@go-to-k/cdkd 0.231.12 → 0.233.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-uvVnteGl.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as resolveSkipPrefix, A as DiffCalculator, B as buildDockerImage, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as AssetManifestLoader, H as getDockerCmd, I as shouldRetainResource, J as synthesisStatusMessage, K as getDockerImageBySourceHash, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as resolveCaptureObservedState, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as runDockerForeground, V as formatDockerLoginError, W as runDockerStreaming, X as getLegacyStateBucketName, Y as getDefaultStateBucketName, Z as resolveApp, _ as green, a as withRetry, at as MIGRATE_TMP_PREFIX, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as AssemblyReader, d as isStatefulRecreateTargetSync, et as resolveStateBucketWithDefault, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as CFN_TEMPLATE_URL_LIMIT, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as warnDeprecatedNoPrefixCliFlag, o as isRetryableTransientError, ot as findLargeInlineResources, p as formatResourceLine, q as Synthesizer, r as DeployEngine, rt as CFN_TEMPLATE_BODY_LIMIT, s as IMPLICIT_DELETE_DEPENDENCIES, st as uploadCfnTemplate, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as resolveStateBucketWithDefaultAndSource, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveBucketRegion, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as WorkGraph } from "./deploy-engine-BkPZar1R.js";
+import { $ as AssetManifestLoader, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as buildDockerImage, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerStreaming, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as getDockerCmd, Y as formatDockerLoginError, Z as runDockerForeground, _ as green, _t as AssemblyReader, a as withRetry, at as resolveApp, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveStateBucketWithDefault, d as isStatefulRecreateTargetSync, dt as warnDeprecatedNoPrefixCliFlag, et as getDockerImageBySourceHash, f as renderStatefulReason, ft as CFN_TEMPLATE_BODY_LIMIT, g as gray, gt as uploadCfnTemplate, h as cyan, ht as findLargeInlineResources, i as withResourceDeadline, it as getLegacyStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveStateBucketWithDefaultAndSource, m as bold, mt as MIGRATE_TMP_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as synthesisStatusMessage, o as isRetryableTransientError, ot as resolveCaptureObservedState, p as formatResourceLine, pt as CFN_TEMPLATE_URL_LIMIT, q as parseBootstrapMarker, r as DeployEngine, rt as getDefaultStateBucketName, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveSkipPrefix, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as Synthesizer, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveUseCdkBootstrapAssets, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, yt as resolveBucketRegion, z as WorkGraph } from "./deploy-engine-Dj9mXUQa.js";
 import { t as ASGProvider } from "./asg-provider-Dd9Xze-T.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -492,6 +492,14 @@ const recreateViaSdkProviderOption = new Option("--recreate-via-sdk-provider <lo
 */
 const forceStatefulRecreationOption = new Option("--force-stateful-recreation", "Bypass the stateful-resource guard for --recreate-via-cc-api targets. Required when ANY named target is a stateful type (RDS / DynamoDB / EFS / S3 with data / Logs with retention / Cognito / Secrets / SSM / Glue / ECR / CloudFront / Kinesis / OpenSearch). Destroy + recreate loses ALL data in the resource — no automatic data migration. Triple-opt-in for CI use: --recreate-via-cc-api <id> --force-stateful-recreation --yes.").default(false);
 const replaceOption = new Option("--replace", "Replace (DELETE + CREATE) a resource whose in-place update is rejected because an immutable property changed and AWS exposes no update API for it (e.g. Lambda LayerVersion content, EFS AccessPoint, ECS TaskDefinition, ApiGatewayV2 immutable fields). Without this flag such a change fails the deploy. Stateful types (RDS / DynamoDB / EFS / S3 with data / Logs with retention / etc.) ALSO require --force-stateful-recreation since the replacement is a data-losing DELETE + CREATE.").default(false);
+/**
+* Issue #1002 PR 2 — per-invocation legacy pin for asset destinations
+* (design §4.2). Shared by `deploy`, `diff`, `import`, and `publish-assets`
+* (every command the redirection / rewrite affects) so the CLI surface stays
+* consistent; the per-app pin is `cdk.json context.cdkd.useCdkBootstrapAssets`
+* (see `resolveUseCdkBootstrapAssets` in config-loader.ts).
+*/
+const useCdkBootstrapAssetsOption = new Option("--use-cdk-bootstrap-assets", "Publish assets to the CDK bootstrap bucket/repo named by the asset manifest verbatim, skipping the cdkd asset-storage redirection even when this region is opted in via 'cdkd bootstrap'. For apps deployed via both CloudFormation and cdkd during a migration window. Per-app pin: cdk.json context.cdkd.useCdkBootstrapAssets. Also suppresses the legacy-mode 'cdk gc' notice.").default(false);
 const deployOptions = [
 	new Option("--concurrency <number>", "Maximum concurrent resource operations").default(10).argParser((value) => parseInt(value, 10)),
 	new Option("--stack-concurrency <number>", "Maximum concurrent stack deployments").default(4).argParser((value) => parseInt(value, 10)),
@@ -511,6 +519,7 @@ const deployOptions = [
 	recreateViaSdkProviderOption,
 	forceStatefulRecreationOption,
 	replaceOption,
+	useCdkBootstrapAssetsOption,
 	...resourceTimeoutOptions
 ];
 /**
@@ -603,7 +612,11 @@ const destroyOptions = [
 /**
 * Bootstrap command implementation
 *
-* Creates S3 bucket for state management
+* Creates the S3 bucket for state management and (unless --no-assets) the
+* cdkd-owned asset storage for the region: asset bucket + container-asset
+* ECR repo + the per-region bootstrap marker that flips deploys in this
+* region from legacy (CDK bootstrap destinations) to cdkd-assets mode
+* (issue #1002, design at docs/design/1002-cdkd-asset-storage.md).
 */
 async function bootstrapCommand(options) {
 	const logger = getLogger();
@@ -646,54 +659,96 @@ async function bootstrapCommand(options) {
 				operation: "HeadBucket"
 			});
 		}
-		if (bucketExists) {
-			if (!options.force) {
+		let skipStateBucketConfig = false;
+		if (bucketExists) if (!options.force) {
+			if (!options.assets) {
 				logger.warn(`Bucket ${bucketName} already exists. Use --force to reconfigure (this will not delete existing state)`);
 				return;
 			}
-			logger.info("--force specified, continuing with existing bucket");
-		} else {
+			logger.info(`State bucket ${bucketName} already exists — skipping reconfiguration (use --force to reconfigure)`);
+			skipStateBucketConfig = true;
+		} else logger.info("--force specified, continuing with existing bucket");
+		else {
 			logger.info(`Creating S3 bucket: ${bucketName} in region ${region}`);
 			const createBucketParams = { Bucket: bucketName };
 			if (region !== "us-east-1") createBucketParams.CreateBucketConfiguration = { LocationConstraint: region };
 			await s3Client.send(new CreateBucketCommand(createBucketParams));
 			logger.info(`✓ Created S3 bucket: ${bucketName}`);
 		}
-		logger.debug("Enabling bucket versioning...");
-		await s3Client.send(new PutBucketVersioningCommand({
-			Bucket: bucketName,
-			VersioningConfiguration: { Status: "Enabled" }
-		}));
-		logger.info("✓ Enabled bucket versioning");
-		logger.debug("Enabling bucket encryption...");
-		await s3Client.send(new PutBucketEncryptionCommand({
-			Bucket: bucketName,
-			ServerSideEncryptionConfiguration: { Rules: [{
-				ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
-				BucketKeyEnabled: true
-			}] }
-		}));
-		logger.info("✓ Enabled bucket encryption (AES-256)");
-		logger.debug("Setting bucket policy...");
-		const bucketPolicy = {
-			Version: "2012-10-17",
-			Statement: [{
-				Sid: "DenyExternalAccess",
-				Effect: "Deny",
-				Principal: "*",
-				Action: "s3:*",
-				Resource: [`arn:aws:s3:::${bucketName}`, `arn:aws:s3:::${bucketName}/*`],
-				Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
-			}]
-		};
-		await s3Client.send(new PutBucketPolicyCommand({
-			Bucket: bucketName,
-			Policy: JSON.stringify(bucketPolicy)
-		}));
-		logger.info("✓ Set bucket policy (deny external access)");
+		if (!skipStateBucketConfig) {
+			logger.debug("Enabling bucket versioning...");
+			await s3Client.send(new PutBucketVersioningCommand({
+				Bucket: bucketName,
+				VersioningConfiguration: { Status: "Enabled" }
+			}));
+			logger.info("✓ Enabled bucket versioning");
+			logger.debug("Enabling bucket encryption...");
+			await s3Client.send(new PutBucketEncryptionCommand({
+				Bucket: bucketName,
+				ServerSideEncryptionConfiguration: { Rules: [{
+					ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
+					BucketKeyEnabled: true
+				}] }
+			}));
+			logger.info("✓ Enabled bucket encryption (AES-256)");
+			logger.debug("Setting bucket policy...");
+			const bucketPolicy = {
+				Version: "2012-10-17",
+				Statement: [{
+					Sid: "DenyExternalAccess",
+					Effect: "Deny",
+					Principal: "*",
+					Action: "s3:*",
+					Resource: [`arn:aws:s3:::${bucketName}`, `arn:aws:s3:::${bucketName}/*`],
+					Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
+				}]
+			};
+			await s3Client.send(new PutBucketPolicyCommand({
+				Bucket: bucketName,
+				Policy: JSON.stringify(bucketPolicy)
+			}));
+			logger.info("✓ Set bucket policy (deny external access)");
+		}
+		let assetStorage;
+		if (options.assets) {
+			logger.info("\nSetting up cdkd asset storage...");
+			const ecrClient = new ECRClient({
+				region,
+				...options.profile && { profile: options.profile }
+			});
+			const markerS3Client = new S3Client({
+				region,
+				...options.profile && { profile: options.profile }
+			});
+			const stateBackend = new S3StateBackend(markerS3Client, {
+				bucket: bucketName,
+				prefix: "cdkd"
+			}, {
+				region,
+				...options.profile && { profile: options.profile }
+			});
+			try {
+				assetStorage = await ensureAssetStorage({
+					s3Client,
+					ecrClient,
+					stateBackend,
+					accountId,
+					region,
+					force: options.force
+				});
+			} finally {
+				ecrClient.destroy();
+				markerS3Client.destroy();
+			}
+		} else logger.info("\n--no-assets specified — skipping cdkd asset storage. Deploys in this region keep publishing assets to the CDK bootstrap bucket/repo.");
 		logger.info("\n✓ Bootstrap completed successfully");
 		logger.info(`\nState bucket: ${bucketName}`);
+		if (assetStorage) {
+			logger.info(`Asset bucket: ${assetStorage.assetBucket}`);
+			logger.info(`Container-asset repository: ${assetStorage.containerRepo}`);
+		}
 		logger.info(`Region: ${region}`);
+		if (assetStorage) logger.info(`\ncdkd asset storage is now ON for region ${region}: deploys in this region publish assets to the cdkd-owned bucket/repo (out of 'cdk gc' reach) instead of the CDK bootstrap storage. The first deploy of each existing stack with assets will show a one-time UPDATE re-pointing asset references — content is identical, no replacement.`);
 		logger.info("\nYou can now use cdkd deploy with:");
 		logger.info(`  --state-bucket ${bucketName}`);
 		logger.info(`  --region ${region}`);
@@ -705,7 +760,7 @@ async function bootstrapCommand(options) {
 * Create bootstrap command
 */
 function createBootstrapCommand() {
-	const cmd = new Command("bootstrap").description("Bootstrap cdkd by creating required S3 bucket for state management").option("--state-bucket <bucket>", "Name of S3 bucket to create for state storage (default: cdkd-state-{accountId})").option("--force", "Force reconfiguration of existing bucket", false).addOption(new Option("--region <region>", "AWS region in which to create the state bucket (defaults to AWS_REGION env or us-east-1)")).action(withErrorHandling(bootstrapCommand));
+	const cmd = new Command("bootstrap").description("Bootstrap cdkd by creating the S3 state bucket plus cdkd-owned asset storage (asset bucket + container-asset ECR repo) for the region").option("--state-bucket <bucket>", "Name of S3 bucket to create for state storage (default: cdkd-state-{accountId})").option("--force", "Force reconfiguration of existing bucket", false).option("--no-assets", "Skip cdkd asset storage (asset bucket / ECR repo / marker) — deploys keep publishing assets to the CDK bootstrap bucket/repo").addOption(new Option("--region <region>", "AWS region in which to create the state bucket (defaults to AWS_REGION env or us-east-1)")).action(withErrorHandling(bootstrapCommand));
 	commonOptions.forEach((opt) => cmd.addOption(opt));
 	return cmd;
 }
@@ -1445,7 +1500,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.231.12";
+	return "0.233.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -36769,7 +36824,7 @@ var NestedStackProvider = class {
 		this.requireDeployContext(ctx, "create");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
 		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${logicalId}' under parent '${ctx.parentStackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
-		const childTemplate = this.readChildTemplate(childTemplatePath);
+		const childTemplate = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
 		const childRegion = ctx.parentRegion;
 		const childParameters = this.extractParameters(properties);
@@ -36788,7 +36843,7 @@ var NestedStackProvider = class {
 		this.requireDeployContext(ctx, "update");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
 		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${logicalId}' on update.`);
-		const childTemplate = this.readChildTemplate(childTemplatePath);
+		const childTemplate = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
 		const childRegion = ctx.parentRegion;
 		const childParameters = this.extractParameters(properties);
@@ -36883,18 +36938,24 @@ var NestedStackProvider = class {
 		else throw new Error(`NestedStackProvider: child Parameter '${k}' resolved to a non-scalar value (type=${v === null ? "null" : typeof v}). Parameters must be scalars (string / number / boolean) by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
 		return result;
 	}
-	readChildTemplate(templatePath) {
+	readChildTemplate(templatePath, assetRedirect) {
 		let raw;
 		try {
 			raw = fs.readFileSync(templatePath, "utf-8");
 		} catch (err) {
 			throw new Error(`Failed to read nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		let template;
 		try {
-			return JSON.parse(raw);
+			template = JSON.parse(raw);
 		} catch (err) {
 			throw new Error(`Failed to parse nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		if (assetRedirect) {
+			const n = rewriteTemplateAssetReferences(template, assetRedirect);
+			if (n > 0) this.logger.debug(`Rewrote ${n} asset reference(s) to cdkd asset storage in nested template ${templatePath}`);
+		}
+		return template;
 	}
 	indexGrandchildTemplates(childTemplate, childTemplatePath) {
 		const dir = path.dirname(childTemplatePath);
@@ -37644,6 +37705,11 @@ async function deployCommand(stacks, options) {
 		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 		stsClient.destroy();
 		const assetPublisher = new AssetPublisher();
+		const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
+		const assetModeResolver = new AssetModeResolver(preflightStateBackend, accountId, {
+			...options.profile && { profile: options.profile },
+			...useCdkBootstrapAssets && { useCdkBootstrapAssets: true }
+		});
 		const stateConfig = {
 			bucket: stateBucket,
 			prefix: options.statePrefix
@@ -37657,20 +37723,36 @@ async function deployCommand(stacks, options) {
 		};
 		const workGraph = new WorkGraph();
 		const stackMap = new Map(targetStacks.map((s) => [s.stackName, s]));
+		const stackRedirects = /* @__PURE__ */ new Map();
 		for (const stack of targetStacks) {
 			const stackNodeId = `stack:${stack.stackName}`;
 			const stackDeps = /* @__PURE__ */ new Set();
-			if (!options.skipAssets && stack.assetManifestPath) try {
+			if (stack.assetManifestPath) {
 				const assetRegion = stack.region || baseRegion;
-				const nodeIds = assetPublisher.addAssetsToGraph(workGraph, stack.assetManifestPath, {
-					accountId,
-					region: assetRegion,
-					...options.profile && { profile: options.profile },
-					nodePrefix: `${stack.stackName}:`
-				});
-				for (const id of nodeIds) stackDeps.add(id);
-			} catch (error) {
-				if (error.code !== "ENOENT") throw error;
+				const manifest = loadPublishableAssetManifest(stack.assetManifestPath);
+				if (manifest) {
+					const assetMode = await assetModeResolver.resolve(assetRegion);
+					logger.debug(`Asset mode for region ${assetRegion}: ${assetMode.mode} (stack ${stack.stackName})`);
+					let redirect;
+					if (assetMode.mode === "cdkd-assets") {
+						redirect = buildAssetRedirectMap(manifest, assetMode.marker, accountId, assetRegion);
+						if (redirect.entries.length > 0) {
+							stackRedirects.set(stack.stackName, redirect);
+							const rewritten = rewriteTemplateAssetReferences(stack.template, redirect);
+							logger.debug(`Rewrote ${rewritten} asset reference(s) to cdkd asset storage (${assetMode.marker.assetBucket} / ${assetMode.marker.containerRepo}) in template of stack ${stack.stackName}`);
+						} else redirect = void 0;
+					}
+					if (!options.skipAssets) {
+						const nodeIds = assetPublisher.addAssetsToGraph(workGraph, stack.assetManifestPath, {
+							accountId,
+							region: assetRegion,
+							...options.profile && { profile: options.profile },
+							nodePrefix: `${stack.stackName}:`,
+							...redirect && { redirect }
+						});
+						for (const id of nodeIds) stackDeps.add(id);
+					}
+				}
 			}
 			for (const depName of effectiveStackDeps(stack.stackName, stack.dependencyNames)) if (stackMap.has(depName)) stackDeps.add(`stack:${depName}`);
 			workGraph.addNode({
@@ -37769,10 +37851,12 @@ async function deployCommand(stacks, options) {
 						})) return;
 					}
 				}
+				const assetRedirect = stackRedirects.get(stackInfo.stackName);
 				const deployEngineOptions = {
 					concurrency: options.concurrency,
 					dryRun: options.dryRun,
 					noRollback: !options.rollback,
+					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
 					...recreateViaCcApiTargets && recreateViaCcApiTargets.size > 0 && { recreateViaCcApiTargets },
 					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
@@ -37798,7 +37882,8 @@ async function deployCommand(stacks, options) {
 					nestedTemplates: stackInfo.nestedTemplates ?? {},
 					dagBuilder,
 					diffCalculator,
-					options: deployEngineOptions
+					options: deployEngineOptions,
+					...assetRedirect && { assetRedirect }
 				}, () => stackDeployEngine.deploy(stackInfo.stackName, stackInfo.template));
 				logger.info(`\n${bold("Deployment Summary:")}`);
 				logger.info(`  Stack: ${bold(cyan(deployResult.stackName))}`);
@@ -38836,7 +38921,7 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, assetRedirect } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
 	const node = {
 		stackName,
@@ -38855,6 +38940,7 @@ async function buildDiffTree(args) {
 		if (!childTemplatePath) throw new Error(`Nested template file not found for ${NESTED_STACK_RESOURCE_TYPE} '${logicalId}' under stack '${stackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default), then re-run synth.`);
 		const childStackName = `${stackName}~${logicalId}`;
 		const childTemplate = readNestedTemplate(childTemplatePath);
+		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 		const grandchildTemplates = indexNestedChildTemplates(childTemplate, childTemplatePath);
 		const childParameters = await resolveChildStackParameters(resource, template, state, region, stackName, stateBackend, parameters);
 		node.children.push(await buildDiffTree({
@@ -38866,7 +38952,8 @@ async function buildDiffTree(args) {
 			recursive: true,
 			stateBackend,
 			diffCalculator,
-			parameters: childParameters
+			parameters: childParameters,
+			...assetRedirect && { assetRedirect }
 		}));
 	}
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
@@ -39176,10 +39263,22 @@ async function diffCommand(stacks, options) {
 		});
 		const diffCalculator = new DiffCalculator();
 		const recursive = options.recursive ?? false;
+		const resolveAssetRedirect = createAssetRedirectResolver({
+			stateBackend,
+			stsRegion: region,
+			...options.profile && { profile: options.profile },
+			useCdkBootstrapAssets: resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets),
+			suppressLegacyNotice: true
+		});
 		const trees = [];
 		for (const stackInfo of targetStacks) {
 			logger.info(`\nCalculating diff for stack: ${stackInfo.stackName}`);
 			const stackRegion = stackInfo.region || region;
+			const assetRedirect = await resolveAssetRedirect(stackInfo.assetManifestPath, stackRegion);
+			if (assetRedirect) {
+				const rewritten = rewriteTemplateAssetReferences(stackInfo.template, assetRedirect);
+				logger.debug(`Rewrote ${rewritten} asset reference(s) to cdkd asset storage in template of stack ${stackInfo.stackName}`);
+			}
 			trees.push(await buildDiffTree({
 				stackName: stackInfo.stackName,
 				displayName: stackInfo.stackName,
@@ -39188,7 +39287,8 @@ async function diffCommand(stacks, options) {
 				nestedTemplates: stackInfo.nestedTemplates ?? {},
 				recursive,
 				stateBackend,
-				diffCalculator
+				diffCalculator,
+				...assetRedirect && { assetRedirect }
 			}));
 		}
 		if (options.json) process.stdout.write(`${JSON.stringify(trees.map(diffTreeToJson), null, 2)}\n`);
@@ -39208,7 +39308,7 @@ async function diffCommand(stacks, options) {
 * Create diff command
 */
 function createDiffCommand() {
-	const cmd = new Command("diff").description("Show difference between current state and desired state").argument("[stacks...]", "Stack name(s) to diff. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Diff all stacks", false).option("--recursive", "Recurse into each AWS::CloudFormation::Stack row and diff every nested-stack child against its own deployed state (DFS order). Default is non-recursive, matching cdk diff.", false).option("--fail", "Exit with code 1 when any change is detected (matches cdk diff --fail). With --recursive, considers the whole nested-stack tree.", false).option("--json", "Output the diff as JSON (nested tree shape when combined with --recursive)", false).action(withErrorHandling(diffCommand));
+	const cmd = new Command("diff").description("Show difference between current state and desired state").argument("[stacks...]", "Stack name(s) to diff. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Diff all stacks", false).option("--recursive", "Recurse into each AWS::CloudFormation::Stack row and diff every nested-stack child against its own deployed state (DFS order). Default is non-recursive, matching cdk diff.", false).option("--fail", "Exit with code 1 when any change is detected (matches cdk diff --fail). With --recursive, considers the whole nested-stack tree.", false).option("--json", "Output the diff as JSON (nested tree shape when combined with --recursive)", false).addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(diffCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -41501,36 +41601,45 @@ async function publishAssetsCommand(stacks, options) {
 	const stsClient = new STSClient({ region: baseRegion });
 	const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 	stsClient.destroy();
+	const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
+	let markerAccess;
+	const getModeResolver = async () => {
+		if (markerAccess !== void 0) return markerAccess?.resolver ?? null;
+		let bucket;
+		try {
+			bucket = await resolveStateBucketWithDefault(options.stateBucket, baseRegion);
+		} catch {
+			logger.info("No cdkd state bucket found — publishing to the asset-manifest destinations (CDK bootstrap storage) verbatim. Run 'cdkd bootstrap' to opt into cdkd-owned asset storage that 'cdk gc' never touches.");
+			markerAccess = null;
+			return null;
+		}
+		const markerClients = new AwsClients({
+			region: baseRegion,
+			...options.profile && { profile: options.profile }
+		});
+		const resolver = new AssetModeResolver(new S3StateBackend(markerClients.s3, {
+			bucket,
+			prefix: options.statePrefix
+		}, {
+			region: baseRegion,
+			...options.profile && { profile: options.profile }
+		}), accountId, { ...options.profile && { profile: options.profile } });
+		markerAccess = {
+			resolver,
+			dispose: () => markerClients.destroy()
+		};
+		return resolver;
+	};
 	const assetPublisher = new AssetPublisher();
 	const results = [];
-	for (const stack of targetStacks) {
-		const startedAt = Date.now();
-		let assetCount = 0;
-		let error;
-		try {
-			if (!stack.assetManifestPath) {
-				logger.debug(`Stack ${stack.stackName} has no asset manifest; nothing to publish`);
-				results.push({
-					stackName: stack.stackName,
-					displayName: stack.displayName,
-					assetCount: 0,
-					durationMs: Date.now() - startedAt
-				});
-				continue;
-			}
-			logger.info(`\nPublishing assets for stack: ${describeStack(stack)}`);
-			const workGraph = new WorkGraph();
-			let nodeIds = [];
+	try {
+		for (const stack of targetStacks) {
+			const startedAt = Date.now();
+			let assetCount = 0;
+			let error;
 			try {
-				nodeIds = assetPublisher.addAssetsToGraph(workGraph, stack.assetManifestPath, {
-					accountId,
-					region: stack.region || baseRegion,
-					...options.profile && { profile: options.profile },
-					nodePrefix: `${stack.stackName}:`
-				});
-			} catch (err) {
-				if (err.code === "ENOENT") {
-					logger.debug(`Asset manifest not found for ${stack.stackName} (${stack.assetManifestPath}); skipping`);
+				if (!stack.assetManifestPath) {
+					logger.debug(`Stack ${stack.stackName} has no asset manifest; nothing to publish`);
 					results.push({
 						stackName: stack.stackName,
 						displayName: stack.displayName,
@@ -41539,36 +41648,76 @@ async function publishAssetsCommand(stacks, options) {
 					});
 					continue;
 				}
-				throw err;
-			}
-			assetCount = nodeIds.filter((id) => id.startsWith("asset-publish:")).length;
-			if (assetCount === 0) {
-				logger.info("  (no assets to publish)");
-				results.push({
-					stackName: stack.stackName,
-					displayName: stack.displayName,
-					assetCount: 0,
-					durationMs: Date.now() - startedAt
-				});
-				continue;
+				logger.info(`\nPublishing assets for stack: ${describeStack(stack)}`);
+				let redirect;
+				if (!useCdkBootstrapAssets) {
+					const manifest = loadPublishableAssetManifest(stack.assetManifestPath);
+					if (manifest) {
+						const modeResolver = await getModeResolver();
+						if (modeResolver) {
+							const stackRegion = stack.region || baseRegion;
+							const assetMode = await modeResolver.resolve(stackRegion);
+							if (assetMode.mode === "cdkd-assets") {
+								const map = buildAssetRedirectMap(manifest, assetMode.marker, accountId, stackRegion);
+								if (map.entries.length > 0) redirect = map;
+							}
+						}
+					}
+				}
+				const workGraph = new WorkGraph();
+				let nodeIds = [];
+				try {
+					nodeIds = assetPublisher.addAssetsToGraph(workGraph, stack.assetManifestPath, {
+						accountId,
+						region: stack.region || baseRegion,
+						...options.profile && { profile: options.profile },
+						nodePrefix: `${stack.stackName}:`,
+						...redirect && { redirect }
+					});
+				} catch (err) {
+					if (err.code === "ENOENT") {
+						logger.debug(`Asset manifest not found for ${stack.stackName} (${stack.assetManifestPath}); skipping`);
+						results.push({
+							stackName: stack.stackName,
+							displayName: stack.displayName,
+							assetCount: 0,
+							durationMs: Date.now() - startedAt
+						});
+						continue;
+					}
+					throw err;
+				}
+				assetCount = nodeIds.filter((id) => id.startsWith("asset-publish:")).length;
+				if (assetCount === 0) {
+					logger.info("  (no assets to publish)");
+					results.push({
+						stackName: stack.stackName,
+						displayName: stack.displayName,
+						assetCount: 0,
+						durationMs: Date.now() - startedAt
+					});
+					continue;
+				}
+				await workGraph.execute({
+					"asset-build": options.imageBuildConcurrency,
+					"asset-publish": options.assetPublishConcurrency,
+					stack: 0
+				}, (node) => assetPublisher.executeNode(node));
+				logger.info(`  ✓ Published ${assetCount} asset(s) in ${((Date.now() - startedAt) / 1e3).toFixed(2)}s`);
+			} catch (err) {
+				error = err instanceof Error ? err : new Error(String(err));
+				logger.error(`  ✗ ${stack.stackName}: ${error.message}`);
 			}
-			await workGraph.execute({
-				"asset-build": options.imageBuildConcurrency,
-				"asset-publish": options.assetPublishConcurrency,
-				stack: 0
-			}, (node) => assetPublisher.executeNode(node));
-			logger.info(`  ✓ Published ${assetCount} asset(s) in ${((Date.now() - startedAt) / 1e3).toFixed(2)}s`);
-		} catch (err) {
-			error = err instanceof Error ? err : new Error(String(err));
-			logger.error(`  ✗ ${stack.stackName}: ${error.message}`);
-		}
-		results.push({
-			stackName: stack.stackName,
-			displayName: stack.displayName,
-			assetCount,
-			durationMs: Date.now() - startedAt,
-			...error && { error }
-		});
+			results.push({
+				stackName: stack.stackName,
+				displayName: stack.displayName,
+				assetCount,
+				durationMs: Date.now() - startedAt,
+				...error && { error }
+			});
+		}
+	} finally {
+		markerAccess?.dispose();
 	}
 	const failed = results.filter((r) => r.error);
 	const totalAssets = results.reduce((sum, r) => sum + r.assetCount, 0);
@@ -41591,11 +41740,12 @@ async function publishAssetsCommand(stacks, options) {
 * `cdkd deploy --no-asset-publish` (which doesn't exist).
 */
 function createPublishAssetsCommand() {
-	const cmd = new Command("publish-assets").description("Synthesize the CDK app and publish assets to S3/ECR for the selected stack(s) without deploying").argument("[stacks...]", "Stack name(s) to publish assets for. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards.").option("--all", "Publish assets for all stacks", false).addOption(new Option("--asset-publish-concurrency <number>", "Maximum concurrent asset publish operations").default(8).argParser((value) => parseInt(value, 10))).addOption(new Option("--image-build-concurrency <number>", "Maximum concurrent Docker image builds").default(4).argParser((value) => parseInt(value, 10))).action(withErrorHandling(publishAssetsCommand));
+	const cmd = new Command("publish-assets").description("Synthesize the CDK app and publish assets to S3/ECR for the selected stack(s) without deploying").argument("[stacks...]", "Stack name(s) to publish assets for. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards.").option("--all", "Publish assets for all stacks", false).addOption(new Option("--asset-publish-concurrency <number>", "Maximum concurrent asset publish operations").default(8).argParser((value) => parseInt(value, 10))).addOption(new Option("--image-build-concurrency <number>", "Maximum concurrent Docker image builds").default(4).argParser((value) => parseInt(value, 10))).addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(publishAssetsCommand));
 	[
 		...commonOptions,
 		...appOptions,
-		...contextOptions
+		...contextOptions,
+		...stateOptions
 	].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(new Option("--stack <name>", "Stack name to publish (alternative to positional)"));
 	cmd.addOption(deprecatedRegionOption);
@@ -45188,6 +45338,45 @@ async function readSchemaVersion(awsClients, bucket, keys) {
 	}
 }
 /**
+* List every region's bootstrap marker under `cdkd-bootstrap/` in the state
+* bucket. Malformed markers are skipped with a warning — `state info` is a
+* cosmetic command and should not crash on an unexpected payload (deploy
+* hard-errors on the same marker instead).
+*/
+async function listAssetStorageMarkers(awsClients, bucket) {
+	const logger = getLogger();
+	const entries = [];
+	let continuationToken;
+	const keys = [];
+	do {
+		const resp = await awsClients.s3.send(new ListObjectsV2Command({
+			Bucket: bucket,
+			Prefix: BOOTSTRAP_MARKER_PREFIX,
+			...continuationToken && { ContinuationToken: continuationToken }
+		}));
+		for (const obj of resp.Contents ?? []) if (typeof obj.Key === "string" && obj.Key.startsWith("cdkd-bootstrap/") && obj.Key.endsWith(".json")) keys.push(obj.Key);
+		continuationToken = resp.NextContinuationToken;
+	} while (continuationToken);
+	for (const key of keys) {
+		const region = key.slice(BOOTSTRAP_MARKER_PREFIX.length, -5);
+		try {
+			const marker = parseBootstrapMarker(await (await awsClients.s3.send(new GetObjectCommand({
+				Bucket: bucket,
+				Key: key
+			}))).Body?.transformToString() ?? "", key);
+			entries.push({
+				region,
+				assetBucket: marker.assetBucket,
+				containerRepo: marker.containerRepo,
+				createdAt: marker.createdAt
+			});
+		} catch (error) {
+			logger.warn(`Skipping malformed/unreadable bootstrap marker '${key}': ${error.message}`);
+		}
+	}
+	return entries.sort((a, b) => a.region.localeCompare(b.region));
+}
+/**
 * `cdkd state info` command implementation.
 *
 * Prints the state-bucket information that used to appear as a banner on
@@ -45229,6 +45418,7 @@ async function stateInfoCommand(options) {
 		const detectedRegion = await detectBucketRegion(awsClients, bucket);
 		const stateFileKeys = await listStateFileKeys(awsClients, bucket, prefix);
 		const schemaVersion = await readSchemaVersion(awsClients, bucket, stateFileKeys);
+		const assetStorage = await listAssetStorageMarkers(awsClients, bucket);
 		if (options.json) {
 			const json = {
 				bucket,
@@ -45236,7 +45426,8 @@ async function stateInfoCommand(options) {
 				regionSource: detectedRegion ? "auto-detected" : "unknown",
 				bucketSource: resolved.source,
 				schemaVersion,
-				stackCount: stateFileKeys.length
+				stackCount: stateFileKeys.length,
+				assetStorage
 			};
 			process.stdout.write(`${JSON.stringify(json, null, 2)}\n`);
 			return;
@@ -45248,6 +45439,11 @@ async function stateInfoCommand(options) {
 		lines.push(`Source:          ${formatBucketSource(resolved.source)}`);
 		lines.push(`Schema version:  ${schemaVersion}`);
 		lines.push(`Stacks:          ${stateFileKeys.length}`);
+		if (assetStorage.length === 0) lines.push("Asset storage:   legacy (CDK bootstrap) — run cdkd bootstrap to opt in");
+		else {
+			lines.push(`Asset storage:   cdkd-assets mode in ${assetStorage.length} region(s)`);
+			for (const entry of assetStorage) lines.push(`  ${entry.region}: ${entry.assetBucket} / ${entry.containerRepo}`);
+		}
 		process.stdout.write(`${lines.join("\n")}\n`);
 	} finally {
 		awsClients.destroy();
@@ -45573,6 +45769,17 @@ async function importCommand(stackArg, options) {
 		else throw new Error(`Multiple stacks found: ${result.stacks.map((s) => s.stackName).join(", ")}. Specify the stack name as a positional argument.`);
 		const targetRegion = stackInfo.region || region;
 		logger.info(`Target stack: ${stackInfo.stackName} (${targetRegion})`);
+		const assetRedirect = await createAssetRedirectResolver({
+			stateBackend,
+			stsRegion: region,
+			...options.profile && { profile: options.profile },
+			useCdkBootstrapAssets: resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets),
+			suppressLegacyNotice: true
+		})(stackInfo.assetManifestPath, targetRegion);
+		if (assetRedirect) {
+			const rewritten = rewriteTemplateAssetReferences(stackInfo.template, assetRedirect);
+			logger.debug(`Rewrote ${rewritten} asset reference(s) to cdkd asset storage in template of stack ${stackInfo.stackName}`);
+		}
 		const overrides = parseResourceOverrides(options.resource, options.resourceMapping, options.resourceMappingInline);
 		if (overrides.size > 0) logger.debug(`User-supplied physical IDs: ${[...overrides.keys()].join(", ")}`);
 		const migrationCfnStackName = options.migrateFromCloudformation ? typeof options.migrateFromCloudformation === "string" && options.migrateFromCloudformation.length > 0 ? options.migrateFromCloudformation : stackInfo.stackName : void 0;
@@ -45709,7 +45916,8 @@ async function importCommand(stackArg, options) {
 				templateParser,
 				lockOwner: owner,
 				accountId: accountIdForNestedSynth,
-				logger
+				logger,
+				assetRedirect
 			});
 			if (migrationCfnStackName) {
 				const orphaned = resources.length - importedRows.length;
@@ -46124,7 +46332,7 @@ async function confirmPrompt(prompt) {
 *      default behavior, now opt-in.
 */
 function createImportCommand() {
-	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource via the aws:cdk:path tag. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to also tag-import the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also tag-import everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / tag-based auto-lookup), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the tag-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO tag-import every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "After cdkd state is written, retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").action(withErrorHandling(importCommand));
+	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource via the aws:cdk:path tag. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to also tag-import the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also tag-import everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / tag-based auto-lookup), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the tag-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO tag-import every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "After cdkd state is written, retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(importCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -46262,7 +46470,7 @@ function validateNestedStackShape(template, tree, parentStackName, nestedTemplat
 * is verified by unit test.
 */
 async function importNestedStackChildrenRecursive(args) {
-	const { parentStackName, parentRegion, parentNestedTemplates, parentTree, stateBackend, lockManager, providerRegistry, templateParser, lockOwner, accountId, logger } = args;
+	const { parentStackName, parentRegion, parentNestedTemplates, parentTree, stateBackend, lockManager, providerRegistry, templateParser, lockOwner, accountId, logger, assetRedirect } = args;
 	for (const [childLogicalId, childTreeNode] of parentTree.nested) {
 		const childStackName = `${parentStackName}~${childLogicalId}`;
 		const childRegion = parentRegion;
@@ -46270,6 +46478,7 @@ async function importNestedStackChildrenRecursive(args) {
 		if (!childTemplatePath) throw new Error(`cdkd import --migrate-from-cloudformation: missing nested-template path for '${childLogicalId}' under parent '${parentStackName}' — validateNestedStackShape should have rejected this; please file a bug.`);
 		logger.info(`Adopting nested stack '${childLogicalId}' as cdkd stack '${childStackName}' (${childRegion})...`);
 		const childTemplate = readNestedChildTemplate(childTemplatePath, childLogicalId);
+		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 		await lockManager.acquireLock(childStackName, childRegion, lockOwner, "import");
 		try {
 			const childResources = collectImportableResources(childTemplate);
@@ -46321,7 +46530,8 @@ async function importNestedStackChildrenRecursive(args) {
 				templateParser,
 				lockOwner,
 				accountId,
-				logger
+				logger,
+				assetRedirect
 			});
 		} finally {
 			await lockManager.releaseLock(childStackName, childRegion).catch((err) => {
@@ -55779,7 +55989,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.231.12");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.233.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());