@go-to-k/cdkd 0.243.0 → 0.244.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-DNqZHDA5.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-3KNTmr1u.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -59,13 +59,14 @@ import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSu
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
+import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$21, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3tables";
+import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$21, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1888,7 +1889,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.243.0";
+	return "0.244.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -34402,6 +34403,601 @@ var EFSProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/fsx-filesystem-provider.ts
+/**
+* Default polling budget for FSx lifecycle transitions. Lustre SCRATCH
+* creates typically finish in 5-10 minutes, but PERSISTENT creates,
+* storage-capacity growth and deletes can take substantially longer —
+* mirror the Custom Resource provider's 1-hour ceiling.
+*/
+const DEFAULT_MAX_WAIT_MS = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS = 15e3;
+/**
+* Lustre sub-properties that `UpdateFileSystem` accepts (the mutable
+* subset of the CFn `LustreConfiguration` block). Everything else in the
+* block is fixed at creation — FSx has no API to change it in place.
+*/
+const LUSTRE_MUTABLE_SUBPROPS = new Set([
+	"WeeklyMaintenanceStartTime",
+	"DailyAutomaticBackupStartTime",
+	"AutomaticBackupRetentionDays",
+	"AutoImportPolicy",
+	"DataCompressionType",
+	"PerUnitStorageThroughput",
+	"MetadataConfiguration",
+	"ThroughputCapacity",
+	"DataReadCacheConfiguration"
+]);
+/**
+* Top-level properties that are create-only per the CFn registry schema
+* (`createOnlyProperties`). A change on any of these is routed through
+* DELETE+CREATE by the replacement-detection layer; if a diff somehow
+* reaches update() with one of them changed, refuse loudly instead of
+* silently applying a partial update.
+*/
+const TOP_LEVEL_IMMUTABLE_PROPS = [
+	"FileSystemType",
+	"SubnetIds",
+	"SecurityGroupIds",
+	"KmsKeyId",
+	"BackupId"
+];
+const toNumber = (v) => v === void 0 ? void 0 : Number(v);
+const toBoolean = (v) => {
+	if (v === void 0) return void 0;
+	if (typeof v === "string") return v === "true";
+	return Boolean(v);
+};
+/**
+* SDK Provider for `AWS::FSx::FileSystem`.
+*
+* The type is `ProvisioningType: NON_PROVISIONABLE` in the CFn registry,
+* so cdkd's Cloud Control fallback cannot handle it (issue #1042).
+*
+* v1 scope: the **Lustre** variant (the CDK L2, `aws-fsx.LustreFileSystem`).
+* The `WindowsConfiguration` / `OntapConfiguration` / `OpenZFSConfiguration`
+* sub-trees are declared `unhandledByDesign`, so templates using them are
+* rejected by the property-coverage pre-flight instead of silently dropping
+* the whole variant config (each non-Lustre `FileSystemType` REQUIRES its
+* variant block, so no non-Lustre template can slip past the pre-flight).
+*
+* Lifecycle handling — every mutation is async on AWS:
+*  - `create` → `CreateFileSystem` (or `CreateFileSystemFromBackup` when
+*    `BackupId` is set) + poll `DescribeFileSystems` until `AVAILABLE`.
+*  - `update` → `UpdateFileSystem` for the mutable surface (StorageCapacity,
+*    Lustre mutable sub-props, StorageType, FileSystemTypeVersion,
+*    NetworkType) + `TagResource`/`UntagResource` for `Tags`; polls back to
+*    `AVAILABLE`.
+*  - `delete` → `DeleteFileSystem` + poll until the file system is GONE
+*    (`FileSystemNotFound` / dropped from the Describe response). A timeout
+*    here is a hard error — a lingering FSx file system bills per hour.
+*
+* `getMinResourceTimeoutMs()` lifts the deploy engine's per-resource
+* deadline to the polling ceiling (mirrors `CustomResourceProvider`), so
+* slow FSx creates don't require a manual `--resource-timeout`.
+*/
+var FSxFileSystemProvider = class {
+	/**
+	* Cloud Control has NO handlers for this type (`ProvisioningType:
+	* NON_PROVISIONABLE` in the CFn registry), so the deploy engine's #614
+	* silent-drop auto-route MUST NOT send a Windows/ONTAP/OpenZFS template
+	* to CC — it would fail at provisioning time with an opaque
+	* UnsupportedActionException. With this opt-out the ProviderRegistry
+	* rejects such templates pre-flight with a clear error instead.
+	* (The runtime Tier 3 set cannot express this: it excludes SDK-covered
+	* types by design, so `isNonProvisionable()` is false for this type.)
+	*/
+	disableCcApiFallback = true;
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("FSxFileSystemProvider");
+	pollIntervalMs;
+	maxWaitMs;
+	constructor(options) {
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
+	}
+	handledProperties = new Map([["AWS::FSx::FileSystem", new Set([
+		"BackupId",
+		"FileSystemType",
+		"FileSystemTypeVersion",
+		"KmsKeyId",
+		"LustreConfiguration",
+		"NetworkType",
+		"SecurityGroupIds",
+		"StorageCapacity",
+		"StorageType",
+		"SubnetIds",
+		"Tags"
+	])]]);
+	unhandledByDesign = new Map([["AWS::FSx::FileSystem", new Map([
+		["WindowsConfiguration", "FSx for Windows File Server variant — requires Active Directory wiring and Windows-specific update/delete semantics (final backups, throughput tiers) that v1 does not implement; only the Lustre variant (the CDK L2) is supported. Follow-up to issue #1042."],
+		["OntapConfiguration", "FSx for NetApp ONTAP variant — the file system is only a container for SVMs/volumes (separate AWS::FSx::StorageVirtualMachine / AWS::FSx::Volume types, both still unsupported), so shipping it alone would be misleading; only the Lustre variant is supported in v1. Follow-up to issue #1042."],
+		["OpenZFSConfiguration", "FSx for OpenZFS variant — root-volume semantics (RootVolumeId, child AWS::FSx::Volume trees) are not implemented in v1; only the Lustre variant is supported. Follow-up to issue #1042."]
+	])]]);
+	getClient() {
+		if (!this.client) this.client = new FSxClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	/**
+	* Self-reported minimum per-resource timeout: the deploy engine resolves
+	* `max(getMinResourceTimeoutMs(), globalCliDefault)` so FSx's slow
+	* create/delete polling fits inside the resource deadline without the
+	* user passing `--resource-timeout`.
+	*/
+	getMinResourceTimeoutMs() {
+		return this.maxWaitMs;
+	}
+	async create(logicalId, resourceType, properties) {
+		if (resourceType !== "AWS::FSx::FileSystem") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		const backupId = properties["BackupId"];
+		const fileSystemType = properties["FileSystemType"];
+		if (backupId === void 0 && fileSystemType !== "LUSTRE") throw new ProvisioningError(`AWS::FSx::FileSystem: FileSystemType '${fileSystemType ?? "(unset)"}' is not supported by cdkd yet — only the LUSTRE variant is implemented (issue #1042). Windows / ONTAP / OpenZFS file systems can follow in a later PR.`, resourceType, logicalId);
+		this.logger.debug(`Creating FSx FileSystem ${logicalId}`);
+		const tokenHash = createHash("sha256").update([
+			properties["FileSystemType"],
+			properties["SubnetIds"],
+			properties["SecurityGroupIds"],
+			properties["KmsKeyId"],
+			properties["BackupId"]
+		].map((v) => JSON.stringify(v ?? null)).join(" ")).digest("hex").slice(0, 12);
+		const clientRequestToken = `cdkd-${logicalId.slice(0, 45)}-${tokenHash}`;
+		const tags = properties["Tags"];
+		const common = {
+			ClientRequestToken: clientRequestToken,
+			SubnetIds: properties["SubnetIds"],
+			SecurityGroupIds: properties["SecurityGroupIds"],
+			KmsKeyId: properties["KmsKeyId"],
+			StorageType: properties["StorageType"],
+			StorageCapacity: toNumber(properties["StorageCapacity"]),
+			FileSystemTypeVersion: properties["FileSystemTypeVersion"],
+			NetworkType: properties["NetworkType"],
+			LustreConfiguration: this.toCreateLustreConfiguration(properties["LustreConfiguration"]),
+			Tags: tags?.map((t) => ({
+				Key: t.Key,
+				Value: t.Value
+			}))
+		};
+		let fileSystemId;
+		try {
+			let created;
+			if (backupId !== void 0) created = (await this.getClient().send(new CreateFileSystemFromBackupCommand({
+				...common,
+				BackupId: backupId
+			}))).FileSystem;
+			else created = (await this.getClient().send(new CreateFileSystemCommand$1({
+				...common,
+				FileSystemType: fileSystemType
+			}))).FileSystem;
+			fileSystemId = created?.FileSystemId;
+			if (!fileSystemId) throw new ProvisioningError(`FSx CreateFileSystem for ${logicalId} returned no FileSystemId`, resourceType, logicalId);
+			const fs = await this.waitForFileSystemAvailable(fileSystemId, logicalId, resourceType);
+			this.logger.debug(`Successfully created FSx FileSystem ${logicalId}: ${fileSystemId}`);
+			return {
+				physicalId: fileSystemId,
+				attributes: this.buildAttributes(fs)
+			};
+		} catch (error) {
+			if (fileSystemId !== void 0) try {
+				await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: fileSystemId }));
+				this.logger.warn(`Rolled back partially-created FSx FileSystem ${fileSystemId}`);
+			} catch (cleanupError) {
+				this.logger.warn(`Failed to roll back partially-created FSx FileSystem ${fileSystemId}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)} — delete it manually to stop billing`);
+			}
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create FSx FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Map the CFn `LustreConfiguration` block to the SDK create shape. The
+	* field names are identical (both PascalCase); numeric / boolean fields
+	* are coerced defensively because template values can arrive as strings.
+	*/
+	toCreateLustreConfiguration(config) {
+		if (!config) return void 0;
+		const metadata = config["MetadataConfiguration"];
+		const readCache = config["DataReadCacheConfiguration"];
+		return {
+			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
+			ImportPath: config["ImportPath"],
+			ExportPath: config["ExportPath"],
+			ImportedFileChunkSize: toNumber(config["ImportedFileChunkSize"]),
+			DeploymentType: config["DeploymentType"],
+			AutoImportPolicy: config["AutoImportPolicy"],
+			PerUnitStorageThroughput: toNumber(config["PerUnitStorageThroughput"]),
+			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
+			AutomaticBackupRetentionDays: toNumber(config["AutomaticBackupRetentionDays"]),
+			CopyTagsToBackups: toBoolean(config["CopyTagsToBackups"]),
+			DriveCacheType: config["DriveCacheType"],
+			DataCompressionType: config["DataCompressionType"],
+			EfaEnabled: toBoolean(config["EfaEnabled"]),
+			ThroughputCapacity: toNumber(config["ThroughputCapacity"]),
+			MetadataConfiguration: metadata ? {
+				Mode: metadata["Mode"],
+				Iops: toNumber(metadata["Iops"])
+			} : void 0,
+			DataReadCacheConfiguration: readCache ? {
+				SizingMode: readCache["SizingMode"],
+				SizeGiB: toNumber(readCache["SizeGiB"])
+			} : void 0
+		};
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		const changed = (key) => JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key]);
+		for (const key of TOP_LEVEL_IMMUTABLE_PROPS) {
+			const next = properties[key];
+			const prev = previousProperties[key];
+			if (JSON.stringify(next ?? null) !== JSON.stringify(prev ?? null)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${key} is immutable on AWS — UpdateFileSystem does not accept ${key}; the property is fixed at creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+		}
+		const nextLustre = properties["LustreConfiguration"] ?? {};
+		const prevLustre = previousProperties["LustreConfiguration"] ?? {};
+		const lustreKeys = new Set([...Object.keys(nextLustre), ...Object.keys(prevLustre)]);
+		const lustreMutableDiff = {};
+		let lustreHasMutableDiff = false;
+		for (const key of lustreKeys) {
+			const next = nextLustre[key];
+			const prev = prevLustre[key];
+			if (JSON.stringify(next) === JSON.stringify(prev)) continue;
+			if (!LUSTRE_MUTABLE_SUBPROPS.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem LustreConfiguration.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			lustreHasMutableDiff = true;
+			switch (key) {
+				case "WeeklyMaintenanceStartTime":
+				case "DailyAutomaticBackupStartTime":
+					lustreMutableDiff[key] = next;
+					break;
+				case "AutomaticBackupRetentionDays":
+				case "PerUnitStorageThroughput":
+				case "ThroughputCapacity":
+					lustreMutableDiff[key] = toNumber(next);
+					break;
+				case "AutoImportPolicy":
+				case "DataCompressionType":
+					lustreMutableDiff[key] = next;
+					break;
+				case "MetadataConfiguration": {
+					const metadata = next;
+					lustreMutableDiff.MetadataConfiguration = metadata ? {
+						Mode: metadata["Mode"],
+						Iops: toNumber(metadata["Iops"])
+					} : void 0;
+					break;
+				}
+				case "DataReadCacheConfiguration": {
+					const readCache = next;
+					lustreMutableDiff.DataReadCacheConfiguration = readCache ? {
+						SizingMode: readCache["SizingMode"],
+						SizeGiB: toNumber(readCache["SizeGiB"])
+					} : void 0;
+					break;
+				}
+			}
+		}
+		const storageCapacityChanged = changed("StorageCapacity");
+		const storageTypeChanged = changed("StorageType");
+		const typeVersionChanged = changed("FileSystemTypeVersion");
+		const networkTypeChanged = changed("NetworkType");
+		const tagsChanged = changed("Tags");
+		if (!lustreHasMutableDiff && !storageCapacityChanged && !storageTypeChanged && !typeVersionChanged && !networkTypeChanged && !tagsChanged) {
+			this.logger.debug(`No mutable diff for FSx FileSystem ${logicalId}, skipping update`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		}
+		this.logger.debug(`Updating FSx FileSystem ${logicalId}: ${physicalId}`);
+		try {
+			const needsUpdateCall = lustreHasMutableDiff || storageCapacityChanged || storageTypeChanged || typeVersionChanged || networkTypeChanged;
+			let updatedFs;
+			if (needsUpdateCall) {
+				const callTimeMs = Date.now();
+				const respPendingActions = ((await this.getClient().send(new UpdateFileSystemCommand$1({
+					FileSystemId: physicalId,
+					...storageCapacityChanged && { StorageCapacity: toNumber(properties["StorageCapacity"]) },
+					...storageTypeChanged && { StorageType: properties["StorageType"] },
+					...typeVersionChanged && { FileSystemTypeVersion: properties["FileSystemTypeVersion"] },
+					...networkTypeChanged && { NetworkType: properties["NetworkType"] },
+					...lustreHasMutableDiff && { LustreConfiguration: lustreMutableDiff }
+				}))).FileSystem?.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.Status === "PENDING" || a.Status === "IN_PROGRESS"));
+				const requestTimes = respPendingActions.map((a) => a.RequestTime?.getTime()).filter((t) => t !== void 0);
+				const actionThresholdMs = requestTimes.length > 0 ? Math.min(...requestTimes) : callTimeMs - 6e4;
+				updatedFs = await this.waitForUpdateActionComplete(physicalId, logicalId, resourceType, actionThresholdMs, respPendingActions.length > 0);
+			}
+			if (tagsChanged) await this.applyTagDiff(physicalId, properties["Tags"], previousProperties["Tags"]);
+			if (!updatedFs) try {
+				updatedFs = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [physicalId] }))).FileSystems?.[0];
+			} catch (describeError) {
+				this.logger.debug(`Post-update attribute refresh for ${physicalId} failed (returning without attributes): ${describeError instanceof Error ? describeError.message : String(describeError)}`);
+			}
+			this.logger.debug(`Successfully updated FSx FileSystem ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				...updatedFs && { attributes: this.buildAttributes(updatedFs) }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update FSx FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Apply a `Tags` diff via `TagResource` / `UntagResource` (the FSx
+	* `UpdateFileSystem` API does not accept tags). Needs the ARN — resolve
+	* it from `DescribeFileSystems`.
+	*/
+	async applyTagDiff(physicalId, nextTags, prevTags) {
+		const arn = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [physicalId] }))).FileSystems?.[0]?.ResourceARN;
+		if (!arn) throw new Error(`could not resolve ResourceARN for FSx FileSystem ${physicalId}`);
+		const next = new Map((nextTags ?? []).map((t) => [t.Key, t.Value]));
+		const prev = new Map((prevTags ?? []).map((t) => [t.Key, t.Value]));
+		const toSet = [];
+		for (const [key, value] of next) {
+			if (key === void 0) continue;
+			if (prev.get(key) !== value) toSet.push({
+				Key: key,
+				Value: value
+			});
+		}
+		const toRemove = [];
+		for (const key of prev.keys()) if (key !== void 0 && !next.has(key)) toRemove.push(key);
+		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$18({
+			ResourceARN: arn,
+			Tags: toSet
+		}));
+		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$18({
+			ResourceARN: arn,
+			TagKeys: toRemove
+		}));
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting FSx FileSystem ${logicalId}: ${physicalId}`);
+		try {
+			await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: physicalId }));
+		} catch (error) {
+			if (error instanceof FileSystemNotFound$1) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`FSx FileSystem ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete FSx FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		await this.waitForFileSystemDeleted(physicalId, logicalId, resourceType);
+		this.logger.debug(`Successfully deleted FSx FileSystem ${logicalId}`);
+	}
+	/**
+	* Issue the polling `DescribeFileSystems` with bounded tolerance for
+	* TRANSIENT errors (throttling / 5xx / connection resets): up to
+	* `maxConsecutiveTransient` consecutive failures are absorbed (with the
+	* normal poll delay) before the error propagates. A 5-10 minute create
+	* poll at 15s intervals would otherwise turn a single throttle into a
+	* spurious failure + best-effort rollback cycle. Non-transient errors
+	* (incl. FileSystemNotFound) propagate immediately.
+	*/
+	async describeForPoll(fileSystemId, transientState, maxConsecutiveTransient = 5) {
+		try {
+			const response = await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [fileSystemId] }));
+			transientState.count = 0;
+			return response.FileSystems?.[0];
+		} catch (error) {
+			const name = error instanceof Error ? error.name : "";
+			const msg = error instanceof Error ? error.message : String(error);
+			if ((name === "ThrottlingException" || name === "ServiceLimitExceeded" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
+				transientState.count += 1;
+				this.logger.debug(`Transient DescribeFileSystems error while polling ${fileSystemId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
+				return;
+			}
+			throw error;
+		}
+	}
+	async waitForFileSystemAvailable(fileSystemId, logicalId, resourceType) {
+		const startTime = Date.now();
+		const transientState = { count: 0 };
+		while (Date.now() - startTime < this.maxWaitMs) {
+			const fs = await this.describeForPoll(fileSystemId, transientState);
+			const lifecycle = fs?.Lifecycle;
+			if (fs && lifecycle === "AVAILABLE") return fs;
+			if (lifecycle === "FAILED" || lifecycle === "MISCONFIGURED") throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state ${lifecycle}: ${fs?.FailureDetails?.Message ?? "no failure details reported"}`, resourceType, logicalId, fileSystemId);
+			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${lifecycle ?? "unknown"}, waiting...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(`Timed out waiting for FSx FileSystem ${fileSystemId} to become AVAILABLE (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fileSystemId);
+	}
+	/**
+	* Wait until the async `FILE_SYSTEM_UPDATE` administrative action kicked
+	* off by `UpdateFileSystem` completes (and the Lifecycle is AVAILABLE).
+	* `STORAGE_OPTIMIZATION` actions are intentionally ignored — they can run
+	* for hours after a capacity grow, and CloudFormation does not wait for
+	* them either (`UPDATED_OPTIMIZING` counts as done). A FAILED update
+	* action is a hard error carrying the action's failure message.
+	*
+	* `actionThresholdMs` scopes the wait to THIS update's actions: FSx keeps
+	* terminal (COMPLETED / FAILED) actions in the history, so only actions
+	* whose `RequestTime` is at or after the threshold are considered — a
+	* PAST failed update must not fail this one's retry. An action without a
+	* `RequestTime` is conservatively tracked.
+	*
+	* `requireActionObservation` guards the eventual-consistency race: when
+	* the UpdateFileSystem response confirmed a newly-created action, the
+	* wait refuses to return until an in-threshold action has been observed
+	* in at least one Describe response — a lagging read replica could
+	* otherwise briefly show none and cause a premature return with the
+	* pre-update config. Terminal actions stay in the history, so the
+	* observation is guaranteed to eventually succeed (bounded by
+	* `maxWaitMs`).
+	*/
+	async waitForUpdateActionComplete(fileSystemId, logicalId, resourceType, actionThresholdMs, requireActionObservation) {
+		const startTime = Date.now();
+		const transientState = { count: 0 };
+		let seenTrackedAction = false;
+		while (Date.now() - startTime < this.maxWaitMs) {
+			const fs = await this.describeForPoll(fileSystemId, transientState);
+			if (fs) {
+				const updateActions = (fs.AdministrativeActions ?? []).filter((a) => a.AdministrativeActionType === "FILE_SYSTEM_UPDATE" && (a.RequestTime === void 0 || a.RequestTime.getTime() >= actionThresholdMs));
+				if (updateActions.length > 0) seenTrackedAction = true;
+				const failed = updateActions.find((a) => a.Status === "FAILED");
+				if (failed) throw new ProvisioningError(`FSx FileSystem ${fileSystemId} update failed (FILE_SYSTEM_UPDATE administrative action): ${failed.FailureDetails?.Message ?? "no failure details reported"}`, resourceType, logicalId, fileSystemId);
+				if (!updateActions.some((a) => a.Status === "PENDING" || a.Status === "IN_PROGRESS") && (!requireActionObservation || seenTrackedAction) && fs.Lifecycle === "AVAILABLE") return fs;
+				this.logger.debug(`FSx FileSystem ${fileSystemId} update in progress (lifecycle: ${fs.Lifecycle ?? "unknown"}), waiting...`);
+			}
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(`Timed out waiting for FSx FileSystem ${fileSystemId} update to complete (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fileSystemId);
+	}
+	async waitForFileSystemDeleted(fileSystemId, logicalId, resourceType) {
+		const startTime = Date.now();
+		const transientState = { count: 0 };
+		while (Date.now() - startTime < this.maxWaitMs) {
+			let fs;
+			let sawResponse = true;
+			try {
+				fs = await this.describeForPoll(fileSystemId, transientState);
+				if (fs === void 0 && transientState.count > 0) sawResponse = false;
+			} catch (error) {
+				if (error instanceof FileSystemNotFound$1) return;
+				const cause = error instanceof Error ? error : void 0;
+				throw new ProvisioningError(`Failed to poll FSx FileSystem ${fileSystemId} deletion: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, fileSystemId, cause);
+			}
+			if (!fs && sawResponse) return;
+			if (!fs) {
+				await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+				continue;
+			}
+			if (fs.Lifecycle === "FAILED") throw new ProvisioningError(`FSx FileSystem ${fileSystemId} entered lifecycle state FAILED during deletion: ${fs.FailureDetails?.Message ?? "no failure details reported"}`, resourceType, logicalId, fileSystemId);
+			this.logger.debug(`FSx FileSystem ${fileSystemId} state: ${fs.Lifecycle ?? "unknown"}, waiting for deletion...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(`Timed out waiting for FSx FileSystem ${fileSystemId} deletion (${Math.round(this.maxWaitMs / 6e4)} min) — verify and delete it manually to stop billing`, resourceType, logicalId, fileSystemId);
+	}
+	buildAttributes(fs) {
+		const attributes = {};
+		if (fs.ResourceARN !== void 0) attributes["ResourceARN"] = fs.ResourceARN;
+		if (fs.DNSName !== void 0) attributes["DNSName"] = fs.DNSName;
+		if (fs.LustreConfiguration?.MountName !== void 0) attributes["LustreMountName"] = fs.LustreConfiguration.MountName;
+		if (fs.FileSystemId !== void 0) attributes["FileSystemId"] = fs.FileSystemId;
+		return attributes;
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "Id" || attributeName === "FileSystemId") return physicalId;
+		const fs = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [physicalId] }))).FileSystems?.[0];
+		if (!fs) return void 0;
+		switch (attributeName) {
+			case "ResourceARN": return fs.ResourceARN;
+			case "DNSName": return fs.DNSName;
+			case "LustreMountName": return fs.LustreConfiguration?.MountName;
+			case "RootVolumeId": return fs.OpenZFSConfiguration?.RootVolumeId;
+			default: return;
+		}
+	}
+	/**
+	* State property paths this provider cannot read back from AWS:
+	*  - `SecurityGroupIds` — `DescribeFileSystems` returns network
+	*    interface ids, never the original security group list.
+	*  - `BackupId` — creation-source input, not surfaced on the deployed
+	*    file system.
+	*/
+	getDriftUnknownPaths(resourceType) {
+		if (resourceType !== "AWS::FSx::FileSystem") return [];
+		return ["SecurityGroupIds", "BackupId"];
+	}
+	/**
+	* Read the AWS-current file system configuration in CFn-property shape
+	* via `DescribeFileSystems`. Lustre data-repository fields (`ImportPath`
+	* / `ExportPath` / `AutoImportPolicy` / `ImportedFileChunkSize`) are
+	* mapped back from the nested `DataRepositoryConfiguration` the API
+	* returns. Returns `undefined` when the file system is gone.
+	*/
+	async readCurrentState(physicalId, _logicalId, resourceType) {
+		if (resourceType !== "AWS::FSx::FileSystem") return void 0;
+		let fs;
+		try {
+			fs = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [physicalId] }))).FileSystems?.[0];
+		} catch (err) {
+			if (err instanceof FileSystemNotFound$1) return void 0;
+			throw err;
+		}
+		if (!fs) return void 0;
+		const result = {};
+		if (fs.FileSystemType !== void 0) result["FileSystemType"] = fs.FileSystemType;
+		if (fs.StorageCapacity !== void 0) result["StorageCapacity"] = fs.StorageCapacity;
+		if (fs.StorageType !== void 0) result["StorageType"] = fs.StorageType;
+		if (fs.SubnetIds !== void 0) result["SubnetIds"] = [...fs.SubnetIds];
+		if (fs.KmsKeyId !== void 0) result["KmsKeyId"] = fs.KmsKeyId;
+		if (fs.FileSystemTypeVersion !== void 0) result["FileSystemTypeVersion"] = fs.FileSystemTypeVersion;
+		if (fs.NetworkType !== void 0) result["NetworkType"] = fs.NetworkType;
+		const lustre = fs.LustreConfiguration;
+		if (lustre) {
+			const config = {};
+			if (lustre.WeeklyMaintenanceStartTime !== void 0) config["WeeklyMaintenanceStartTime"] = lustre.WeeklyMaintenanceStartTime;
+			if (lustre.DeploymentType !== void 0) config["DeploymentType"] = lustre.DeploymentType;
+			if (lustre.PerUnitStorageThroughput !== void 0) config["PerUnitStorageThroughput"] = lustre.PerUnitStorageThroughput;
+			if (lustre.DailyAutomaticBackupStartTime !== void 0) config["DailyAutomaticBackupStartTime"] = lustre.DailyAutomaticBackupStartTime;
+			if (lustre.AutomaticBackupRetentionDays !== void 0) config["AutomaticBackupRetentionDays"] = lustre.AutomaticBackupRetentionDays;
+			if (lustre.CopyTagsToBackups !== void 0) config["CopyTagsToBackups"] = lustre.CopyTagsToBackups;
+			if (lustre.DriveCacheType !== void 0) config["DriveCacheType"] = lustre.DriveCacheType;
+			if (lustre.DataCompressionType !== void 0) config["DataCompressionType"] = lustre.DataCompressionType;
+			if (lustre.EfaEnabled !== void 0) config["EfaEnabled"] = lustre.EfaEnabled;
+			if (lustre.ThroughputCapacity !== void 0) config["ThroughputCapacity"] = lustre.ThroughputCapacity;
+			if (lustre.MetadataConfiguration) {
+				const metadata = {};
+				if (lustre.MetadataConfiguration.Mode !== void 0) metadata["Mode"] = lustre.MetadataConfiguration.Mode;
+				if (lustre.MetadataConfiguration.Iops !== void 0) metadata["Iops"] = lustre.MetadataConfiguration.Iops;
+				if (Object.keys(metadata).length > 0) config["MetadataConfiguration"] = metadata;
+			}
+			if (lustre.DataReadCacheConfiguration) {
+				const readCache = {};
+				if (lustre.DataReadCacheConfiguration.SizingMode !== void 0) readCache["SizingMode"] = lustre.DataReadCacheConfiguration.SizingMode;
+				if (lustre.DataReadCacheConfiguration.SizeGiB !== void 0) readCache["SizeGiB"] = lustre.DataReadCacheConfiguration.SizeGiB;
+				if (Object.keys(readCache).length > 0) config["DataReadCacheConfiguration"] = readCache;
+			}
+			const dataRepo = lustre.DataRepositoryConfiguration;
+			if (dataRepo) {
+				if (dataRepo.ImportPath !== void 0) config["ImportPath"] = dataRepo.ImportPath;
+				if (dataRepo.ExportPath !== void 0) config["ExportPath"] = dataRepo.ExportPath;
+				if (dataRepo.AutoImportPolicy !== void 0) config["AutoImportPolicy"] = dataRepo.AutoImportPolicy;
+				if (dataRepo.ImportedFileChunkSize !== void 0) config["ImportedFileChunkSize"] = dataRepo.ImportedFileChunkSize;
+			}
+			if (Object.keys(config).length > 0) result["LustreConfiguration"] = config;
+		}
+		result["Tags"] = normalizeAwsTagsToCfn(fs.Tags);
+		return result;
+	}
+	/**
+	* Adopt an existing FSx file system into cdkd state. Explicit physical
+	* id is verified via `DescribeFileSystems`; otherwise a paginated walk
+	* matches the `aws:cdk:path` tag (`Tags` ride inline on each item).
+	*/
+	async import(input) {
+		if (input.resourceType !== "AWS::FSx::FileSystem") return null;
+		if (input.knownPhysicalId) try {
+			const fs = (await this.getClient().send(new DescribeFileSystemsCommand$1({ FileSystemIds: [input.knownPhysicalId] }))).FileSystems?.[0];
+			return fs?.FileSystemId ? {
+				physicalId: fs.FileSystemId,
+				attributes: this.buildAttributes(fs)
+			} : null;
+		} catch (err) {
+			if (err instanceof FileSystemNotFound$1) return null;
+			throw err;
+		}
+		if (!input.cdkPath) return null;
+		let nextToken;
+		do {
+			const list = await this.getClient().send(new DescribeFileSystemsCommand$1({ ...nextToken && { NextToken: nextToken } }));
+			for (const fs of list.FileSystems ?? []) {
+				if (!fs.FileSystemId) continue;
+				if (matchesCdkPath(fs.Tags, input.cdkPath)) return {
+					physicalId: fs.FileSystemId,
+					attributes: this.buildAttributes(fs)
+				};
+			}
+			nextToken = list.NextToken;
+		} while (nextToken);
+		return null;
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/firehose-provider.ts
 /**
@@ -36623,11 +37219,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !(k in newTagMap));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$18({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$19({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$18({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$19({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -36884,7 +37480,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = Object.keys(oldTags).filter((k) => !(k in newTags));
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$19({
+					await this.getClient().send(new UntagResourceCommand$20({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -36893,7 +37489,7 @@ var DLMLifecyclePolicyProvider = class {
 				const tagsToAdd = {};
 				for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) tagsToAdd[k] = v;
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$19({
+					await this.getClient().send(new TagResourceCommand$20({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -37096,11 +37692,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$20({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$21({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$20({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$21({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -38091,7 +38687,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$21({
+			await this.getClient().send(new UntagResourceCommand$22({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -38100,7 +38696,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$21({
+			await this.getClient().send(new TagResourceCommand$22({
 				resourceArn,
 				tags: upserts
 			}));
@@ -38132,7 +38728,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$21({
+			await this.getClient().send(new UntagResourceCommand$22({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -38141,7 +38737,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$21({
+			await this.getClient().send(new TagResourceCommand$22({
 				resourceArn,
 				tags: upserts
 			}));
@@ -39790,6 +40386,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::EFS::FileSystem", efsProvider);
 	registry.register("AWS::EFS::MountTarget", efsProvider);
 	registry.register("AWS::EFS::AccessPoint", efsProvider);
+	registry.register("AWS::FSx::FileSystem", new FSxFileSystemProvider());
 	registry.register("AWS::KinesisFirehose::DeliveryStream", new FirehoseProvider());
 	registry.register("AWS::CloudTrail::Trail", new CloudTrailProvider());
 	registry.register("AWS::CodeBuild::Project", new CodeBuildProvider());
@@ -59068,7 +59665,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.243.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.244.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());