@go-to-k/cdkd 0.238.4 → 0.238.6

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-CQuZCVUP.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-_tADDg2k.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -1885,7 +1885,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.238.4";
+	return "0.238.6";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -46316,12 +46316,18 @@ function formatBucketSource(source) {
 * not-yet-bootstrapped bucket. (Bucket existence is verified separately
 * via {@link setupStateBackend}, so getting here implies the bucket is
 * reachable; `GetBucketLocation` failing is most often a permissions gap.)
+*
+* Takes the (region-corrected) S3 client directly — see the issue #1054 note
+* in {@link stateInfoCommand}. Before that fix this call was made with the
+* ambient-region client, so a cross-region state bucket silently degraded to
+* `undefined` ("Region: unknown") here; with the corrected client it now
+* succeeds and reports the bucket's actual region.
 */
-async function detectBucketRegion(awsClients, bucket) {
+async function detectBucketRegion(s3, bucket) {
 	try {
-		const constraint = (await awsClients.s3.send(new GetBucketLocationCommand({
+		const constraint = (await s3.send(new GetBucketLocationCommand({
 			Bucket: bucket,
-			...await expectedOwnerParam(awsClients.s3)
+			...await expectedOwnerParam(s3)
 		}))).LocationConstraint;
 		if (!constraint) return "us-east-1";
 		if (constraint === "EU") return "eu-west-1";
@@ -46342,12 +46348,12 @@ async function detectBucketRegion(awsClients, bucket) {
 * Returns the full set of state-file keys; the count is the unique-stacks
 * tally we want for the `Stacks:` line.
 */
-async function listStateFileKeys(awsClients, bucket, prefix) {
+async function listStateFileKeys(s3, bucket, prefix) {
 	const keys = [];
 	let continuationToken;
 	const searchPrefix = `${prefix}/`;
 	do {
-		const resp = await awsClients.s3.send(new ListObjectsV2Command({
+		const resp = await s3.send(new ListObjectsV2Command({
 			Bucket: bucket,
 			Prefix: searchPrefix,
 			...continuationToken && { ContinuationToken: continuationToken }
@@ -46365,13 +46371,13 @@ async function listStateFileKeys(awsClients, bucket, prefix) {
 * Returns `'unknown'` when no state files exist or parsing fails — we don't
 * want a cosmetic command to crash on an unexpected payload.
 */
-async function readSchemaVersion(awsClients, bucket, keys) {
+async function readSchemaVersion(s3, bucket, keys) {
 	if (keys.length === 0) return "unknown";
 	try {
-		const resp = await awsClients.s3.send(new GetObjectCommand({
+		const resp = await s3.send(new GetObjectCommand({
 			Bucket: bucket,
 			Key: keys[0],
-			...await expectedOwnerParam(awsClients.s3)
+			...await expectedOwnerParam(s3)
 		}));
 		if (!resp.Body) return "unknown";
 		const body = await resp.Body.transformToString();
@@ -46387,13 +46393,13 @@ async function readSchemaVersion(awsClients, bucket, keys) {
 * cosmetic command and should not crash on an unexpected payload (deploy
 * hard-errors on the same marker instead).
 */
-async function listAssetStorageMarkers(awsClients, bucket) {
+async function listAssetStorageMarkers(s3, bucket) {
 	const logger = getLogger();
 	const entries = [];
 	let continuationToken;
 	const keys = [];
 	do {
-		const resp = await awsClients.s3.send(new ListObjectsV2Command({
+		const resp = await s3.send(new ListObjectsV2Command({
 			Bucket: bucket,
 			Prefix: BOOTSTRAP_MARKER_PREFIX,
 			...continuationToken && { ContinuationToken: continuationToken }
@@ -46404,10 +46410,10 @@ async function listAssetStorageMarkers(awsClients, bucket) {
 	for (const key of keys) {
 		const region = key.slice(BOOTSTRAP_MARKER_PREFIX.length, -5);
 		try {
-			const marker = parseBootstrapMarker(await (await awsClients.s3.send(new GetObjectCommand({
+			const marker = parseBootstrapMarker(await (await s3.send(new GetObjectCommand({
 				Bucket: bucket,
 				Key: key,
-				...await expectedOwnerParam(awsClients.s3)
+				...await expectedOwnerParam(s3)
 			}))).Body?.transformToString() ?? "", key);
 			entries.push({
 				region,
@@ -46451,6 +46457,7 @@ async function stateInfoCommand(options) {
 		...options.profile && { profile: options.profile }
 	});
 	setAwsClients(awsClients);
+	let regionCorrectedS3 = null;
 	try {
 		const region = options.region || process.env["AWS_REGION"] || "us-east-1";
 		const resolved = await resolveStateBucketWithDefaultAndSource(options.stateBucket, region);
@@ -46460,10 +46467,18 @@ async function stateInfoCommand(options) {
 			bucket,
 			prefix
 		}).verifyBucketExists();
-		const detectedRegion = await detectBucketRegion(awsClients, bucket);
-		const stateFileKeys = await listStateFileKeys(awsClients, bucket, prefix);
-		const schemaVersion = await readSchemaVersion(awsClients, bucket, stateFileKeys);
-		const assetStorage = await listAssetStorageMarkers(awsClients, bucket);
+		regionCorrectedS3 = await rebuildClientForBucketRegion(awsClients.s3, bucket, {
+			reuseClientCredentials: true,
+			tolerateNonStandardClient: true,
+			onRebuild: ({ bucketRegion, currentRegion }) => {
+				logger.debug(`State bucket '${bucket}' is in '${bucketRegion}' (state-info client was '${String(currentRegion)}'); building a region-corrected S3 client for info reads.`);
+			}
+		});
+		const infoS3 = regionCorrectedS3 ?? awsClients.s3;
+		const detectedRegion = await detectBucketRegion(infoS3, bucket);
+		const stateFileKeys = await listStateFileKeys(infoS3, bucket, prefix);
+		const schemaVersion = await readSchemaVersion(infoS3, bucket, stateFileKeys);
+		const assetStorage = await listAssetStorageMarkers(infoS3, bucket);
 		if (options.json) {
 			const json = {
 				bucket,
@@ -46491,6 +46506,7 @@ async function stateInfoCommand(options) {
 		}
 		process.stdout.write(`${lines.join("\n")}\n`);
 	} finally {
+		regionCorrectedS3?.destroy();
 		awsClients.destroy();
 	}
 }
@@ -47705,6 +47721,72 @@ async function loadStateForStack(stackName, synthRegion, opts) {
 	}
 }
 /**
+* Best-effort read of the region's asset-storage bootstrap marker
+* (`s3://{stateBucket}/cdkd-bootstrap/{region}.json`) to recover the
+* cdkd-owned container-asset ECR repository name (issue #1025). Since
+* `cdkd bootstrap --container-repo <name>` (issue #1011) the repo can
+* carry ANY name, so the local resolvers' conventional-prefix regex
+* cannot classify images published to a custom-named repo — the marker
+* is the only source of truth.
+*
+* This is a fast-path optimization for `cdkd local run-task
+* --from-state` (recognizing a cdk-asset image enables the local
+* `cdk.out` docker build instead of an ECR pull), so it must NEVER fail
+* the run: every miss (no bucket, no marker, malformed marker, any AWS
+* error) logs at debug and returns `undefined` — the caller falls back
+* to the conventional-prefix regex.
+*
+* Marker-key region resolution: the marker records the repo for the
+* stack's DEPLOY region, so after the explicit CLI overrides (`--region`
+* highest per the repo convention, then `--stack-region` — the state
+* disambiguator that names the region whose state is being loaded) the
+* synth-derived stack region outranks the ambient env region. This
+* deliberately differs from {@link loadStateForStack}'s bucket-resolution
+* chain (which is about WHERE the state bucket is, not WHICH region's
+* data is read).
+*/
+async function loadBootstrapContainerRepo(synthRegion, opts) {
+	const logger = getLogger();
+	const prefix = opts.logPrefix ?? "--from-state";
+	const region = opts.region ?? opts.stackRegion ?? synthRegion ?? process.env["AWS_REGION"] ?? process.env["AWS_DEFAULT_REGION"] ?? "us-east-1";
+	let stateBucket;
+	try {
+		stateBucket = await resolveStateBucketWithDefault(opts.stateBucket, region);
+	} catch (err) {
+		logger.debug(`${prefix}: could not resolve state bucket for the bootstrap-marker read: ${err instanceof Error ? err.message : String(err)}. Falling back to conventional asset-repo names.`);
+		return;
+	}
+	const awsClients = new AwsClients({
+		...opts.region !== void 0 && { region: opts.region },
+		...opts.profile !== void 0 && { profile: opts.profile }
+	});
+	setAwsClients(awsClients);
+	try {
+		const stateConfig = {
+			bucket: stateBucket,
+			prefix: opts.statePrefix
+		};
+		const stateBackend = new S3StateBackend(awsClients.s3, stateConfig, {
+			...opts.region !== void 0 && { region: opts.region },
+			...opts.profile !== void 0 && { profile: opts.profile }
+		});
+		const markerKey = getBootstrapMarkerKey(region);
+		const body = await stateBackend.getRawObject(markerKey);
+		if (body === null) {
+			logger.debug(`${prefix}: no bootstrap marker at '${markerKey}' in bucket '${stateBucket}' — assuming conventional asset-repo names.`);
+			return;
+		}
+		const marker = parseBootstrapMarker(body, markerKey);
+		logger.debug(`${prefix}: bootstrap marker for ${region} names container repo '${marker.containerRepo}'.`);
+		return marker.containerRepo;
+	} catch (err) {
+		logger.debug(`${prefix}: bootstrap-marker read failed: ${err instanceof Error ? err.message : String(err)}. Falling back to conventional asset-repo names.`);
+		return;
+	} finally {
+		resetAwsClients();
+	}
+}
+/**
 * Build a {@link CrossStackResolver} that walks cdkd's S3 state to look
 * up `Fn::ImportValue` / `Fn::GetStackOutput` references the same way
 * `cdkd deploy`'s `IntrinsicFunctionResolver` does. Returns `undefined`
@@ -48431,6 +48513,7 @@ function detectEcsImageResolutionNeeds(stack) {
 	let needsStateResources = false;
 	let needsEnvOrSecretSubstitution = false;
 	let needsCrossStackResolver = false;
+	let needsAssetRepoMarker = false;
 	for (const res of Object.values(resources)) {
 		if (res.Type !== "AWS::ECS::TaskDefinition") continue;
 		const props = res.Properties ?? {};
@@ -48442,6 +48525,8 @@ function detectEcsImageResolutionNeeds(stack) {
 			const need = inspectImageForSubstitutions(image, resources);
 			if (need.pseudo) needsPseudoParameters = true;
 			if (need.state) needsStateResources = true;
+			const flat = extractImageString(image);
+			if (flat !== void 0 && extractEcrRepoComponent(flat) !== void 0 && !CDK_ASSET_IMAGE_REPO_RE.test(flat)) needsAssetRepoMarker = true;
 			if (containerHasIntrinsicEnvOrSecret(co)) needsEnvOrSecretSubstitution = true;
 			if (containerHasCrossStackEnvOrSecret(co)) {
 				needsEnvOrSecretSubstitution = true;
@@ -48461,7 +48546,8 @@ function detectEcsImageResolutionNeeds(stack) {
 		needsPseudoParameters,
 		needsStateResources,
 		needsEnvOrSecretSubstitution,
-		needsCrossStackResolver
+		needsCrossStackResolver,
+		needsAssetRepoMarker
 	};
 }
 /**
@@ -48937,11 +49023,53 @@ function buildSubstitutionContextFromImageContext(context) {
 * `cdk.out` build, so both must classify as `kind: 'cdk-asset'`. The `cdk-`
 * qualifier is generalized to `[a-z0-9]+` so a custom-qualifier bootstrap is
 * matched too (previously only the hardcoded `hnb659fds` default was).
+*
+* Since `cdkd bootstrap --container-repo <name>` (issue #1011) the
+* cdkd-owned repo can carry ANY name — the per-region bootstrap marker is
+* the source of truth. The regex therefore cannot recognize images
+* published to a custom-named repo; `isCdkAssetImageUri` additionally
+* matches an ECR-hosted URI whose repository path component equals the
+* marker-resolved name when the caller supplies it (issue #1025). The
+* regex stays as the no-marker fallback — `cdkd local run-task` can run
+* without AWS access, where no marker read is possible.
 */
 const CDK_ASSET_IMAGE_REPO_RE = /(?:cdk-[a-z0-9]+|cdkd)-container-assets-/;
-/** True when `uri` embeds a CDK-bootstrap or cdkd-owned container-assets repo. */
-function isCdkAssetImageUri(uri) {
-	return CDK_ASSET_IMAGE_REPO_RE.test(uri);
+/**
+* Extract the repository path component of an ECR-hosted image URI.
+*
+* The host part (before the first `/`) must contain `.dkr.ecr.` — this
+* tolerates both concrete hosts (`123456789012.dkr.ecr.us-east-1.amazonaws.com`)
+* and placeholder-bearing hosts
+* (`${AWS::AccountId}.dkr.ecr.${AWS::Region}.${AWS::URLSuffix}`). The repo
+* component is the substring after the first `/`, stripped of a trailing
+* `@<digest>` (first `@`) and then a trailing `:<tag>` (last `:` — ECR
+* repo names cannot contain `:` but CAN contain `/`, so the last colon is
+* the tag separator). Stripping the digest FIRST handles the combined
+* `name:tag@digest` form Docker accepts. Returns `undefined` for non-ECR
+* hosts and empty results.
+*/
+function extractEcrRepoComponent(uri) {
+	const slash = uri.indexOf("/");
+	if (slash <= 0) return void 0;
+	if (!uri.slice(0, slash).includes(".dkr.ecr.")) return void 0;
+	let repo = uri.slice(slash + 1);
+	const at = repo.indexOf("@");
+	if (at !== -1) repo = repo.slice(0, at);
+	const colon = repo.lastIndexOf(":");
+	if (colon !== -1) repo = repo.slice(0, colon);
+	return repo.length > 0 ? repo : void 0;
+}
+/**
+* True when `uri` embeds a CDK-bootstrap or cdkd-owned container-assets
+* repo — either via the conventional-name regex, or (issue #1025) via an
+* exact match between the URI's ECR repository path component and the
+* bootstrap-marker-resolved `cdkAssetContainerRepo` name, which covers
+* regions bootstrapped with `cdkd bootstrap --container-repo <name>`.
+*/
+function isCdkAssetImageUri(uri, cdkAssetContainerRepo) {
+	if (CDK_ASSET_IMAGE_REPO_RE.test(uri)) return true;
+	if (cdkAssetContainerRepo === void 0) return false;
+	return extractEcrRepoComponent(uri) === cdkAssetContainerRepo;
 }
 /**
 * Parse the `Image` field of an ECS container definition.
@@ -48976,14 +49104,14 @@ function isCdkAssetImageUri(uri) {
 */
 function parseContainerImage(raw, containerName, taskLogicalId, resources, _stack, context) {
 	const getAttImage = tryResolveImageGetAtt(raw, resources, context);
-	if (getAttImage) return classifyResolvedImage(getAttImage);
+	if (getAttImage) return classifyResolvedImage(getAttImage, context?.cdkAssetContainerRepo);
 	const joinResolved = tryResolveImageFnJoin(raw, resources, context);
-	if (joinResolved.kind === "resolved") return classifyResolvedImage(joinResolved.uri);
+	if (joinResolved.kind === "resolved") return classifyResolvedImage(joinResolved.uri, context?.cdkAssetContainerRepo);
 	if (joinResolved.kind === "needs-state") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' references same-stack ECR repository '${joinResolved.repoLogicalId}' via Fn::Join. cdkd local run-task cannot resolve the repository URI without state — pass --from-state (the stack must have been deployed via cdkd deploy), build via ContainerImage.fromAsset, or pin a public image.`);
 	if (joinResolved.kind === "unsupported-join") throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unsupported Fn::Join Image shape: ${joinResolved.reason}. cdkd local run-task recognizes the canonical CDK 2.x ContainerImage.fromEcrRepository Fn::Join shape (delimiter "" with nested Fn::Select/Fn::Split over an ECR Repository Arn GetAtt + Ref to the repo).`);
 	const flat = extractImageString(raw);
 	if (!flat) throw new EcsTaskResolutionError(`Container '${containerName}' in task '${taskLogicalId}' has an unparseable Image property. cdkd local run-task v1 supports flat string images, single-key Fn::Sub bodies, and CDK-asset Image references.`);
-	if (isCdkAssetImageUri(flat)) {
+	if (isCdkAssetImageUri(flat, context?.cdkAssetContainerRepo)) {
 		const hashMatch = /:([a-f0-9]{8,})$/.exec(flat);
 		const out = { kind: "cdk-asset" };
 		if (hashMatch) out.assetHash = hashMatch[1];
@@ -49029,9 +49157,11 @@ function findUnresolvedEcrRepositoryRef(substituted, resources) {
 * Classify a fully-substituted image URI (Tier 1 / Tier 2 produced a
 * concrete string) into the `ResolvedEcsImage` shape. Splits out so the
 * `Fn::GetAtt` path can share the regex-match branches.
+* `cdkAssetContainerRepo` is the optional marker-resolved custom repo
+* name (issue #1025) threaded through from the resolution context.
 */
-function classifyResolvedImage(uri) {
-	if (isCdkAssetImageUri(uri)) {
+function classifyResolvedImage(uri, cdkAssetContainerRepo) {
+	if (isCdkAssetImageUri(uri, cdkAssetContainerRepo)) {
 		const hashMatch = /:([a-f0-9]{8,})$/.exec(uri);
 		const out = { kind: "cdk-asset" };
 		if (hashMatch) out.assetHash = hashMatch[1];
@@ -53488,7 +53618,7 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 	const logger = getLogger();
 	if (!candidate) return void 0;
 	const needs = detectEcsImageResolutionNeeds(candidate);
-	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution) return;
+	if (!needs.needsPseudoParameters && !needs.needsStateResources && !needs.needsEnvOrSecretSubstitution && !needs.needsAssetRepoMarker) return;
 	const ctx = {};
 	const wantsPseudoForEnvOrSecret = !!stateProvider && needs.needsEnvOrSecretSubstitution;
 	if (needs.needsPseudoParameters || wantsPseudoForEnvOrSecret) {
@@ -53516,6 +53646,17 @@ async function buildEcsImageResolutionContext$1(candidate, stateProvider, option
 		if (loaded) ctx.stateResources = loaded.resources;
 	} else if (!stateProvider && needs.needsStateResources) logger.warn("Container Image references a same-stack AWS::ECR::Repository. Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute the deployed repository URI. Otherwise the resolver will surface its existing error.");
 	else if (!stateProvider && needs.needsEnvOrSecretSubstitution) logger.warn("Container Environment / Secrets entries contain CloudFormation intrinsics (Ref / Fn::GetAtt / Fn::Sub / Fn::Join). Pass --from-state (cdkd-deployed) or --from-cfn-stack (cdk-deployed) to substitute them against deployed state. Without a state source these entries are dropped (per-key warnings will follow).");
+	if (needs.needsAssetRepoMarker && options.fromState) {
+		const containerRepo = await loadBootstrapContainerRepo(candidate.region, {
+			statePrefix: options.statePrefix,
+			...options.stackRegion !== void 0 && { stackRegion: options.stackRegion },
+			...options.stateBucket !== void 0 && { stateBucket: options.stateBucket },
+			...options.region !== void 0 && { region: options.region },
+			...options.profile !== void 0 && { profile: options.profile },
+			logPrefix: "--from-state"
+		});
+		if (containerRepo !== void 0) ctx.cdkAssetContainerRepo = containerRepo;
+	}
 	return ctx;
 }
 function pickCandidateStack(stackPattern, stacks) {
@@ -57058,7 +57199,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.238.4");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.238.6");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());