@go-to-k/cdkd 0.232.0 → 0.234.0

package/dist/{deploy-engine-BkPZar1R.js → deploy-engine-Dj9mXUQa.js}

@@ -1,7 +1,7 @@
 import { B as generateResourceName, E as SynthesisError, F as getLiveRenderer, M as getLogger, S as ResourceUpdateNotSupportedError, T as StateError, U as withStackName, V as generateResourceNameWithFallback, a as normalizeAwsTagsToCfn, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, s as assertRegionMatch, t as disableInstanceApiTermination, x as ResourceTimeoutError, z as applyDefaultNameForFallback } from "./ec2-termination-protection-uvVnteGl.js";
 import { r as getAwsClients } from "./aws-clients-pjPwZz1r.js";
 import { randomUUID } from "node:crypto";
-import { DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { CloudControlClient, CreateResourceCommand, DeleteResourceCommand, GetResourceCommand, GetResourceRequestStatusCommand, ListResourcesCommand, UpdateResourceCommand } from "@aws-sdk/client-cloudcontrol";
 import { AttachRolePolicyCommand, CreateRoleCommand, DeleteRoleCommand, DeleteRolePermissionsBoundaryCommand, DeleteRolePolicyCommand, DetachRolePolicyCommand, GetRoleCommand, GetRolePolicyCommand, IAMClient, ListAttachedRolePoliciesCommand, ListInstanceProfilesForRoleCommand, ListRolePoliciesCommand, ListRoleTagsCommand, ListRolesCommand, NoSuchEntityException, PutRolePermissionsBoundaryCommand, PutRolePolicyCommand, RemoveRoleFromInstanceProfileCommand, TagRoleCommand, UntagRoleCommand, UpdateAssumeRolePolicyCommand, UpdateRoleCommand } from "@aws-sdk/client-iam";
 import { PublishCommand, SNSClient } from "@aws-sdk/client-sns";
@@ -24,7 +24,7 @@ import { DescribeListenersCommand, DescribeLoadBalancersCommand, ElasticLoadBala
 import { KMSClient, ListAliasesCommand } from "@aws-sdk/client-kms";
 import { readFile } from "fs/promises";
 import { join as join$1 } from "path";
-import { DescribeImagesCommand as DescribeImagesCommand$1, ECRClient, GetAuthorizationTokenCommand } from "@aws-sdk/client-ecr";
+import { CreateRepositoryCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, PutImageTagMutabilityCommand } from "@aws-sdk/client-ecr";
 import { hostname } from "os";
 import graphlib from "graphlib";
 import { DescribeDBClustersCommand, DescribeDBInstancesCommand, RDSClient } from "@aws-sdk/client-rds";
@@ -1774,6 +1774,22 @@ function resolveCaptureObservedState(cliValue) {
 	return true;
 }
 /**
+* Resolve the effective `--use-cdk-bootstrap-assets` value (issue #1002
+* PR 2, design §4.2): pin legacy asset destinations for one app even when
+* the region's bootstrap marker exists — for apps deployed via both
+* CloudFormation and cdkd during a migration window.
+*
+* Priority: CLI flag (`true` wins) > `cdk.json context.cdkd.useCdkBootstrapAssets`
+* (boolean) > default `false`. The CLI flag has no `--no-` negation form, so
+* a cdk.json `true` can only be overruled by removing the context entry —
+* matching the "per-app pin" semantics (the app is CFn-co-deployed or it
+* isn't; per-invocation flip-flop would churn stack properties).
+*/
+function resolveUseCdkBootstrapAssets(cliValue) {
+	if (cliValue === true) return true;
+	return (loadCdkJson()?.context?.["cdkd"])?.["useCdkBootstrapAssets"] === true;
+}
+/**
 * Pre-parse argv walk that surfaces the deprecation warning when the
 * user explicitly passes the legacy `--no-prefix-user-supplied-names`
 * flag. Commander's auto-negation of `--prefix-user-supplied-names`
@@ -2896,6 +2912,705 @@ var DockerAssetPublisher = class {
 	}
 };
 
+//#endregion
+//#region src/assets/asset-storage.ts
+/**
+* cdkd-owned asset storage — naming, bootstrap marker, and deploy-time
+* asset-mode detection (issue #1002, design at
+* docs/design/1002-cdkd-asset-storage.md).
+*
+* Why this exists: cdkd publishes assets to the CDK bootstrap bucket / ECR
+* repo, but `cdk gc` decides "in use" by scanning CloudFormation stack
+* templates — cdkd-deployed stacks have no CFn stack, so every cdkd-published
+* asset looks isolated and gets deleted. The fix is cdkd-owned asset storage
+* created by `cdkd bootstrap` (structurally out of `cdk gc`'s reach because
+* gc only discovers storage from the CDK bootstrap stack's outputs).
+*
+* The upgrade is strictly transparent: deploys behave byte-identically to
+* before until the user re-runs `cdkd bootstrap` for a region, which writes a
+* per-region marker object into the state bucket. Deploy reads the marker to
+* pick the mode; PR 2 of the phasing wires the actual publish redirection +
+* template rewrite onto the `cdkd-assets` mode resolved here.
+*/
+/** Marker schema version, bumped if the marker shape ever changes. */
+const ASSET_SUPPORT_VERSION = 1;
+/**
+* S3 key prefix for bootstrap markers in the state bucket. Deliberately
+* outside the `cdkd/` state prefix so `state list` key-listing never mistakes
+* a marker for a stack, and concurrent bootstraps in two regions cannot race
+* last-writer-wins on a shared object (design §12.1).
+*/
+const BOOTSTRAP_MARKER_PREFIX = "cdkd-bootstrap/";
+/**
+* Name of the cdkd-owned asset bucket for an (account, region) pair.
+* Per-region because Lambda requires the code bucket to be in the function's
+* region — the same reason CDK's asset bucket is per-region (design §3).
+*/
+function getCdkdAssetBucketName(accountId, region) {
+	return `cdkd-assets-${accountId}-${region}`;
+}
+/**
+* Name of the cdkd-owned container-asset ECR repository for an
+* (account, region) pair. ECR repos are account+region scoped by ARN, so the
+* suffix is not strictly needed — the CDK-parallel shape keeps the future
+* template rewrite uniform and the names self-describing (design §3).
+*/
+function getCdkdContainerRepoName(accountId, region) {
+	return `cdkd-container-assets-${accountId}-${region}`;
+}
+/**
+* State-bucket key of the bootstrap marker for a region.
+*/
+function getBootstrapMarkerKey(region) {
+	return `${BOOTSTRAP_MARKER_PREFIX}${region}.json`;
+}
+/**
+* Parse and validate a bootstrap marker body.
+*
+* Throws on malformed JSON or missing required fields — a corrupt marker is
+* treated like the marker-present-but-resources-missing case (hard error,
+* never a silent legacy fallback that would flip-flop stack properties
+* between deploys — design §4.1).
+*/
+function parseBootstrapMarker(body, markerKey) {
+	let parsed;
+	try {
+		parsed = JSON.parse(body);
+	} catch (error) {
+		throw new CdkdError(`Bootstrap marker '${markerKey}' in the state bucket is not valid JSON. Re-run 'cdkd bootstrap' for this region to rewrite it.`, "INVALID_BOOTSTRAP_MARKER", error);
+	}
+	const marker = parsed;
+	if (typeof marker.assetBucket !== "string" || marker.assetBucket.length === 0 || typeof marker.containerRepo !== "string" || marker.containerRepo.length === 0 || typeof marker.assetSupportVersion !== "number") throw new CdkdError(`Bootstrap marker '${markerKey}' in the state bucket is malformed (missing assetBucket / containerRepo / assetSupportVersion). Re-run 'cdkd bootstrap' for this region to rewrite it.`, "INVALID_BOOTSTRAP_MARKER");
+	if (marker.assetSupportVersion > 1) throw new CdkdError(`Bootstrap marker '${markerKey}' has assetSupportVersion ${marker.assetSupportVersion}, but this cdkd only understands up to ${1}. Upgrade cdkd to deploy in this region.`, "UNSUPPORTED_BOOTSTRAP_MARKER_VERSION");
+	return {
+		assetBucket: marker.assetBucket,
+		containerRepo: marker.containerRepo,
+		assetSupportVersion: marker.assetSupportVersion,
+		createdAt: typeof marker.createdAt === "string" ? marker.createdAt : ""
+	};
+}
+/**
+* Verify that the asset bucket + ECR repo named by a marker actually exist.
+*
+* Called when a marker is present: the user opted the region in, so missing
+* resources (user deleted them) are a hard error naming the missing resource
+* and the `cdkd bootstrap` fix — never a silent fallback to CDK bootstrap
+* storage (design §4.1).
+*
+* Every S3 call passes `ExpectedBucketOwner` so a marker pointing at a
+* since-recreated foreign bucket can never leak assets cross-account
+* (bucket-squatting defense, design §5).
+*/
+async function verifyAssetStorageExists(marker, accountId, region, opts = {}) {
+	const rebootstrapHint = `Run 'cdkd bootstrap --region ${region}' to recreate it. cdkd never silently falls back to CDK bootstrap asset storage once a region is opted in.`;
+	const clientOpts = {
+		region,
+		...opts.profile && { profile: opts.profile }
+	};
+	const s3Client = new S3Client(clientOpts);
+	const ecrClient = new ECRClient(clientOpts);
+	try {
+		try {
+			await s3Client.send(new HeadBucketCommand({
+				Bucket: marker.assetBucket,
+				ExpectedBucketOwner: accountId
+			}));
+		} catch (error) {
+			const err = error;
+			if (err.name === "NotFound" || err.name === "NoSuchBucket") throw new CdkdError(`cdkd asset storage is bootstrapped for region '${region}' but the asset bucket '${marker.assetBucket}' is missing. ${rebootstrapHint}`, "ASSET_STORAGE_MISSING");
+			if (err.$metadata?.httpStatusCode === 403) throw new CdkdError(`Asset bucket '${marker.assetBucket}' exists but is not owned by account ${accountId} (or access is denied). Refusing to use it. ${rebootstrapHint}`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
+			throw error;
+		}
+		try {
+			await ecrClient.send(new DescribeRepositoriesCommand({ repositoryNames: [marker.containerRepo] }));
+		} catch (error) {
+			if (error.name === "RepositoryNotFoundException") throw new CdkdError(`cdkd asset storage is bootstrapped for region '${region}' but the container-asset ECR repository '${marker.containerRepo}' is missing. ${rebootstrapHint}`, "ASSET_STORAGE_MISSING");
+			throw error;
+		}
+	} finally {
+		s3Client.destroy();
+		ecrClient.destroy();
+	}
+}
+/**
+* Create (or adopt, when already owned by this account) the cdkd asset
+* bucket + container-asset ECR repo for a region, then write the bootstrap
+* marker. Called by `cdkd bootstrap` unless `--no-assets` is passed.
+*
+* Idempotent like the state-bucket path: existing resources are left as-is
+* unless `force` re-applies their configuration. The marker is written LAST,
+* only after both resources exist (design §5) — a crash mid-bootstrap leaves
+* no marker, so deploys stay in legacy mode.
+*
+* Bucket-squatting defense: the bucket name is predictable (same weakness as
+* CDK's bootstrap bucket), so this refuses to adopt a bucket this account
+* does not own, and the `HeadBucket` probe passes `ExpectedBucketOwner`.
+*/
+async function ensureAssetStorage(options) {
+	const logger = getLogger();
+	const { s3Client, ecrClient, stateBackend, accountId, region, force } = options;
+	const assetBucket = getCdkdAssetBucketName(accountId, region);
+	const containerRepo = getCdkdContainerRepoName(accountId, region);
+	let bucketExists = false;
+	try {
+		await s3Client.send(new HeadBucketCommand({
+			Bucket: assetBucket,
+			ExpectedBucketOwner: accountId
+		}));
+		bucketExists = true;
+		logger.info(`Asset bucket ${assetBucket} already exists`);
+	} catch (error) {
+		const err = error;
+		if (err.name === "NotFound" || err.name === "NoSuchBucket") {} else if (err.$metadata?.httpStatusCode === 403) throw new CdkdError(`Asset bucket name '${assetBucket}' is already taken by a bucket this account does not own (or access is denied). Refusing to adopt it — resolve the naming conflict before re-running 'cdkd bootstrap'.`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
+		else throw normalizeAwsError(error, {
+			bucket: assetBucket,
+			operation: "HeadBucket"
+		});
+	}
+	if (!bucketExists) {
+		logger.info(`Creating asset bucket: ${assetBucket} in region ${region}`);
+		try {
+			await s3Client.send(new CreateBucketCommand({
+				Bucket: assetBucket,
+				...region !== "us-east-1" && { CreateBucketConfiguration: { LocationConstraint: region } }
+			}));
+			logger.info(`✓ Created asset bucket: ${assetBucket}`);
+		} catch (error) {
+			const err = error;
+			if (err.name === "BucketAlreadyOwnedByYou") logger.info(`Asset bucket ${assetBucket} already exists`);
+			else if (err.name === "BucketAlreadyExists") throw new CdkdError(`Asset bucket name '${assetBucket}' is already taken by another AWS account. Refusing to adopt it — resolve the naming conflict before re-running 'cdkd bootstrap'.`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
+			else throw normalizeAwsError(error, {
+				bucket: assetBucket,
+				operation: "CreateBucket"
+			});
+		}
+	}
+	if (!bucketExists || force) {
+		await s3Client.send(new PutBucketEncryptionCommand({
+			Bucket: assetBucket,
+			ExpectedBucketOwner: accountId,
+			ServerSideEncryptionConfiguration: { Rules: [{
+				ApplyServerSideEncryptionByDefault: { SSEAlgorithm: "AES256" },
+				BucketKeyEnabled: true
+			}] }
+		}));
+		await s3Client.send(new PutPublicAccessBlockCommand({
+			Bucket: assetBucket,
+			ExpectedBucketOwner: accountId,
+			PublicAccessBlockConfiguration: {
+				BlockPublicAcls: true,
+				BlockPublicPolicy: true,
+				IgnorePublicAcls: true,
+				RestrictPublicBuckets: true
+			}
+		}));
+		await s3Client.send(new PutBucketPolicyCommand({
+			Bucket: assetBucket,
+			ExpectedBucketOwner: accountId,
+			Policy: JSON.stringify({
+				Version: "2012-10-17",
+				Statement: [{
+					Sid: "DenyExternalAccess",
+					Effect: "Deny",
+					Principal: "*",
+					Action: "s3:*",
+					Resource: [`arn:aws:s3:::${assetBucket}`, `arn:aws:s3:::${assetBucket}/*`],
+					Condition: { StringNotEquals: { "aws:PrincipalAccount": accountId } }
+				}]
+			})
+		}));
+		logger.info("✓ Configured asset bucket (AES-256 encryption, public access block, deny external access)");
+	}
+	let repoExists = false;
+	try {
+		await ecrClient.send(new DescribeRepositoriesCommand({ repositoryNames: [containerRepo] }));
+		repoExists = true;
+		logger.info(`Container-asset repository ${containerRepo} already exists`);
+	} catch (error) {
+		if (error.name !== "RepositoryNotFoundException") throw error;
+	}
+	if (!repoExists) {
+		logger.info(`Creating container-asset ECR repository: ${containerRepo}`);
+		try {
+			await ecrClient.send(new CreateRepositoryCommand({
+				repositoryName: containerRepo,
+				imageTagMutability: "IMMUTABLE"
+			}));
+			logger.info(`✓ Created container-asset ECR repository: ${containerRepo}`);
+		} catch (error) {
+			if (error.name === "RepositoryAlreadyExistsException") logger.info(`Container-asset repository ${containerRepo} already exists`);
+			else throw error;
+		}
+	} else if (force) {
+		await ecrClient.send(new PutImageTagMutabilityCommand({
+			repositoryName: containerRepo,
+			imageTagMutability: "IMMUTABLE"
+		}));
+		logger.info("✓ Configured container-asset repository (immutable tags)");
+	}
+	const marker = {
+		assetBucket,
+		containerRepo,
+		assetSupportVersion: 1,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	await stateBackend.putRawObject(getBootstrapMarkerKey(region), JSON.stringify(marker, null, 2));
+	logger.info(`✓ Wrote bootstrap marker (${getBootstrapMarkerKey(region)})`);
+	return {
+		assetBucket,
+		containerRepo
+	};
+}
+/**
+* Deploy-time asset-mode resolver. One instance per CLI invocation; results
+* are cached per region for the process lifetime (the marker read is one
+* GetObject against a bucket every deploy already reads — design §4.1).
+*
+* In legacy mode, one `logger.info` line per invocation mentions the
+* `cdk gc` hazard and the `cdkd bootstrap` opt-in (info, not warn — existing
+* users are not doing anything wrong; design §12.2).
+*/
+var AssetModeResolver = class {
+	logger = getLogger().child("AssetMode");
+	cache = /* @__PURE__ */ new Map();
+	legacyNoticeShown = false;
+	stateBackend;
+	accountId;
+	profile;
+	useCdkBootstrapAssets;
+	suppressLegacyNotice;
+	constructor(stateBackend, accountId, opts = {}) {
+		this.stateBackend = stateBackend;
+		this.accountId = accountId;
+		this.profile = opts.profile;
+		this.useCdkBootstrapAssets = opts.useCdkBootstrapAssets ?? false;
+		this.suppressLegacyNotice = opts.suppressLegacyNotice ?? false;
+	}
+	/**
+	* Resolve the asset mode for a deploy region. Concurrent callers for the
+	* same region share one in-flight resolution.
+	*/
+	resolve(region) {
+		if (this.useCdkBootstrapAssets) return Promise.resolve({ mode: "legacy" });
+		const cached = this.cache.get(region);
+		if (cached) return cached;
+		const inFlight = this.doResolve(region).catch((error) => {
+			this.cache.delete(region);
+			throw error;
+		});
+		this.cache.set(region, inFlight);
+		return inFlight;
+	}
+	async doResolve(region) {
+		const markerKey = getBootstrapMarkerKey(region);
+		const body = await this.stateBackend.getRawObject(markerKey);
+		if (body === null) {
+			if (!this.legacyNoticeShown && !this.suppressLegacyNotice) {
+				this.legacyNoticeShown = true;
+				this.logger.info("Assets are published to the CDK bootstrap bucket/repo, which 'cdk gc' may garbage-collect (cdkd-deployed stacks have no CloudFormation stack for gc to scan). Run 'cdkd bootstrap' to create cdkd-owned asset storage that 'cdk gc' never touches.");
+			}
+			return { mode: "legacy" };
+		}
+		const marker = parseBootstrapMarker(body, markerKey);
+		await verifyAssetStorageExists(marker, this.accountId, region, { ...this.profile && { profile: this.profile } });
+		this.logger.debug(`cdkd asset storage active for region '${region}': ${marker.assetBucket} / ${marker.containerRepo}`);
+		return {
+			mode: "cdkd-assets",
+			marker
+		};
+	}
+};
+
+//#endregion
+//#region src/assets/asset-redirect.ts
+/**
+* Resolve `${AWS::AccountId}` / `${AWS::Region}` / `${AWS::Partition}`
+* placeholders in an asset-manifest destination value. Module-level twin of
+* `AssetManifestLoader.resolveAssetDestinationValue` (same substitution set,
+* same `aws` default partition) so the mapping table, the publishers, and
+* the rewrite flatten identically.
+*/
+function flattenAssetPlaceholders(value, accountId, region, partition = "aws") {
+	return value.replace(/\$\{AWS::AccountId\}/g, accountId).replace(/\$\{AWS::Region\}/g, region).replace(/\$\{AWS::Partition\}/g, partition);
+}
+/**
+* §8 scope rule, file-asset leg: `true` when a FLATTENED bucket name is
+* default-bootstrap-shaped for this (account, region) — any qualifier
+* (`cdk-hnb659fds-assets-…` default or `cdk-myqual-assets-…` custom; gc can
+* target any bootstrap stack). Everything else (user-chosen names,
+* AppStagingSynthesizer staging buckets, other accounts/regions) is out of
+* scope and left verbatim.
+*/
+function isDefaultBootstrapBucketName(name, accountId, region) {
+	return new RegExp(`^cdk-[a-z0-9]+-assets-${accountId}-${escapeRegExp(region)}$`).test(name);
+}
+/** §8 scope rule, container-image leg (`cdk-<qualifier>-container-assets-…`). */
+function isDefaultBootstrapRepoName(name, accountId, region) {
+	return new RegExp(`^cdk-[a-z0-9]+-container-assets-${accountId}-${escapeRegExp(region)}$`).test(name);
+}
+function escapeRegExp(s) {
+	return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Build the §6 asset-location mapping table from a stack's asset manifest.
+*
+* For every file / docker destination that (a) targets the deploy region and
+* (b) is default-bootstrap-shaped after flattening, the flattened source name
+* maps to the marker's cdkd-owned bucket / repo. `objectKey` / `imageTag`
+* (content hashes, including any `bucketPrefix` baked into `objectKey`) are
+* never part of the table — keys and tags flow through unchanged so the
+* existence-check/skip logic works as-is per storage.
+*
+* Template assets (`*.template.json` sources) contribute their destinations
+* too even though cdkd never publishes them: the parent's `TemplateURL`
+* property references the same bootstrap bucket and must rewrite with it
+* (harmlessly — `NestedStackProvider` never dereferences the URL).
+*
+* Cross-region destinations (`dest.region` ≠ deploy region) are skipped
+* entirely — cdkd asset storage and its marker are per-region (§8).
+*/
+function buildAssetRedirectMap(manifest, marker, accountId, region, partition = "aws") {
+	const buckets = /* @__PURE__ */ new Map();
+	const repos = /* @__PURE__ */ new Map();
+	const sources = /* @__PURE__ */ new Map();
+	const addForms = (rawName, flattened, target) => {
+		sources.set(flattened, target);
+		if (rawName !== flattened) sources.set(rawName, target);
+		const suffixRe = new RegExp(`-${accountId}-${escapeRegExp(region)}$`);
+		for (const suffix of [
+			"-${AWS::AccountId}-${AWS::Region}",
+			`-\${AWS::AccountId}-${region}`,
+			`-${accountId}-\${AWS::Region}`
+		]) {
+			const form = flattened.replace(suffixRe, suffix);
+			if (form !== flattened) sources.set(form, target);
+		}
+	};
+	const destTargetsDeployRegion = (dest) => {
+		if (!dest.region) return true;
+		return flattenAssetPlaceholders(dest.region, accountId, region, partition) === region;
+	};
+	for (const asset of Object.values(manifest.files ?? {})) for (const dest of Object.values(asset.destinations ?? {})) {
+		if (!destTargetsDeployRegion(dest)) continue;
+		const flattened = flattenAssetPlaceholders(dest.bucketName, accountId, region, partition);
+		if (!isDefaultBootstrapBucketName(flattened, accountId, region)) continue;
+		buckets.set(flattened, marker.assetBucket);
+		addForms(dest.bucketName, flattened, marker.assetBucket);
+	}
+	for (const asset of Object.values(manifest.dockerImages ?? {})) for (const dest of Object.values(asset.destinations ?? {})) {
+		if (!destTargetsDeployRegion(dest)) continue;
+		const flattened = flattenAssetPlaceholders(dest.repositoryName, accountId, region, partition);
+		if (!isDefaultBootstrapRepoName(flattened, accountId, region)) continue;
+		repos.set(flattened, marker.containerRepo);
+		addForms(dest.repositoryName, flattened, marker.containerRepo);
+	}
+	return {
+		buckets,
+		repos,
+		entries: [...sources.entries()].map(([source, target]) => ({
+			source,
+			target
+		})).sort((a, b) => b.source.length - a.source.length),
+		accountId,
+		region,
+		partition
+	};
+}
+/**
+* Boundary-aware replacement (§7 step 2): a source name only matches when it
+* stands alone as a name token — not preceded by a name character (so a user
+* bucket `my-cdk-hnb659fds-assets-…` is never corrupted) and not followed by
+* one (so `cdk-hnb659fds-assets-<acct>-<region>-backup` is never corrupted).
+* URI delimiters (`/`, `:`, `.`, quotes, whitespace) and end-of-string are
+* boundaries.
+*
+* Known trade-off: a trailing `.` MUST be a boundary for virtual-host-style
+* URLs (`<bucket>.s3.<region>.amazonaws.com`), so a user bucket literally
+* named `cdk-<qualifier>-assets-<acct>-<region>.backup` (dot-suffixed
+* lookalike) would have its prefix rewritten. S3 discourages dots in bucket
+* names (breaks virtual-host TLS) and the name would ALSO have to collide
+* with the deploy account+region bootstrap shape — accepted as pathological.
+*/
+function buildBoundaryRegex(source) {
+	return new RegExp(`(?<![A-Za-z0-9_.-])${escapeRegExp(source)}(?![A-Za-z0-9_-])`, "g");
+}
+function rewriteString(value, map, counter) {
+	let result = value;
+	for (const { source, target } of map.entries) {
+		if (!result.includes(source)) continue;
+		const re = buildBoundaryRegex(source);
+		result = result.replace(re, () => {
+			counter.n++;
+			return target;
+		});
+	}
+	return result;
+}
+/** True when the string contains any mapped source name at a token boundary. */
+function containsAnySource(value, map) {
+	for (const { source } of map.entries) {
+		if (!value.includes(source)) continue;
+		if (buildBoundaryRegex(source).test(value)) return true;
+	}
+	return false;
+}
+const FOLDABLE_PSEUDO_PARAMS = new Set([
+	"AWS::AccountId",
+	"AWS::Region",
+	"AWS::Partition",
+	"AWS::URLSuffix"
+]);
+function evaluatePseudoParam(name, map) {
+	switch (name) {
+		case "AWS::AccountId": return map.accountId;
+		case "AWS::Region": return map.region;
+		case "AWS::Partition": return map.partition;
+		case "AWS::URLSuffix": return "amazonaws.com";
+		default: throw new Error(`Not a foldable pseudo parameter: ${name}`);
+	}
+}
+/** A `Fn::Join` part that partial evaluation can fold to a literal. */
+function foldablePartValue(part, map) {
+	if (typeof part === "string") return part;
+	if (part !== null && typeof part === "object" && !Array.isArray(part)) {
+		const keys = Object.keys(part);
+		if (keys.length === 1 && keys[0] === "Ref") {
+			const ref = part["Ref"];
+			if (typeof ref === "string" && FOLDABLE_PSEUDO_PARAMS.has(ref)) return evaluatePseudoParam(ref, map);
+		}
+	}
+}
+/**
+* §7 `Fn::Join` handling: fold maximal runs of pseudo-parameter-only parts
+* (string literals + `{Ref: AWS::AccountId|Region|Partition|URLSuffix}` —
+* all deploy-time constants) into a literal, and KEEP the folded literal only
+* when a source name actually matched inside it — otherwise the original
+* parts are preserved so templates without asset references stay
+* byte-identical. Joins whose relevant runs contain real resource refs are
+* left alone (synthesizer output never splits an asset location across a
+* resource ref).
+*
+* Returns the new parts array (or the original when nothing changed).
+*/
+function foldAndRewriteJoinParts(delimiter, parts, map, counter) {
+	const out = [];
+	let changed = false;
+	let i = 0;
+	while (i < parts.length) {
+		const folded = foldablePartValue(parts[i], map);
+		if (folded === void 0) {
+			out.push(parts[i]);
+			i++;
+			continue;
+		}
+		const runValues = [folded];
+		let j = i + 1;
+		for (; j < parts.length; j++) {
+			const v = foldablePartValue(parts[j], map);
+			if (v === void 0) break;
+			runValues.push(v);
+		}
+		const literal = runValues.join(delimiter);
+		if (j - i > 1 && containsAnySource(literal, map)) {
+			out.push(rewriteString(literal, map, counter));
+			changed = true;
+		} else for (let k = i; k < j; k++) out.push(parts[k]);
+		i = j;
+	}
+	return changed ? out : parts;
+}
+function rewriteNode(node, map, counter) {
+	if (typeof node === "string") return rewriteString(node, map, counter);
+	if (Array.isArray(node)) {
+		for (let i = 0; i < node.length; i++) node[i] = rewriteNode(node[i], map, counter);
+		return node;
+	}
+	if (node !== null && typeof node === "object") {
+		const obj = node;
+		const joinArgs = obj["Fn::Join"];
+		if (Object.keys(obj).length === 1 && Array.isArray(joinArgs) && joinArgs.length === 2 && typeof joinArgs[0] === "string" && Array.isArray(joinArgs[1])) {
+			const foldedParts = foldAndRewriteJoinParts(joinArgs[0], joinArgs[1], map, counter);
+			obj["Fn::Join"] = [joinArgs[0], rewriteNode(foldedParts, map, counter)];
+			return obj;
+		}
+		for (const key of Object.keys(obj)) obj[key] = rewriteNode(obj[key], map, counter);
+		return obj;
+	}
+	return node;
+}
+/**
+* §7 template reference rewrite: deep-walk the parsed template IN PLACE and
+* replace every boundary-matched source name (both placeholder and flattened
+* forms, incl. inside `Fn::Sub` template strings and across folded `Fn::Join`
+* pseudo-parameter runs) with the cdkd-owned storage name. Returns the number
+* of replacements for logging.
+*
+* Applied per stack before DAG build (deploy), before diff computation
+* (diff, incl. every recursive child template), and before state write
+* (import, incl. the recursive CFn-migration child walk). `cdkd synth` and
+* `cdkd export` output stays unrewritten by design (§7.1).
+*/
+function rewriteTemplateAssetReferences(template, map) {
+	if (map.entries.length === 0) return 0;
+	const counter = { n: 0 };
+	rewriteNode(template, map, counter);
+	return counter.n;
+}
+function auditNode(node, map, path, findings) {
+	if (typeof node === "string") {
+		for (const { source } of map.entries) {
+			if (!node.includes(source)) continue;
+			if (buildBoundaryRegex(source).test(node)) {
+				findings.push({
+					path,
+					source
+				});
+				return;
+			}
+		}
+		return;
+	}
+	if (Array.isArray(node)) {
+		node.forEach((item, i) => auditNode(item, map, `${path}[${i}]`, findings));
+		return;
+	}
+	if (node !== null && typeof node === "object") for (const [key, value] of Object.entries(node)) auditNode(value, map, path ? `${path}.${key}` : key, findings);
+}
+/**
+* §7 step 3 post-resolution audit (defense in depth): after the intrinsic
+* resolver produces final literals, scan the resolved properties for any
+* remaining mapped SOURCE name. A hit means a template shape the rewrite
+* missed — the deploy engine fails the resource loudly instead of deploying
+* a split-brain reference (assets in cdkd storage, property pointing at the
+* CDK bootstrap bucket that `cdk gc` may have emptied).
+*/
+function findUnrewrittenAssetReferences(resolvedProperties, map) {
+	const findings = [];
+	auditNode(resolvedProperties, map, "", findings);
+	return findings;
+}
+/**
+* Apply the mapping table to one file asset's destinations (§6 publish-time
+* redirection). Returns a shallow-cloned asset when any destination is
+* redirected, or the original object otherwise. `objectKey` is untouched.
+*/
+function redirectFileAsset(asset, map) {
+	let changed = false;
+	const destinations = {};
+	for (const [id, dest] of Object.entries(asset.destinations ?? {})) {
+		const flattened = flattenAssetPlaceholders(dest.bucketName, map.accountId, map.region, map.partition);
+		const target = map.buckets.get(flattened);
+		if (target && destRegionMatches(dest, map)) {
+			destinations[id] = {
+				...dest,
+				bucketName: target
+			};
+			changed = true;
+		} else destinations[id] = dest;
+	}
+	return changed ? {
+		...asset,
+		destinations
+	} : asset;
+}
+/**
+* Apply the mapping table to one docker-image asset's destinations.
+* Returns a shallow-cloned asset when any destination is redirected.
+* `imageTag` is untouched.
+*/
+function redirectDockerAsset(asset, map) {
+	let changed = false;
+	const destinations = {};
+	for (const [id, dest] of Object.entries(asset.destinations ?? {})) {
+		const flattened = flattenAssetPlaceholders(dest.repositoryName, map.accountId, map.region, map.partition);
+		const target = map.repos.get(flattened);
+		if (target && destRegionMatches(dest, map)) {
+			destinations[id] = {
+				...dest,
+				repositoryName: target
+			};
+			changed = true;
+		} else destinations[id] = dest;
+	}
+	return changed ? {
+		...asset,
+		destinations
+	} : asset;
+}
+function destRegionMatches(dest, map) {
+	if (!dest.region) return true;
+	return flattenAssetPlaceholders(dest.region, map.accountId, map.region, map.partition) === map.region;
+}
+/**
+* Load a stack's asset manifest and report whether it has anything cdkd
+* would actually publish (file assets excluding CFn template assets, plus
+* docker images). Returns `null` when the manifest file does not exist or
+* has nothing publishable — the caller then skips asset-mode resolution
+* entirely so asset-less deploys stay byte-identical to pre-#1002 behavior
+* (no marker read, no legacy-mode notice).
+*
+* Non-ENOENT read/parse failures propagate — a corrupt manifest must not
+* be mistaken for "no assets".
+*/
+function loadPublishableAssetManifest(manifestPath) {
+	let raw;
+	try {
+		raw = readFileSync(manifestPath, "utf-8");
+	} catch (error) {
+		if (error.code === "ENOENT") return null;
+		throw error;
+	}
+	const manifest = JSON.parse(raw);
+	if (Object.values(manifest.files ?? {}).filter((asset) => !isCfnTemplateAssetPath(asset.source.path)).length + Object.keys(manifest.dockerImages ?? {}).length === 0) return null;
+	return manifest;
+}
+/**
+* Lazily-initializing per-stack redirect resolver for commands that do NOT
+* already resolve the caller account id up front (`diff`, `import`). Returns
+* a function that maps `(manifestPath, region)` to the stack's
+* {@link AssetRedirectMap} — or `undefined` when the stack has nothing
+* publishable, the region is in legacy mode, or the map has no
+* in-scope destinations.
+*
+* The STS `GetCallerIdentity` call and the {@link AssetModeResolver} are
+* created on first need only, so invocations that never touch an
+* asset-bearing stack make no extra AWS calls (byte-identical to pre-#1002
+* behavior). `useCdkBootstrapAssets` short-circuits everything to legacy.
+*/
+function createAssetRedirectResolver(opts) {
+	let accountIdPromise;
+	let modeResolver;
+	const getAccountId = () => {
+		accountIdPromise ??= (async () => {
+			const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
+			const stsClient = new STSClient({
+				region: opts.stsRegion,
+				...opts.profile && { profile: opts.profile }
+			});
+			try {
+				return (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
+			} finally {
+				stsClient.destroy();
+			}
+		})();
+		return accountIdPromise;
+	};
+	return async (manifestPath, region) => {
+		if (opts.useCdkBootstrapAssets || !manifestPath) return void 0;
+		const manifest = loadPublishableAssetManifest(manifestPath);
+		if (!manifest) return void 0;
+		const accountId = await getAccountId();
+		modeResolver ??= new AssetModeResolver(opts.stateBackend, accountId, {
+			...opts.profile && { profile: opts.profile },
+			...opts.suppressLegacyNotice && { suppressLegacyNotice: true }
+		});
+		const mode = await modeResolver.resolve(region);
+		if (mode.mode !== "cdkd-assets") return void 0;
+		const map = buildAssetRedirectMap(manifest, mode.marker, accountId, region);
+		return map.entries.length > 0 ? map : void 0;
+	};
+}
+
 //#endregion
 //#region src/deployment/work-graph.ts
 /**
@@ -3044,8 +3759,9 @@ var AssetPublisher = class {
 		const manifest = JSON.parse(content);
 		const cdkOutputDir = manifestPath.replace(/\/[^/]+$/, "");
 		const prefix = options.nodePrefix || "";
+		const redirect = options.redirect;
 		const nodeIds = [];
-		const fileAssets = Object.entries(manifest.files || {}).filter(([, asset]) => !isCfnTemplateAssetPath(asset.source.path));
+		const fileAssets = Object.entries(manifest.files || {}).filter(([, asset]) => !isCfnTemplateAssetPath(asset.source.path)).map(([hash, asset]) => [hash, redirect ? redirectFileAsset(asset, redirect) : asset]);
 		for (const [hash, asset] of fileAssets) {
 			const nodeId = `asset-publish:${prefix}file:${hash}`;
 			graph.addNode({
@@ -3065,7 +3781,8 @@ var AssetPublisher = class {
 			});
 			nodeIds.push(nodeId);
 		}
-		for (const [hash, asset] of Object.entries(manifest.dockerImages || {})) {
+		for (const [hash, rawAsset] of Object.entries(manifest.dockerImages || {})) {
+			const asset = redirect ? redirectDockerAsset(rawAsset, redirect) : rawAsset;
 			const localTag = `cdkd-asset-${hash}`;
 			const buildNodeId = `asset-build:${prefix}docker:${hash}`;
 			const publishNodeId = `asset-publish:${prefix}docker:${hash}`;
@@ -3128,7 +3845,8 @@ var AssetPublisher = class {
 			if (this.addAssetsToGraph(graph, manifestPath, {
 				accountId,
 				region,
-				...options.profile && { profile: options.profile }
+				...options.profile && { profile: options.profile },
+				...options.redirect && { redirect: options.redirect }
 			}).length === 0) {
 				this.logger.debug("No assets to publish");
 				return;
@@ -14520,6 +15238,22 @@ var DeployEngine = class {
 		} catch {}
 	}
 	/**
+	* Issue #1002 PR 2 — §7 step 3 post-resolution audit (defense in depth).
+	* No-op in legacy mode (`options.assetRedirect` unset). In cdkd-assets
+	* mode, a resolved property still naming a mapped SOURCE (CDK bootstrap)
+	* bucket / repo means a template shape the §7 rewrite missed — fail the
+	* resource loudly BEFORE provisioning instead of deploying a split-brain
+	* reference (assets live in cdkd storage, the property points at the CDK
+	* bootstrap bucket that `cdk gc` may have emptied).
+	*/
+	auditResolvedAssetReferences(logicalId, resourceType, resolvedProps) {
+		const redirect = this.options.assetRedirect;
+		if (!redirect) return;
+		const findings = findUnrewrittenAssetReferences(resolvedProps, redirect);
+		if (findings.length === 0) return;
+		throw new ProvisioningError(`Unrewritten asset reference on '${logicalId}' (${resourceType}): this region uses cdkd-owned asset storage, but the following resolved properties still point at the CDK bootstrap storage that 'cdk gc' may garbage-collect:\n${findings.map((f) => `  - ${f.path}: still references '${f.source}'`).join("\n")}\nThis is a template shape cdkd's asset-reference rewrite did not cover — deploying it would split-brain the stack (assets in cdkd storage, properties reading the CDK bucket). Please report this at https://github.com/go-to-k/cdkd/issues with the property shape. Workaround: deploy with --use-cdk-bootstrap-assets to pin the legacy destinations for this app.`, resourceType, logicalId);
+	}
+	/**
 	* Inner body of provisionResource, extracted so the outer wrapper can
 	* apply the per-resource deadline (`withResourceDeadline`) without
 	* having the timeout / warn timer code dwarf the real provisioning
@@ -14539,6 +15273,7 @@ var DeployEngine = class {
 					...conditions && { conditions }
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
+				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				const createDecision = this.providerRegistry.getProviderFor({
 					resourceType,
 					properties: resolvedProps
@@ -14578,6 +15313,7 @@ var DeployEngine = class {
 					...conditions && { conditions }
 				}, stackName);
 				const resolvedProps = await this.resolver.resolve(desiredProps, context);
+				this.auditResolvedAssetReferences(logicalId, resourceType, resolvedProps);
 				if (JSON.stringify(resolvedProps) === JSON.stringify(currentProps)) {
 					if (change.attributeChanges && change.attributeChanges.length > 0) {
 						const attrSummary = change.attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
@@ -15000,5 +15736,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { resolveSkipPrefix as $, DiffCalculator as A, buildDockerImage as B, findActionableSilentDrops as C, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, AssetManifestLoader as G, getDockerCmd as H, shouldRetainResource as I, synthesisStatusMessage as J, getDockerImageBySourceHash as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, resolveCaptureObservedState as Q, stringifyValue as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, runDockerForeground as U, formatDockerLoginError as V, runDockerStreaming as W, getLegacyStateBucketName as X, getDefaultStateBucketName as Y, resolveApp as Z, green as _, withRetry as a, MIGRATE_TMP_PREFIX as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, AssemblyReader as ct, isStatefulRecreateTargetSync as d, resolveStateBucketWithDefault as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, CFN_TEMPLATE_URL_LIMIT as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, clearBucketRegionCache as lt, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, warnDeprecatedNoPrefixCliFlag as nt, isRetryableTransientError as o, findLargeInlineResources as ot, formatResourceLine as p, Synthesizer as q, DeployEngine as r, CFN_TEMPLATE_BODY_LIMIT as rt, IMPLICIT_DELETE_DEPENDENCIES as s, uploadCfnTemplate as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveBucketRegion as ut, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, WorkGraph as z };
-//# sourceMappingURL=deploy-engine-BkPZar1R.js.map
+export { AssetManifestLoader as $, DiffCalculator as A, buildAssetRedirectMap as B, findActionableSilentDrops as C, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, BOOTSTRAP_MARKER_PREFIX as G, loadPublishableAssetManifest as H, shouldRetainResource as I, buildDockerImage as J, ensureAssetStorage as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, runDockerStreaming as Q, stringifyValue as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, rewriteTemplateAssetReferences as U, createAssetRedirectResolver as V, AssetModeResolver as W, getDockerCmd as X, formatDockerLoginError as Y, runDockerForeground as Z, green as _, AssemblyReader as _t, withRetry as a, resolveApp as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveStateBucketWithDefault as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as dt, getDockerImageBySourceHash as et, renderStatefulReason as f, CFN_TEMPLATE_BODY_LIMIT as ft, gray as g, uploadCfnTemplate as gt, cyan as h, findLargeInlineResources as ht, withResourceDeadline as i, getLegacyStateBucketName as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, resolveStateBucketWithDefaultAndSource as lt, bold as m, MIGRATE_TMP_PREFIX as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, synthesisStatusMessage as nt, isRetryableTransientError as o, resolveCaptureObservedState as ot, formatResourceLine as p, CFN_TEMPLATE_URL_LIMIT as pt, parseBootstrapMarker as q, DeployEngine as r, getDefaultStateBucketName as rt, IMPLICIT_DELETE_DEPENDENCIES as s, resolveSkipPrefix as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, Synthesizer as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveUseCdkBootstrapAssets as ut, red as v, clearBucketRegionCache as vt, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, resolveBucketRegion as yt, WorkGraph as z };
+//# sourceMappingURL=deploy-engine-Dj9mXUQa.js.map