@@ -92,6 +92,11 @@ export class CloudAssembly implements ICloudAssembly {
    */
   public readonly artifacts: CloudArtifact[];
 
+  /**
+   * Modified time
+   */
+  public readonly mtimeMs: number;
+
   /**
    * Runtime information such as module versions used to synthesize this assembly.
    */
@@ -115,11 +120,19 @@ export class CloudAssembly implements ICloudAssembly {
     this.directory = directory;
     this.loadOptions = loadOptions;
 
-    this.manifest = cxschema.Manifest.loadAssemblyManifest(path.join(directory, MANIFEST_FILE), this.loadOptions);
+    const manifestFile = path.join(directory, MANIFEST_FILE);
+    this.manifest = cxschema.Manifest.loadAssemblyManifest(manifestFile, this.loadOptions);
     this.version = this.manifest.version;
     this.artifacts = this.renderArtifacts(this.loadOptions?.topoSort ?? true);
     this.runtime = this.manifest.runtime || { libraries: { } };
 
+    try {
+      this.mtimeMs = fs.statSync(manifestFile).mtimeMs;
+    } catch (e) {
+      // Unlikely to happen but the file could have disappeared due to a race condition since reading it above.
+      this.mtimeMs = Date.now();
+    }
+
     Object.defineProperty(this, CLOUD_ASSEMBLY_SYMBOL, { value: true });
 
     // force validation of deps by accessing 'depends' on all artifacts
 
@@ -25,3 +25,5 @@ export * from './stack-trace';
 export * from './validation/formatting';
 export * from './validation/parsing';
 export * from './validation/loading';
+export * from './assembly-index';
+export { type ConstructInfo } from './tree-json-types';
@@ -43,6 +43,14 @@ export class StackTrace {
     }
     return undefined;
   }
+
+  public findFirstUserFrame(): StackFrame | undefined {
+    return this.findAndParse(DEFAULT_USER_CODE_FINDER);
+  }
+
+  public renderJustMyCode(indent = true): string[] {
+    return renderCallStackJustMyCode(this.frames.map(f => StackFrame.parse(f)), indent);
+  }
 }
 
 export class StackFrame {
@@ -99,32 +107,154 @@ export class StackFrame {
     fileName = m ? frame.slice(0, -m[0].length) : frame;
     sourceLocation = m ? m[0].slice(1) : '';
 
-    return {
+    return new StackFrame({
       fileName,
       functionName,
       sourceLocation,
+    });
+  }
+
+  /**
+   * The file name this call frame is in
+   */
+  public readonly fileName: string;
+
+  /**
+   * Name of the function this call frame is in
+   */
+  public readonly functionName: string;
+
+  /**
+   * The line and optionally column number this call frame is in
+   *
+   * Formatted as `<line> [':' <column>]`.
+   */
+  public readonly sourceLocation: string;
+
+  constructor(props: {
+    fileName: string;
+    functionName: string;
+    sourceLocation: string;
+  }) {
+    this.fileName = props.fileName;
+    this.functionName = props.functionName;
+    this.sourceLocation = props.sourceLocation;
+  }
+
+  public get lineLocation() {
+    if (!this.sourceLocation) {
+      return undefined;
+    }
+    const parts = this.sourceLocation.split(':');
+    const line = parseInt(parts[0], 10);
+    const column = parseInt(parts[1], 10);
+    return {
+      line: isNaN(line) ? undefined : line,
+      column: isNaN(column) ? undefined : column,
     };
   }
 
-  constructor(
-    /**
-     * Name of the function this call frame is in
-     */
-    public readonly functionName: string,
-
-    /**
-     * The file name this call frame is in
-     */
-    public readonly fileName: string,
-
-    /**
-     * The line and optionally column number this call frame is in
-     *
-     * Formatted as `<line> [':' <column>]`.
-     */
-    public readonly sourceLocation: string,
-  ) {
+  public get lineNumber(): number | undefined {
+    return this.lineLocation?.line;
+  }
+
+  public get columnNumber(): number | undefined {
+    return this.lineLocation?.column;
+  }
+}
+
+// Look for `/node_modules/` followed by either
+// - An @ sign, and 2 path segments
+// - No @ sign, and 1 path segment
+const MODULE_RE = /(\/|\\)node_modules(\/|\\)(@[^/\\]+[/\\][^/\\]+|[^@][^/\\]*)/;
+
+const DECORATOR_RE = /(\/|\\)(prop-injectable|no-box-stack-traces)\./;
+
+/**
+ * Renders an array of CallSites nicely, focusing on the user application code
+ *
+ * We detect "Not My Code" using the following heuristics:
+ *
+ * - If there is '/node_modules/' in the file path, we assume the call stack is a library and we skip it.
+ * - If there is 'node:' in the file path, we assume it is NodeJS internals and we skip it.
+ * - We skip (and hide) 'prop-injectable' or 'no-box-stack-traces' in the trace, because those are
+ *   constructor decorators that hide what's interesting (and look weird).
+ *
+ * If `indent` is enabled, we will prefix stack frames of actual files with "  at ", just like
+ * Node does for its stack frames.
+ */
+function renderCallStackJustMyCode(stack: StackFrame[], indent = true): string[] {
+  const lines = [];
+  let skipped = new Array<{ functionName?: string; fileName: string }>();
+
+  let sawMyCode = false;
+  let i = 0;
+  while (i < stack.length) {
+    const frame = stack[i++];
+
+    if (frame.fileName.match(DECORATOR_RE)) {
+      continue;
+    }
+
+    const pat = frame.fileName.match(MODULE_RE);
+    if (pat) {
+      while (i < stack.length && stack[i].fileName.includes(pat[0])) {
+        i++;
+      }
+      // The last stack frame has the function that user code call into.
+      skip({ functionName: stack[i - 1].functionName, fileName: pat[3] });
+    } else if (frame.fileName.includes('node:')) {
+      skip({ fileName: 'node internals' });
+      while (i < stack.length && stack[i].fileName.includes('node:')) {
+        i++;
+      }
+    } else if (isHostInternalFrame(frame)) {
+      skip({ fileName: 'jsii runtime' });
+      while (i < stack.length && isHostInternalFrame(stack[i])) {
+        i++;
+      }
+    } else {
+      reportSkipped(true);
+      const prefix = indent ? '    at ' : '';
+      lines.push(`${prefix}${frame.functionName} (${frame.fileName}:${frame.sourceLocation})`);
+      sawMyCode = true;
+    }
+  }
+  reportSkipped(false);
+
+  if (!sawMyCode) {
+    lines.push(`${indent ? '    ' : ''}(no user code in ${Error.stackTraceLimit} frames, use --stack-trace-limit to capture more)`);
+  }
+
+  return lines;
+
+  function skip(what: typeof skipped[number]) {
+    if (!skipped.find(x => x.fileName === what.fileName && x.functionName === what.functionName)) {
+      skipped.push(what);
+    }
+  }
+
+  function reportSkipped(includeFunction: boolean) {
+    if (skipped.length > 0) {
+      const rendered = skipped.map((s, j) =>
+        // Only render the function name of the last frame before user code
+        j === skipped.length - 1 && s.functionName && includeFunction ?
+          `${s.functionName} in ${s.fileName}` : s.fileName);
 
+      const prefix = indent ? '    ' : '';
+      lines.push(`${prefix}...${rendered.join(', ')}...`);
+    }
+    skipped = [];
   }
 }
 
+const JSII_HOST_DIR_NAME_SYM = Symbol.for('jsii.context.hostDirName');
+
+/**
+ * Whether the call site comes from the internals of the host that sent us the stack trace
+ */
+function isHostInternalFrame(frame: StackFrame): boolean {
+  const hostDirName = (global as any)[JSII_HOST_DIR_NAME_SYM];
+  return hostDirName && frame.fileName.includes(hostDirName);
+}
+
@@ -0,0 +1,85 @@
+/**
+ * Serializable representation of a construct
+ */
+export interface Node<Child> {
+  /**
+   * The construct's ID
+   *
+   * Even though this ID is already in the `children` map of the containing node,
+   * we repeat it here.
+   */
+  readonly id: string;
+
+  /**
+   * The construct's path
+   *
+   * Even though this path can be constructed from the construct IDs of constructs
+   * on the root path to this construct, we still repeat it here.
+   *
+   * FIXME: In a sizeable file (tested on 136MB) this takes about 20% of the
+   * total size without adding any value. We should probably remove this at some
+   * point.
+   */
+  readonly path: string;
+  children?: { [key: string]: Child };
+  attributes?: { [key: string]: unknown };
+
+  /**
+   * Information on the construct class that led to this node, if available
+   */
+  constructInfo?: ConstructInfo;
+}
+
+export interface TreeFile {
+  version: 'tree-0.1';
+  tree: TreeFileNode;
+}
+
+export interface ForestFile {
+  version: 'forest-0.1';
+  forest: Record<string, TreeFileNode>;
+}
+
+export type TreeFileNode = Node<TreeFileNode> | SubTreeReference;
+
+export type TreeNode = Node<TreeNode>;
+
+/**
+ * A reference to a node that is stored in an entirely different tree.json file
+ */
+export interface SubTreeReference {
+  readonly id: string;
+  readonly path: string;
+  fileName: string;
+
+  /**
+   * If set, indicates the subtree in the forest file
+   *
+   * If this is set then `fileName` must point to a ForestFile, and this indicates
+   * the tree inside the forest.
+   */
+  treeId: string;
+}
+
+/**
+ * Source information on a construct (class fqn and version)
+ */
+export interface ConstructInfo {
+  // !!! Important !!!
+  // This is the public contract of what shows up in tree.json
+  // We are very unlikely to extend this in future
+  // I you need additional details, add them on top of this.
+
+  /**
+   * The FQN of the construct.
+   */
+  readonly fqn: string;
+  /**
+   * The version of the package the construct belongs to.
+   */
+  readonly version: string;
+}
+
+export function isSubtreeReference(x: TreeFileNode): x is SubTreeReference {
+  return (x as SubTreeReference).fileName !== undefined && !!(x as SubTreeReference).treeId;
+}
@@ -5,6 +5,7 @@ import type * as cxschema from '@aws-cdk/cloud-assembly-schema';
 import type { CloudFormationStackArtifact } from '../artifacts/cloudformation-artifact';
 import { SynthesisMessageLevel } from '../metadata';
 import { ANNOTATION_PLUGIN_NAME } from './parsing';
+import { StackTrace } from '../stack-trace';
 
 const VALIDATION_REPORT_FILE = 'validation-report.json';
 
@@ -131,14 +132,11 @@ function pluginReportFromAnnotations(stacks: CloudFormationStackArtifact[]): cxs
       violation.violatingConstructs.push({
         constructPath: entry.id.replace(/^\//, ''), // remove leading slash
 
-        // TODO: see if this information can be obtained from tree.json
-        // cloudFormationResource
-        // constructFqn:
-        // libraryVersion
-
-        // TODO: see if we can get this from metadata stack traces. We may need to re-enable them for
-        // annotations in the core library. Otherwise we should probably get a stack trace to the resource itself.
-        // stackTraces
+        // If we get this stack trace here, it was recorded by the `constructs` library,
+        // which means it hasn't been JustMyCode-stripped yet.
+        stackTraces: entry.entry.trace ? [
+          new StackTrace(entry.entry.trace).renderJustMyCode().join('\n'),
+        ] : [],
       });
     }
   }