@go-to-k/cdkd 0.232.0 → 0.234.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-uvVnteGl.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as resolveSkipPrefix, A as DiffCalculator, B as buildDockerImage, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as AssetManifestLoader, H as getDockerCmd, I as shouldRetainResource, J as synthesisStatusMessage, K as getDockerImageBySourceHash, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as resolveCaptureObservedState, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as runDockerForeground, V as formatDockerLoginError, W as runDockerStreaming, X as getLegacyStateBucketName, Y as getDefaultStateBucketName, Z as resolveApp, _ as green, a as withRetry, at as MIGRATE_TMP_PREFIX, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as AssemblyReader, d as isStatefulRecreateTargetSync, et as resolveStateBucketWithDefault, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as CFN_TEMPLATE_URL_LIMIT, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as warnDeprecatedNoPrefixCliFlag, o as isRetryableTransientError, ot as findLargeInlineResources, p as formatResourceLine, q as Synthesizer, r as DeployEngine, rt as CFN_TEMPLATE_BODY_LIMIT, s as IMPLICIT_DELETE_DEPENDENCIES, st as uploadCfnTemplate, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as resolveStateBucketWithDefaultAndSource, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveBucketRegion, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as WorkGraph } from "./deploy-engine-BkPZar1R.js";
+import { $ as AssetManifestLoader, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as buildDockerImage, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as runDockerStreaming, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as getDockerCmd, Y as formatDockerLoginError, Z as runDockerForeground, _ as green, _t as AssemblyReader, a as withRetry, at as resolveApp, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveStateBucketWithDefault, d as isStatefulRecreateTargetSync, dt as warnDeprecatedNoPrefixCliFlag, et as getDockerImageBySourceHash, f as renderStatefulReason, ft as CFN_TEMPLATE_BODY_LIMIT, g as gray, gt as uploadCfnTemplate, h as cyan, ht as findLargeInlineResources, i as withResourceDeadline, it as getLegacyStateBucketName, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveStateBucketWithDefaultAndSource, m as bold, mt as MIGRATE_TMP_PREFIX, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as synthesisStatusMessage, o as isRetryableTransientError, ot as resolveCaptureObservedState, p as formatResourceLine, pt as CFN_TEMPLATE_URL_LIMIT, q as parseBootstrapMarker, r as DeployEngine, rt as getDefaultStateBucketName, s as IMPLICIT_DELETE_DEPENDENCIES, st as resolveSkipPrefix, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as Synthesizer, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveUseCdkBootstrapAssets, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, yt as resolveBucketRegion, z as WorkGraph } from "./deploy-engine-Dj9mXUQa.js";
 import { t as ASGProvider } from "./asg-provider-Dd9Xze-T.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -492,6 +492,14 @@ const recreateViaSdkProviderOption = new Option("--recreate-via-sdk-provider <lo
 */
 const forceStatefulRecreationOption = new Option("--force-stateful-recreation", "Bypass the stateful-resource guard for --recreate-via-cc-api targets. Required when ANY named target is a stateful type (RDS / DynamoDB / EFS / S3 with data / Logs with retention / Cognito / Secrets / SSM / Glue / ECR / CloudFront / Kinesis / OpenSearch). Destroy + recreate loses ALL data in the resource — no automatic data migration. Triple-opt-in for CI use: --recreate-via-cc-api <id> --force-stateful-recreation --yes.").default(false);
 const replaceOption = new Option("--replace", "Replace (DELETE + CREATE) a resource whose in-place update is rejected because an immutable property changed and AWS exposes no update API for it (e.g. Lambda LayerVersion content, EFS AccessPoint, ECS TaskDefinition, ApiGatewayV2 immutable fields). Without this flag such a change fails the deploy. Stateful types (RDS / DynamoDB / EFS / S3 with data / Logs with retention / etc.) ALSO require --force-stateful-recreation since the replacement is a data-losing DELETE + CREATE.").default(false);
+/**
+* Issue #1002 PR 2 — per-invocation legacy pin for asset destinations
+* (design §4.2). Shared by `deploy`, `diff`, `import`, and `publish-assets`
+* (every command the redirection / rewrite affects) so the CLI surface stays
+* consistent; the per-app pin is `cdk.json context.cdkd.useCdkBootstrapAssets`
+* (see `resolveUseCdkBootstrapAssets` in config-loader.ts).
+*/
+const useCdkBootstrapAssetsOption = new Option("--use-cdk-bootstrap-assets", "Publish assets to the CDK bootstrap bucket/repo named by the asset manifest verbatim, skipping the cdkd asset-storage redirection even when this region is opted in via 'cdkd bootstrap'. For apps deployed via both CloudFormation and cdkd during a migration window. Per-app pin: cdk.json context.cdkd.useCdkBootstrapAssets. Also suppresses the legacy-mode 'cdk gc' notice.").default(false);
 const deployOptions = [
 	new Option("--concurrency <number>", "Maximum concurrent resource operations").default(10).argParser((value) => parseInt(value, 10)),
 	new Option("--stack-concurrency <number>", "Maximum concurrent stack deployments").default(4).argParser((value) => parseInt(value, 10)),
@@ -511,6 +519,7 @@ const deployOptions = [
 	recreateViaSdkProviderOption,
 	forceStatefulRecreationOption,
 	replaceOption,
+	useCdkBootstrapAssetsOption,
 	...resourceTimeoutOptions
 ];
 /**
@@ -598,310 +607,6 @@ const destroyOptions = [
 	allowUnsupportedTypesOption
 ];
 
-//#endregion
-//#region src/assets/asset-storage.ts
-/**
-* cdkd-owned asset storage — naming, bootstrap marker, and deploy-time
-* asset-mode detection (issue #1002, design at
-* docs/design/1002-cdkd-asset-storage.md).
-*
-* Why this exists: cdkd publishes assets to the CDK bootstrap bucket / ECR
-* repo, but `cdk gc` decides "in use" by scanning CloudFormation stack
-* templates — cdkd-deployed stacks have no CFn stack, so every cdkd-published
-* asset looks isolated and gets deleted. The fix is cdkd-owned asset storage
-* created by `cdkd bootstrap` (structurally out of `cdk gc`'s reach because
-* gc only discovers storage from the CDK bootstrap stack's outputs).
-*
-* The upgrade is strictly transparent: deploys behave byte-identically to
-* before until the user re-runs `cdkd bootstrap` for a region, which writes a
-* per-region marker object into the state bucket. Deploy reads the marker to
-* pick the mode; PR 2 of the phasing wires the actual publish redirection +
-* template rewrite onto the `cdkd-assets` mode resolved here.
-*/
-/** Marker schema version, bumped if the marker shape ever changes. */
-const ASSET_SUPPORT_VERSION = 1;
-/**
-* S3 key prefix for bootstrap markers in the state bucket. Deliberately
-* outside the `cdkd/` state prefix so `state list` key-listing never mistakes
-* a marker for a stack, and concurrent bootstraps in two regions cannot race
-* last-writer-wins on a shared object (design §12.1).
-*/
-const BOOTSTRAP_MARKER_PREFIX = "cdkd-bootstrap/";
-/**
-* Name of the cdkd-owned asset bucket for an (account, region) pair.
-* Per-region because Lambda requires the code bucket to be in the function's
-* region — the same reason CDK's asset bucket is per-region (design §3).
-*/
-function getCdkdAssetBucketName(accountId, region) {
-	return `cdkd-assets-${accountId}-${region}`;
-}
-/**
-* Name of the cdkd-owned container-asset ECR repository for an
-* (account, region) pair. ECR repos are account+region scoped by ARN, so the
-* suffix is not strictly needed — the CDK-parallel shape keeps the future
-* template rewrite uniform and the names self-describing (design §3).
-*/
-function getCdkdContainerRepoName(accountId, region) {
-	return `cdkd-container-assets-${accountId}-${region}`;
-}
-/**
-* State-bucket key of the bootstrap marker for a region.
-*/
-function getBootstrapMarkerKey(region) {
-	return `${BOOTSTRAP_MARKER_PREFIX}${region}.json`;
-}
-/**
-* Parse and validate a bootstrap marker body.
-*
-* Throws on malformed JSON or missing required fields — a corrupt marker is
-* treated like the marker-present-but-resources-missing case (hard error,
-* never a silent legacy fallback that would flip-flop stack properties
-* between deploys — design §4.1).
-*/
-function parseBootstrapMarker(body, markerKey) {
-	let parsed;
-	try {
-		parsed = JSON.parse(body);
-	} catch (error) {
-		throw new CdkdError(`Bootstrap marker '${markerKey}' in the state bucket is not valid JSON. Re-run 'cdkd bootstrap' for this region to rewrite it.`, "INVALID_BOOTSTRAP_MARKER", error);
-	}
-	const marker = parsed;
-	if (typeof marker.assetBucket !== "string" || marker.assetBucket.length === 0 || typeof marker.containerRepo !== "string" || marker.containerRepo.length === 0 || typeof marker.assetSupportVersion !== "number") throw new CdkdError(`Bootstrap marker '${markerKey}' in the state bucket is malformed (missing assetBucket / containerRepo / assetSupportVersion). Re-run 'cdkd bootstrap' for this region to rewrite it.`, "INVALID_BOOTSTRAP_MARKER");
-	if (marker.assetSupportVersion > 1) throw new CdkdError(`Bootstrap marker '${markerKey}' has assetSupportVersion ${marker.assetSupportVersion}, but this cdkd only understands up to ${1}. Upgrade cdkd to deploy in this region.`, "UNSUPPORTED_BOOTSTRAP_MARKER_VERSION");
-	return {
-		assetBucket: marker.assetBucket,
-		containerRepo: marker.containerRepo,
-		assetSupportVersion: marker.assetSupportVersion,
-		createdAt: typeof marker.createdAt === "string" ? marker.createdAt : ""
-	};
-}
-/**
-* Verify that the asset bucket + ECR repo named by a marker actually exist.
-*
-* Called when a marker is present: the user opted the region in, so missing
-* resources (user deleted them) are a hard error naming the missing resource
-* and the `cdkd bootstrap` fix — never a silent fallback to CDK bootstrap
-* storage (design §4.1).
-*
-* Every S3 call passes `ExpectedBucketOwner` so a marker pointing at a
-* since-recreated foreign bucket can never leak assets cross-account
-* (bucket-squatting defense, design §5).
-*/
-async function verifyAssetStorageExists(marker, accountId, region, opts = {}) {
-	const rebootstrapHint = `Run 'cdkd bootstrap --region ${region}' to recreate it. cdkd never silently falls back to CDK bootstrap asset storage once a region is opted in.`;
-	const clientOpts = {
-		region,
-		...opts.profile && { profile: opts.profile }
-	};
-	const s3Client = new S3Client(clientOpts);
-	const ecrClient = new ECRClient(clientOpts);
-	try {
-		try {
-			await s3Client.send(new HeadBucketCommand({
-				Bucket: marker.assetBucket,
-				ExpectedBucketOwner: accountId
-			}));
-		} catch (error) {
-			const err = error;
-			if (err.name === "NotFound" || err.name === "NoSuchBucket") throw new CdkdError(`cdkd asset storage is bootstrapped for region '${region}' but the asset bucket '${marker.assetBucket}' is missing. ${rebootstrapHint}`, "ASSET_STORAGE_MISSING");
-			if (err.$metadata?.httpStatusCode === 403) throw new CdkdError(`Asset bucket '${marker.assetBucket}' exists but is not owned by account ${accountId} (or access is denied). Refusing to use it. ${rebootstrapHint}`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
-			throw error;
-		}
-		try {
-			await ecrClient.send(new DescribeRepositoriesCommand({ repositoryNames: [marker.containerRepo] }));
-		} catch (error) {
-			if (error.name === "RepositoryNotFoundException") throw new CdkdError(`cdkd asset storage is bootstrapped for region '${region}' but the container-asset ECR repository '${marker.containerRepo}' is missing. ${rebootstrapHint}`, "ASSET_STORAGE_MISSING");
-			throw error;
-		}
-	} finally {
-		s3Client.destroy();
-		ecrClient.destroy();
-	}
-}
-/**
-* Create (or adopt, when already owned by this account) the cdkd asset
-* bucket + container-asset ECR repo for a region, then write the bootstrap
-* marker. Called by `cdkd bootstrap` unless `--no-assets` is passed.
-*
-* Idempotent like the state-bucket path: existing resources are left as-is
-* unless `force` re-applies their configuration. The marker is written LAST,
-* only after both resources exist (design §5) — a crash mid-bootstrap leaves
-* no marker, so deploys stay in legacy mode.
-*
-* Bucket-squatting defense: the bucket name is predictable (same weakness as
-* CDK's bootstrap bucket), so this refuses to adopt a bucket this account
-* does not own, and the `HeadBucket` probe passes `ExpectedBucketOwner`.
-*/
-async function ensureAssetStorage(options) {
-	const logger = getLogger();
-	const { s3Client, ecrClient, stateBackend, accountId, region, force } = options;
-	const assetBucket = getCdkdAssetBucketName(accountId, region);
-	const containerRepo = getCdkdContainerRepoName(accountId, region);
-	let bucketExists = false;
-	try {
-		await s3Client.send(new HeadBucketCommand({
-			Bucket: assetBucket,
-			ExpectedBucketOwner: accountId
-		}));
-		bucketExists = true;
-		logger.info(`Asset bucket ${assetBucket} already exists`);
-	} catch (error) {
-		const err = error;
-		if (err.name === "NotFound" || err.name === "NoSuchBucket") {} else if (err.$metadata?.httpStatusCode === 403) throw new CdkdError(`Asset bucket name '${assetBucket}' is already taken by a bucket this account does not own (or access is denied). Refusing to adopt it — resolve the naming conflict before re-running 'cdkd bootstrap'.`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
-		else throw normalizeAwsError(error, {
-			bucket: assetBucket,
-			operation: "HeadBucket"
-		});
-	}
-	if (!bucketExists) {
-		logger.info(`Creating asset bucket: ${assetBucket} in region ${region}`);
-		try {
-			await s3Client.send(new CreateBucketCommand({
-				Bucket: assetBucket,
-				...region !== "us-east-1" && { CreateBucketConfiguration: { LocationConstraint: region } }
-			}));
-			logger.info(`✓ Created asset bucket: ${assetBucket}`);
-		} catch (error) {
-			const err = error;
-			if (err.name === "BucketAlreadyOwnedByYou") logger.info(`Asset bucket ${assetBucket} already exists`);
-			else if (err.name === "BucketAlreadyExists") throw new CdkdError(`Asset bucket name '${assetBucket}' is already taken by another AWS account. Refusing to adopt it — resolve the naming conflict before re-running 'cdkd bootstrap'.`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
-			else throw normalizeAwsError(error, {
-				bucket: assetBucket,
-				operation: "CreateBucket"
-			});
-		}
-	}
-	if (!bucketExists || force) {
-		await s3Client.send(new PutBucketEncryptionCommand({
-			Bucket: assetBucket,
-			ExpectedBucketOwner: accountId,
-			ServerSideEncryptionConfiguration: { Rules: [{
-				ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
-				BucketKeyEnabled: true
-			}] }
-		}));
-		await s3Client.send(new PutPublicAccessBlockCommand({
-			Bucket: assetBucket,
-			ExpectedBucketOwner: accountId,
-			PublicAccessBlockConfiguration: {
-				BlockPublicAcls: true,
-				BlockPublicPolicy: true,
-				IgnorePublicAcls: true,
-				RestrictPublicBuckets: true
-			}
-		}));
-		await s3Client.send(new PutBucketPolicyCommand({
-			Bucket: assetBucket,
-			ExpectedBucketOwner: accountId,
-			Policy: JSON.stringify({
-				Version: "2012-10-17",
-				Statement: [{
-					Sid: "DenyExternalAccess",
-					Effect: "Deny",
-					Principal: "*",
-					Action: "s3:*",
-					Resource: [`arn:aws:s3:::${assetBucket}`, `arn:aws:s3:::${assetBucket}/*`],
-					Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
-				}]
-			})
-		}));
-		logger.info("✓ Configured asset bucket (AES-256 encryption, public access block, deny external access)");
-	}
-	let repoExists = false;
-	try {
-		await ecrClient.send(new DescribeRepositoriesCommand({ repositoryNames: [containerRepo] }));
-		repoExists = true;
-		logger.info(`Container-asset repository ${containerRepo} already exists`);
-	} catch (error) {
-		if (error.name !== "RepositoryNotFoundException") throw error;
-	}
-	if (!repoExists) {
-		logger.info(`Creating container-asset ECR repository: ${containerRepo}`);
-		try {
-			await ecrClient.send(new CreateRepositoryCommand({
-				repositoryName: containerRepo,
-				imageTagMutability: "IMMUTABLE"
-			}));
-			logger.info(`✓ Created container-asset ECR repository: ${containerRepo}`);
-		} catch (error) {
-			if (error.name === "RepositoryAlreadyExistsException") logger.info(`Container-asset repository ${containerRepo} already exists`);
-			else throw error;
-		}
-	} else if (force) {
-		await ecrClient.send(new PutImageTagMutabilityCommand({
-			repositoryName: containerRepo,
-			imageTagMutability: "IMMUTABLE"
-		}));
-		logger.info("✓ Configured container-asset repository (immutable tags)");
-	}
-	const marker = {
-		assetBucket,
-		containerRepo,
-		assetSupportVersion: 1,
-		createdAt: (/* @__PURE__ */ new Date()).toISOString()
-	};
-	await stateBackend.putRawObject(getBootstrapMarkerKey(region), JSON.stringify(marker, null, 2));
-	logger.info(`✓ Wrote bootstrap marker (${getBootstrapMarkerKey(region)})`);
-	return {
-		assetBucket,
-		containerRepo
-	};
-}
-/**
-* Deploy-time asset-mode resolver. One instance per CLI invocation; results
-* are cached per region for the process lifetime (the marker read is one
-* GetObject against a bucket every deploy already reads — design §4.1).
-*
-* In legacy mode, one `logger.info` line per invocation mentions the
-* `cdk gc` hazard and the `cdkd bootstrap` opt-in (info, not warn — existing
-* users are not doing anything wrong; design §12.2).
-*/
-var AssetModeResolver = class {
-	logger = getLogger().child("AssetMode");
-	cache = /* @__PURE__ */ new Map();
-	legacyNoticeShown = false;
-	stateBackend;
-	accountId;
-	profile;
-	constructor(stateBackend, accountId, opts = {}) {
-		this.stateBackend = stateBackend;
-		this.accountId = accountId;
-		this.profile = opts.profile;
-	}
-	/**
-	* Resolve the asset mode for a deploy region. Concurrent callers for the
-	* same region share one in-flight resolution.
-	*/
-	resolve(region) {
-		const cached = this.cache.get(region);
-		if (cached) return cached;
-		const inFlight = this.doResolve(region).catch((error) => {
-			this.cache.delete(region);
-			throw error;
-		});
-		this.cache.set(region, inFlight);
-		return inFlight;
-	}
-	async doResolve(region) {
-		const markerKey = getBootstrapMarkerKey(region);
-		const body = await this.stateBackend.getRawObject(markerKey);
-		if (body === null) {
-			if (!this.legacyNoticeShown) {
-				this.legacyNoticeShown = true;
-				this.logger.info("Assets are published to the CDK bootstrap bucket/repo, which 'cdk gc' may garbage-collect (cdkd-deployed stacks have no CloudFormation stack for gc to scan). Run 'cdkd bootstrap' to create cdkd-owned asset storage that 'cdk gc' never touches.");
-			}
-			return { mode: "legacy" };
-		}
-		const marker = parseBootstrapMarker(body, markerKey);
-		await verifyAssetStorageExists(marker, this.accountId, region, { ...this.profile && { profile: this.profile } });
-		this.logger.debug(`cdkd asset storage active for region '${region}': ${marker.assetBucket} / ${marker.containerRepo}`);
-		return {
-			mode: "cdkd-assets",
-			marker
-		};
-	}
-};
-
 //#endregion
 //#region src/cli/commands/bootstrap.ts
 /**
@@ -1795,7 +1500,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.232.0";
+	return "0.234.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -37119,7 +36824,7 @@ var NestedStackProvider = class {
 		this.requireDeployContext(ctx, "create");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
 		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${logicalId}' under parent '${ctx.parentStackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default).`);
-		const childTemplate = this.readChildTemplate(childTemplatePath);
+		const childTemplate = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
 		const childRegion = ctx.parentRegion;
 		const childParameters = this.extractParameters(properties);
@@ -37138,7 +36843,7 @@ var NestedStackProvider = class {
 		this.requireDeployContext(ctx, "update");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
 		if (!childTemplatePath) throw new Error(`Nested template file not found for AWS::CloudFormation::Stack '${logicalId}' on update.`);
-		const childTemplate = this.readChildTemplate(childTemplatePath);
+		const childTemplate = this.readChildTemplate(childTemplatePath, ctx.assetRedirect);
 		const childStackName = this.deriveChildStackName(ctx.parentStackName, logicalId);
 		const childRegion = ctx.parentRegion;
 		const childParameters = this.extractParameters(properties);
@@ -37233,18 +36938,24 @@ var NestedStackProvider = class {
 		else throw new Error(`NestedStackProvider: child Parameter '${k}' resolved to a non-scalar value (type=${v === null ? "null" : typeof v}). Parameters must be scalars (string / number / boolean) by the time they reach the provider — an unresolved intrinsic here means IntrinsicFunctionResolver upstream did not handle the value, which is a bug. Surface the unresolved input rather than silently coercing to '[object Object]'.`);
 		return result;
 	}
-	readChildTemplate(templatePath) {
+	readChildTemplate(templatePath, assetRedirect) {
 		let raw;
 		try {
 			raw = fs.readFileSync(templatePath, "utf-8");
 		} catch (err) {
 			throw new Error(`Failed to read nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		let template;
 		try {
-			return JSON.parse(raw);
+			template = JSON.parse(raw);
 		} catch (err) {
 			throw new Error(`Failed to parse nested template at ${templatePath}: ${err instanceof Error ? err.message : String(err)}`);
 		}
+		if (assetRedirect) {
+			const n = rewriteTemplateAssetReferences(template, assetRedirect);
+			if (n > 0) this.logger.debug(`Rewrote ${n} asset reference(s) to cdkd asset storage in nested template ${templatePath}`);
+		}
+		return template;
 	}
 	indexGrandchildTemplates(childTemplate, childTemplatePath) {
 		const dir = path.dirname(childTemplatePath);
@@ -37994,7 +37705,11 @@ async function deployCommand(stacks, options) {
 		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 		stsClient.destroy();
 		const assetPublisher = new AssetPublisher();
-		const assetModeResolver = new AssetModeResolver(preflightStateBackend, accountId, { ...options.profile && { profile: options.profile } });
+		const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
+		const assetModeResolver = new AssetModeResolver(preflightStateBackend, accountId, {
+			...options.profile && { profile: options.profile },
+			...useCdkBootstrapAssets && { useCdkBootstrapAssets: true }
+		});
 		const stateConfig = {
 			bucket: stateBucket,
 			prefix: options.statePrefix
@@ -38008,27 +37723,36 @@ async function deployCommand(stacks, options) {
 		};
 		const workGraph = new WorkGraph();
 		const stackMap = new Map(targetStacks.map((s) => [s.stackName, s]));
+		const stackRedirects = /* @__PURE__ */ new Map();
 		for (const stack of targetStacks) {
 			const stackNodeId = `stack:${stack.stackName}`;
 			const stackDeps = /* @__PURE__ */ new Set();
-			if (!options.skipAssets && stack.assetManifestPath) {
+			if (stack.assetManifestPath) {
 				const assetRegion = stack.region || baseRegion;
-				let nodeIds = [];
-				try {
-					nodeIds = assetPublisher.addAssetsToGraph(workGraph, stack.assetManifestPath, {
-						accountId,
-						region: assetRegion,
-						...options.profile && { profile: options.profile },
-						nodePrefix: `${stack.stackName}:`
-					});
-				} catch (error) {
-					if (error.code !== "ENOENT") throw error;
-				}
-				if (nodeIds.length > 0) {
+				const manifest = loadPublishableAssetManifest(stack.assetManifestPath);
+				if (manifest) {
 					const assetMode = await assetModeResolver.resolve(assetRegion);
 					logger.debug(`Asset mode for region ${assetRegion}: ${assetMode.mode} (stack ${stack.stackName})`);
+					let redirect;
+					if (assetMode.mode === "cdkd-assets") {
+						redirect = buildAssetRedirectMap(manifest, assetMode.marker, accountId, assetRegion);
+						if (redirect.entries.length > 0) {
+							stackRedirects.set(stack.stackName, redirect);
+							const rewritten = rewriteTemplateAssetReferences(stack.template, redirect);
+							logger.debug(`Rewrote ${rewritten} asset reference(s) to cdkd asset storage (${assetMode.marker.assetBucket} / ${assetMode.marker.containerRepo}) in template of stack ${stack.stackName}`);
+						} else redirect = void 0;
+					}
+					if (!options.skipAssets) {
+						const nodeIds = assetPublisher.addAssetsToGraph(workGraph, stack.assetManifestPath, {
+							accountId,
+							region: assetRegion,
+							...options.profile && { profile: options.profile },
+							nodePrefix: `${stack.stackName}:`,
+							...redirect && { redirect }
+						});
+						for (const id of nodeIds) stackDeps.add(id);
+					}
 				}
-				for (const id of nodeIds) stackDeps.add(id);
 			}
 			for (const depName of effectiveStackDeps(stack.stackName, stack.dependencyNames)) if (stackMap.has(depName)) stackDeps.add(`stack:${depName}`);
 			workGraph.addNode({
@@ -38127,10 +37851,12 @@ async function deployCommand(stacks, options) {
 						})) return;
 					}
 				}
+				const assetRedirect = stackRedirects.get(stackInfo.stackName);
 				const deployEngineOptions = {
 					concurrency: options.concurrency,
 					dryRun: options.dryRun,
 					noRollback: !options.rollback,
+					...assetRedirect && { assetRedirect },
 					...eventRecorder && { eventRecorder },
 					...recreateViaCcApiTargets && recreateViaCcApiTargets.size > 0 && { recreateViaCcApiTargets },
 					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
@@ -38156,7 +37882,8 @@ async function deployCommand(stacks, options) {
 					nestedTemplates: stackInfo.nestedTemplates ?? {},
 					dagBuilder,
 					diffCalculator,
-					options: deployEngineOptions
+					options: deployEngineOptions,
+					...assetRedirect && { assetRedirect }
 				}, () => stackDeployEngine.deploy(stackInfo.stackName, stackInfo.template));
 				logger.info(`\n${bold("Deployment Summary:")}`);
 				logger.info(`  Stack: ${bold(cyan(deployResult.stackName))}`);
@@ -39194,7 +38921,7 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parameters, assetRedirect } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
 	const node = {
 		stackName,
@@ -39213,6 +38940,7 @@ async function buildDiffTree(args) {
 		if (!childTemplatePath) throw new Error(`Nested template file not found for ${NESTED_STACK_RESOURCE_TYPE} '${logicalId}' under stack '${stackName}'. Verify the synth output emits Metadata['aws:asset:path'] on this resource (CDK 2.x cdk.NestedStack does so by default), then re-run synth.`);
 		const childStackName = `${stackName}~${logicalId}`;
 		const childTemplate = readNestedTemplate(childTemplatePath);
+		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 		const grandchildTemplates = indexNestedChildTemplates(childTemplate, childTemplatePath);
 		const childParameters = await resolveChildStackParameters(resource, template, state, region, stackName, stateBackend, parameters);
 		node.children.push(await buildDiffTree({
@@ -39224,7 +38952,8 @@ async function buildDiffTree(args) {
 			recursive: true,
 			stateBackend,
 			diffCalculator,
-			parameters: childParameters
+			parameters: childParameters,
+			...assetRedirect && { assetRedirect }
 		}));
 	}
 	for (const [logicalId, resource] of Object.entries(state.resources)) {
@@ -39534,10 +39263,22 @@ async function diffCommand(stacks, options) {
 		});
 		const diffCalculator = new DiffCalculator();
 		const recursive = options.recursive ?? false;
+		const resolveAssetRedirect = createAssetRedirectResolver({
+			stateBackend,
+			stsRegion: region,
+			...options.profile && { profile: options.profile },
+			useCdkBootstrapAssets: resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets),
+			suppressLegacyNotice: true
+		});
 		const trees = [];
 		for (const stackInfo of targetStacks) {
 			logger.info(`\nCalculating diff for stack: ${stackInfo.stackName}`);
 			const stackRegion = stackInfo.region || region;
+			const assetRedirect = await resolveAssetRedirect(stackInfo.assetManifestPath, stackRegion);
+			if (assetRedirect) {
+				const rewritten = rewriteTemplateAssetReferences(stackInfo.template, assetRedirect);
+				logger.debug(`Rewrote ${rewritten} asset reference(s) to cdkd asset storage in template of stack ${stackInfo.stackName}`);
+			}
 			trees.push(await buildDiffTree({
 				stackName: stackInfo.stackName,
 				displayName: stackInfo.stackName,
@@ -39546,7 +39287,8 @@ async function diffCommand(stacks, options) {
 				nestedTemplates: stackInfo.nestedTemplates ?? {},
 				recursive,
 				stateBackend,
-				diffCalculator
+				diffCalculator,
+				...assetRedirect && { assetRedirect }
 			}));
 		}
 		if (options.json) process.stdout.write(`${JSON.stringify(trees.map(diffTreeToJson), null, 2)}\n`);
@@ -39566,7 +39308,7 @@ async function diffCommand(stacks, options) {
 * Create diff command
 */
 function createDiffCommand() {
-	const cmd = new Command("diff").description("Show difference between current state and desired state").argument("[stacks...]", "Stack name(s) to diff. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Diff all stacks", false).option("--recursive", "Recurse into each AWS::CloudFormation::Stack row and diff every nested-stack child against its own deployed state (DFS order). Default is non-recursive, matching cdk diff.", false).option("--fail", "Exit with code 1 when any change is detected (matches cdk diff --fail). With --recursive, considers the whole nested-stack tree.", false).option("--json", "Output the diff as JSON (nested tree shape when combined with --recursive)", false).action(withErrorHandling(diffCommand));
+	const cmd = new Command("diff").description("Show difference between current state and desired state").argument("[stacks...]", "Stack name(s) to diff. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards (e.g. 'MyStage/*').").option("--all", "Diff all stacks", false).option("--recursive", "Recurse into each AWS::CloudFormation::Stack row and diff every nested-stack child against its own deployed state (DFS order). Default is non-recursive, matching cdk diff.", false).option("--fail", "Exit with code 1 when any change is detected (matches cdk diff --fail). With --recursive, considers the whole nested-stack tree.", false).option("--json", "Output the diff as JSON (nested tree shape when combined with --recursive)", false).addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(diffCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -41859,36 +41601,45 @@ async function publishAssetsCommand(stacks, options) {
 	const stsClient = new STSClient({ region: baseRegion });
 	const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
 	stsClient.destroy();
+	const useCdkBootstrapAssets = resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets);
+	let markerAccess;
+	const getModeResolver = async () => {
+		if (markerAccess !== void 0) return markerAccess?.resolver ?? null;
+		let bucket;
+		try {
+			bucket = await resolveStateBucketWithDefault(options.stateBucket, baseRegion);
+		} catch {
+			logger.info("No cdkd state bucket found — publishing to the asset-manifest destinations (CDK bootstrap storage) verbatim. Run 'cdkd bootstrap' to opt into cdkd-owned asset storage that 'cdk gc' never touches.");
+			markerAccess = null;
+			return null;
+		}
+		const markerClients = new AwsClients({
+			region: baseRegion,
+			...options.profile && { profile: options.profile }
+		});
+		const resolver = new AssetModeResolver(new S3StateBackend(markerClients.s3, {
+			bucket,
+			prefix: options.statePrefix
+		}, {
+			region: baseRegion,
+			...options.profile && { profile: options.profile }
+		}), accountId, { ...options.profile && { profile: options.profile } });
+		markerAccess = {
+			resolver,
+			dispose: () => markerClients.destroy()
+		};
+		return resolver;
+	};
 	const assetPublisher = new AssetPublisher();
 	const results = [];
-	for (const stack of targetStacks) {
-		const startedAt = Date.now();
-		let assetCount = 0;
-		let error;
-		try {
-			if (!stack.assetManifestPath) {
-				logger.debug(`Stack ${stack.stackName} has no asset manifest; nothing to publish`);
-				results.push({
-					stackName: stack.stackName,
-					displayName: stack.displayName,
-					assetCount: 0,
-					durationMs: Date.now() - startedAt
-				});
-				continue;
-			}
-			logger.info(`\nPublishing assets for stack: ${describeStack(stack)}`);
-			const workGraph = new WorkGraph();
-			let nodeIds = [];
+	try {
+		for (const stack of targetStacks) {
+			const startedAt = Date.now();
+			let assetCount = 0;
+			let error;
 			try {
-				nodeIds = assetPublisher.addAssetsToGraph(workGraph, stack.assetManifestPath, {
-					accountId,
-					region: stack.region || baseRegion,
-					...options.profile && { profile: options.profile },
-					nodePrefix: `${stack.stackName}:`
-				});
-			} catch (err) {
-				if (err.code === "ENOENT") {
-					logger.debug(`Asset manifest not found for ${stack.stackName} (${stack.assetManifestPath}); skipping`);
+				if (!stack.assetManifestPath) {
+					logger.debug(`Stack ${stack.stackName} has no asset manifest; nothing to publish`);
 					results.push({
 						stackName: stack.stackName,
 						displayName: stack.displayName,
@@ -41897,36 +41648,76 @@ async function publishAssetsCommand(stacks, options) {
 					});
 					continue;
 				}
-				throw err;
-			}
-			assetCount = nodeIds.filter((id) => id.startsWith("asset-publish:")).length;
-			if (assetCount === 0) {
-				logger.info("  (no assets to publish)");
-				results.push({
-					stackName: stack.stackName,
-					displayName: stack.displayName,
-					assetCount: 0,
-					durationMs: Date.now() - startedAt
-				});
-				continue;
+				logger.info(`\nPublishing assets for stack: ${describeStack(stack)}`);
+				let redirect;
+				if (!useCdkBootstrapAssets) {
+					const manifest = loadPublishableAssetManifest(stack.assetManifestPath);
+					if (manifest) {
+						const modeResolver = await getModeResolver();
+						if (modeResolver) {
+							const stackRegion = stack.region || baseRegion;
+							const assetMode = await modeResolver.resolve(stackRegion);
+							if (assetMode.mode === "cdkd-assets") {
+								const map = buildAssetRedirectMap(manifest, assetMode.marker, accountId, stackRegion);
+								if (map.entries.length > 0) redirect = map;
+							}
+						}
+					}
+				}
+				const workGraph = new WorkGraph();
+				let nodeIds = [];
+				try {
+					nodeIds = assetPublisher.addAssetsToGraph(workGraph, stack.assetManifestPath, {
+						accountId,
+						region: stack.region || baseRegion,
+						...options.profile && { profile: options.profile },
+						nodePrefix: `${stack.stackName}:`,
+						...redirect && { redirect }
+					});
+				} catch (err) {
+					if (err.code === "ENOENT") {
+						logger.debug(`Asset manifest not found for ${stack.stackName} (${stack.assetManifestPath}); skipping`);
+						results.push({
+							stackName: stack.stackName,
+							displayName: stack.displayName,
+							assetCount: 0,
+							durationMs: Date.now() - startedAt
+						});
+						continue;
+					}
+					throw err;
+				}
+				assetCount = nodeIds.filter((id) => id.startsWith("asset-publish:")).length;
+				if (assetCount === 0) {
+					logger.info("  (no assets to publish)");
+					results.push({
+						stackName: stack.stackName,
+						displayName: stack.displayName,
+						assetCount: 0,
+						durationMs: Date.now() - startedAt
+					});
+					continue;
+				}
+				await workGraph.execute({
+					"asset-build": options.imageBuildConcurrency,
+					"asset-publish": options.assetPublishConcurrency,
+					stack: 0
+				}, (node) => assetPublisher.executeNode(node));
+				logger.info(`  ✓ Published ${assetCount} asset(s) in ${((Date.now() - startedAt) / 1e3).toFixed(2)}s`);
+			} catch (err) {
+				error = err instanceof Error ? err : new Error(String(err));
+				logger.error(`  ✗ ${stack.stackName}: ${error.message}`);
 			}
-			await workGraph.execute({
-				"asset-build": options.imageBuildConcurrency,
-				"asset-publish": options.assetPublishConcurrency,
-				stack: 0
-			}, (node) => assetPublisher.executeNode(node));
-			logger.info(`  ✓ Published ${assetCount} asset(s) in ${((Date.now() - startedAt) / 1e3).toFixed(2)}s`);
-		} catch (err) {
-			error = err instanceof Error ? err : new Error(String(err));
-			logger.error(`  ✗ ${stack.stackName}: ${error.message}`);
-		}
-		results.push({
-			stackName: stack.stackName,
-			displayName: stack.displayName,
-			assetCount,
-			durationMs: Date.now() - startedAt,
-			...error && { error }
-		});
+			results.push({
+				stackName: stack.stackName,
+				displayName: stack.displayName,
+				assetCount,
+				durationMs: Date.now() - startedAt,
+				...error && { error }
+			});
+		}
+	} finally {
+		markerAccess?.dispose();
 	}
 	const failed = results.filter((r) => r.error);
 	const totalAssets = results.reduce((sum, r) => sum + r.assetCount, 0);
@@ -41949,11 +41740,12 @@ async function publishAssetsCommand(stacks, options) {
 * `cdkd deploy --no-asset-publish` (which doesn't exist).
 */
 function createPublishAssetsCommand() {
-	const cmd = new Command("publish-assets").description("Synthesize the CDK app and publish assets to S3/ECR for the selected stack(s) without deploying").argument("[stacks...]", "Stack name(s) to publish assets for. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards.").option("--all", "Publish assets for all stacks", false).addOption(new Option("--asset-publish-concurrency <number>", "Maximum concurrent asset publish operations").default(8).argParser((value) => parseInt(value, 10))).addOption(new Option("--image-build-concurrency <number>", "Maximum concurrent Docker image builds").default(4).argParser((value) => parseInt(value, 10))).action(withErrorHandling(publishAssetsCommand));
+	const cmd = new Command("publish-assets").description("Synthesize the CDK app and publish assets to S3/ECR for the selected stack(s) without deploying").argument("[stacks...]", "Stack name(s) to publish assets for. Accepts physical CloudFormation names (e.g. 'MyStage-Api') or CDK display paths (e.g. 'MyStage/Api'). Supports wildcards.").option("--all", "Publish assets for all stacks", false).addOption(new Option("--asset-publish-concurrency <number>", "Maximum concurrent asset publish operations").default(8).argParser((value) => parseInt(value, 10))).addOption(new Option("--image-build-concurrency <number>", "Maximum concurrent Docker image builds").default(4).argParser((value) => parseInt(value, 10))).addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(publishAssetsCommand));
 	[
 		...commonOptions,
 		...appOptions,
-		...contextOptions
+		...contextOptions,
+		...stateOptions
 	].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(new Option("--stack <name>", "Stack name to publish (alternative to positional)"));
 	cmd.addOption(deprecatedRegionOption);
@@ -45977,6 +45769,17 @@ async function importCommand(stackArg, options) {
 		else throw new Error(`Multiple stacks found: ${result.stacks.map((s) => s.stackName).join(", ")}. Specify the stack name as a positional argument.`);
 		const targetRegion = stackInfo.region || region;
 		logger.info(`Target stack: ${stackInfo.stackName} (${targetRegion})`);
+		const assetRedirect = await createAssetRedirectResolver({
+			stateBackend,
+			stsRegion: region,
+			...options.profile && { profile: options.profile },
+			useCdkBootstrapAssets: resolveUseCdkBootstrapAssets(options.useCdkBootstrapAssets),
+			suppressLegacyNotice: true
+		})(stackInfo.assetManifestPath, targetRegion);
+		if (assetRedirect) {
+			const rewritten = rewriteTemplateAssetReferences(stackInfo.template, assetRedirect);
+			logger.debug(`Rewrote ${rewritten} asset reference(s) to cdkd asset storage in template of stack ${stackInfo.stackName}`);
+		}
 		const overrides = parseResourceOverrides(options.resource, options.resourceMapping, options.resourceMappingInline);
 		if (overrides.size > 0) logger.debug(`User-supplied physical IDs: ${[...overrides.keys()].join(", ")}`);
 		const migrationCfnStackName = options.migrateFromCloudformation ? typeof options.migrateFromCloudformation === "string" && options.migrateFromCloudformation.length > 0 ? options.migrateFromCloudformation : stackInfo.stackName : void 0;
@@ -46113,7 +45916,8 @@ async function importCommand(stackArg, options) {
 				templateParser,
 				lockOwner: owner,
 				accountId: accountIdForNestedSynth,
-				logger
+				logger,
+				assetRedirect
 			});
 			if (migrationCfnStackName) {
 				const orphaned = resources.length - importedRows.length;
@@ -46528,7 +46332,7 @@ async function confirmPrompt(prompt) {
 *      default behavior, now opt-in.
 */
 function createImportCommand() {
-	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource via the aws:cdk:path tag. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to also tag-import the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also tag-import everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / tag-based auto-lookup), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the tag-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO tag-import every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "After cdkd state is written, retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").action(withErrorHandling(importCommand));
+	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource via the aws:cdk:path tag. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to also tag-import the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also tag-import everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / tag-based auto-lookup), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the tag-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO tag-import every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "After cdkd state is written, retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(importCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -46666,7 +46470,7 @@ function validateNestedStackShape(template, tree, parentStackName, nestedTemplat
 * is verified by unit test.
 */
 async function importNestedStackChildrenRecursive(args) {
-	const { parentStackName, parentRegion, parentNestedTemplates, parentTree, stateBackend, lockManager, providerRegistry, templateParser, lockOwner, accountId, logger } = args;
+	const { parentStackName, parentRegion, parentNestedTemplates, parentTree, stateBackend, lockManager, providerRegistry, templateParser, lockOwner, accountId, logger, assetRedirect } = args;
 	for (const [childLogicalId, childTreeNode] of parentTree.nested) {
 		const childStackName = `${parentStackName}~${childLogicalId}`;
 		const childRegion = parentRegion;
@@ -46674,6 +46478,7 @@ async function importNestedStackChildrenRecursive(args) {
 		if (!childTemplatePath) throw new Error(`cdkd import --migrate-from-cloudformation: missing nested-template path for '${childLogicalId}' under parent '${parentStackName}' — validateNestedStackShape should have rejected this; please file a bug.`);
 		logger.info(`Adopting nested stack '${childLogicalId}' as cdkd stack '${childStackName}' (${childRegion})...`);
 		const childTemplate = readNestedChildTemplate(childTemplatePath, childLogicalId);
+		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 		await lockManager.acquireLock(childStackName, childRegion, lockOwner, "import");
 		try {
 			const childResources = collectImportableResources(childTemplate);
@@ -46725,7 +46530,8 @@ async function importNestedStackChildrenRecursive(args) {
 				templateParser,
 				lockOwner,
 				accountId,
-				logger
+				logger,
+				assetRedirect
 			});
 		} finally {
 			await lockManager.releaseLock(childStackName, childRegion).catch((err) => {
@@ -48070,6 +47876,28 @@ function buildSubstitutionContextFromImageContext(context) {
 	return subContext;
 }
 /**
+* A container-image URI that points at a CDK-bootstrap OR cdkd-owned assets
+* ECR repository:
+*
+*   - `cdk-<qualifier>-container-assets-<acct>-<region>` — the CDK bootstrap
+*     repo (default qualifier `hnb659fds`, or a custom `cdk bootstrap
+*     --qualifier` value);
+*   - `cdkd-container-assets-<acct>-<region>` — the repo `cdkd bootstrap`
+*     creates and `cdkd deploy` publishes into once a bootstrap marker exists
+*     (issue #1002; a migrated stack's template / `--from-state` state carries
+*     this shape).
+*
+* Either is a CDK asset image the ECS runner resolves back to the on-disk
+* `cdk.out` build, so both must classify as `kind: 'cdk-asset'`. The `cdk-`
+* qualifier is generalized to `[a-z0-9]+` so a custom-qualifier bootstrap is
+* matched too (previously only the hardcoded `hnb659fds` default was).
+*/
+const CDK_ASSET_IMAGE_REPO_RE = /(?:cdk-[a-z0-9]+|cdkd)-container-assets-/;
+/** True when `uri` embeds a CDK-bootstrap or cdkd-owned container-assets repo. */
+function isCdkAssetImageUri(uri) {
+	return CDK_ASSET_IMAGE_REPO_RE.test(uri);
+}
+/**
 * Parse the `Image` field of an ECS container definition.
 *
 * Three shapes:
@@ -48109,7 +47937,7 @@ function parseContainerImage(raw, containerName, taskLogicalId, resources, _stac
 	if (joinResolved.kind === "unsupported-join") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unsupported Fn::Join Image shape: ${joinResolved.reason}. cdkd local run-task recognizes the canonical CDK 2.x ContainerImage.fromEcrRepository Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
 	const flat = extractImageString(raw);
 	if (!flat) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unparseable Image property. cdkd local run-task v1 supports flat string images, single-key Fn::Sub bodies, and CDK-asset Image references.`);
-	if (flat.includes("cdk-hnb659fds-container-assets-")) {
+	if (isCdkAssetImageUri(flat)) {
 		const hashMatch = /:([a-f0-9]{8,})$/.exec(flat);
 		const out = { kind: "cdk-asset" };
 		if (hashMatch) out.assetHash = hashMatch[1];
@@ -48157,7 +47985,7 @@ function findUnresolvedEcrRepositoryRef(substituted, resources) {
 * `Fn::GetAtt` path can share the regex-match branches.
 */
 function classifyResolvedImage(uri) {
-	if (uri.includes("cdk-hnb659fds-container-assets-")) {
+	if (isCdkAssetImageUri(uri)) {
 		const hashMatch = /:([a-f0-9]{8,})$/.exec(uri);
 		const out = { kind: "cdk-asset" };
 		if (hashMatch) out.assetHash = hashMatch[1];
@@ -56183,7 +56011,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.232.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.234.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());