT as fn, applyCorsResponseHeaders as fr, resolveCloudFrontDistribution as ft, annotatePinnedEcsTargets as g, pickRefLogicalId as gi, MCP_PATH as gn, matchPreflight as gr, stripCloudFrontImport as gt, annotateEcsTaskPinnedTargets as h, discoverRoutes as hi, MCP_CONTAINER_PORT as hn, isFunctionUrlOacFronted as hr, runViewerResponse as ht, coerceStopRequest as i, resolveSsmParameters as ii, SOFT_RELOAD_COMPLETION_LOG_SUFFIX as in, verifyJwtAuthorizer as ir, CLOUDFRONT_DISTRIBUTION_TYPE as it, attachAgentCoreWsBridge as j, DynamicReferenceResolutionError as ji, toCmdArgv as jn, bufferToBody as jr, createLocalRunTaskCommand as jt, selectServeInboundAuth as k, tryResolveImageFnJoin as ki, computeCodeImageTag as kn, probeHostGatewaySupport as kr, serviceStrategy as kt, relayServeRequest as l, availableWebSocketApiIdentifiers as li, createLocalInvokeAgentCoreCommand as ln, invokeRequestAuthorizer as lr, pickKvsLogicalIdFromArn as lt, annotateAlbPinnedBackingServices as m, webSocketApiMatchesIdentifier as mi, a2aInvokeOnce as mn, buildCorsConfigFromCloudFrontChain as mr, runViewerRequest as mt, coerceRunRequest as n, CfnLocalStateProvider as ni, CloudMapRegistry as nn, createJwksCache as nr, edgeHeadersToHttp as nt, resolveServeBaseUrl as o, resolveSingleTarget as oi, getContainerNetworkIp as on, buildMethodArn as or, extractKvsAssociations as ot, isCustomResourceLambdaTarget as p, parseSelectionExpressionPath as pi, A2A_PATH as pn, buildCorsConfigByApiId as pr, compileCloudFrontFunction as pt, matchBehavior as q, workloadClientConfig as qi, filterRoutesByApiIdentifiers as qn, substituteEnvVarsFromState as qr, mergeForService as qt, coerceServeRequest as r, collectSsmParameterRefs as ri, DEFAULT_SHADOW_READY_TIMEOUT_MS as rn, verifyCognitoJwt as rr, httpHeadersToEdge as rt, createStudioServeManager as s, countTargets as si, attachContainerLogStreamer as sn, computeRequestIdentityHash as sr, isCloudFrontDistribution as st, addStudioSpecificOptions as t, resolveCfnStackName as ti, buildCloudMapIndex as tn, buildJwksUrlFromIssuer as tr, buildEdgeResponseEvent as tt, reinvoke as u, discoverWebSocketApis as ui, bridgeAgentCoreWs as un, invokeTokenAuthorizer as ur, pickLambdaEdgeFunctionLogicalId as ut, startStudioServer as v, AGENTCORE_A2A_PROTOCOL as vi, mcpInvokeOnce as vn, translateLambdaResponse as vr, createLocalFileKvsDataSource as vt, createLocalListCommand as w, pickAgentCoreCandidateStack as wi, waitForAgentCoreHttpReady as wn, selectIntegrationResponse as wr, resolveAlbTarget as wt, createStudioStore as x, AGENTCORE_MCP_PROTOCOL as xi, signAgentCoreInvocation as xn, buildRestV1Event as xr, albStrategy as xt, toStudioTargetGroups as y, AGENTCORE_AGUI_PROTOCOL as yi, parseSseForJsonRpc as yn, applyAuthorizerOverlay as yr, createUnboundCloudFrontModule as yt, resolveCloudFrontTarget as z, resolveDynamicReferencesInEnv as zi, createAuthorizerCache as zn, architectureToPlatform as zr, parseRestartPolicy as zt };
-//# sourceMappingURL=local-studio-DCTVck5l.js.map
+//# sourceMappingURL=local-studio-CJfNARFz.js.map