@go-to-k/cdkd 0.250.0 → 0.252.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as ensureAssetStorage, A as WAFv2WebACLProvider, B as LockManager, Bt as LocalInvokeBuildError$1, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_BODY_LIMIT, D as IntrinsicFunctionResolver, Dt as uploadCfnTemplate, E as isTerminationProtectionPropagationError, Et as findLargeInlineResources, F as assertRegionMatch, Ft as setAwsClients, G as stringifyValue, Gt as NestedStackChildDirectDestroyError, H as rebuildClientForBucketRegion, Ht as LocalStartServiceError, I as applyRoleArnIfSet, J as createAssetRedirectResolver, Jt as ResourceTimeoutError, K as WorkGraph, Kt as PartialFailureError, L as DiffCalculator, Lt as CdkdError, M as matchesCdkPath, Mt as AwsClients, N as normalizeAwsTagsToCfn, Nt as getAwsClients, O as cfnRefValueFromPhysicalId, Ot as expectedOwnerParam, P as resolveExplicitPhysicalId, Pt as resetAwsClients, Q as BOOTSTRAP_MARKER_PREFIX, R as DagBuilder, S as ProviderRegistry, St as warnDeprecatedNoPrefixCliFlag, T as disableInstanceApiTermination, Tt as MIGRATE_TMP_PREFIX, U as shouldRetainResource, V as S3StateBackend, Vt as LocalMigrateError, W as AssetPublisher, Wt as MissingCdkCliError, X as rewriteTemplateAssetReferences, Xt as StackHasActiveImportsError, Y as loadPublishableAssetManifest, Yt as ResourceUpdateNotSupportedError, Z as AssetModeResolver, Zt as StackTerminationProtectionError, _ as green, _t as resolveCaptureObservedState, a as withRetry, at as formatDockerLoginError, b as IAMRoleProvider, bt as resolveStateBucketWithDefaultAndSource, c as computeImplicitDeleteEdges, ct as runDockerStreaming, d as isStatefulRecreateTargetSync, dt as Synthesizer, et as getBootstrapMarkerKey, f as renderStatefulReason, ft as synthesisStatusMessage, g as gray, gt as resolveAutoAssetStorage, h as cyan, ht as resolveApp, i as withResourceDeadline, it as buildDockerImage, j as CDK_PATH_TAG, jt as resolveBucketRegion, k as refStateLookupFromResource, kt as AssemblyReader, l as extractDeploymentEventError, lt as AssetManifestLoader, m as bold, mt as getLegacyStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as normalizeAwsError, nt as validateAssetBucketName, o as isRetryableTransientError, ot as getDockerCmd, p as formatResourceLine, pt as getDefaultStateBucketName, q as buildAssetRedirectMap, qt as ProvisioningError, r as DeployEngine, rn as withErrorHandling, rt as validateContainerRepoName, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerForeground, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as parseBootstrapMarker, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as getDockerImageBySourceHash, v as red, vt as resolveSkipPrefix, w as CloudControlProvider, wt as CFN_TEMPLATE_URL_LIMIT, x as collectInlinePolicyNamesManagedBySiblings, xt as resolveUseCdkBootstrapAssets, y as yellow, yt as resolveStateBucketWithDefault, z as TemplateParser } from "./deploy-engine-D-gBbMiZ.js";
+import { $ as BOOTSTRAP_MARKER_PREFIX, A as refStateLookupFromResource, At as AssemblyReader, B as TemplateParser, C as ProviderRegistry, Ct as warnDeprecatedNoPrefixCliFlag, D as isTerminationProtectionPropagationError, Dt as findLargeInlineResources, E as disableInstanceApiTermination, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as IntrinsicFunctionResolver, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as collectInlinePolicyNamesManagedBySiblings, St as resolveUseCdkBootstrapAssets, T as CloudControlProvider, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as gray, _t as resolveAutoAssetStorage, a as withRetry, at as buildDockerImage, b as yellow, bt as resolveStateBucketWithDefault, c as IMPLICIT_DELETE_DEPENDENCIES, ct as runDockerForeground, d as MULTI_REGION_RECREATE_BLOCKED_TYPES, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as isStatefulRecreateTargetSync, ft as Synthesizer, g as cyan, gt as resolveApp, h as bold, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as WAFv2WebACLProvider, k as cfnRefValueFromPhysicalId, kt as expectedOwnerParam, l as computeImplicitDeleteEdges, lt as runDockerStreaming, m as formatResourceLine, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as isRetryableTransientError, ot as formatDockerLoginError, p as renderStatefulReason, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as isThrottlingError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as extractDeploymentEventError, ut as AssetManifestLoader, v as green, vt as resolveCaptureObservedState, w as findActionableSilentDrops, wt as CFN_TEMPLATE_BODY_LIMIT, x as IAMRoleProvider, xt as resolveStateBucketWithDefaultAndSource, y as red, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-IkhnJXWR.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-er3xGYRo.js";
+import { t as ASGProvider } from "./asg-provider-BzBdoSYp.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1888,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.250.0";
+	return "0.252.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25221,6 +25221,155 @@ var RDSDBProxyTargetGroupProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/import-tag-walk.ts
+/**
+* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
+*
+* Providers that adopt a resource without an explicit name property fall back
+* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
+* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
+* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
+* summaries usually do not carry tags. That is an inherent **N+1** read
+* pattern: an account with many resources of the type produces one API call
+* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
+*
+* Every provider previously hand-rolled this loop with NO backoff, so a single
+* throttled `Describe*` aborted the whole `cdkd import` run. This helper
+* centralises the loop and wraps BOTH the list page fetch and the per-candidate
+* describe in the deploy engine's `withRetry` with exponential backoff.
+*
+* ## Why a narrower classifier than `isRetryableTransientError`
+*
+* The deploy engine's classifier is tuned for the WRITE path: it also treats
+* eventual-consistency phrasings like `does not exist` / `not authorized to
+* perform` as transient, because a just-created dependency legitimately needs a
+* moment to propagate. On a read-only import walk those messages mean the
+* opposite — the candidate really is gone, or the caller's credentials really
+* lack the permission — and retrying them burns the full backoff budget per
+* candidate before surfacing the true error.
+*
+* So the walk retries throttling ONLY, reusing the deploy engine's throttle
+* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
+* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
+*
+* ## Batching
+*
+* Batched tag reads are deliberately NOT modelled here: the services this
+* helper currently serves (EMR `DescribeCluster`, DocDB
+* `ListTagsForResource`) expose only single-resource reads. A service that
+* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
+* satisfy several candidates from one call inside its own `describe` callback,
+* or bypass the helper entirely.
+*/
+/** Max number of retries after the first attempt, per API call in the walk. */
+const DEFAULT_MAX_RETRIES = 5;
+/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
+const DEFAULT_INITIAL_DELAY_MS = 500;
+/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
+const DEFAULT_MAX_DELAY_MS = 5e3;
+/**
+* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
+* one call. Backoff is per-call, so without this a sustained throttle against a
+* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
+* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
+* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
+* DocDB account completes in seconds when AWS is not throttling) and bounds the
+* pathological case to something a user will wait through.
+*/
+const DEFAULT_MAX_WALK_MS = 10 * 6e4;
+/**
+* Ceiling on pages fetched. A service that returns a non-advancing pagination
+* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
+* forever. This is now the shared path every migrated provider runs on, so the
+* guard belongs here rather than in each caller.
+*/
+const DEFAULT_MAX_PAGES = 1e3;
+/**
+* Whether an error hit during the read-only tag walk is a rate-limit rejection
+* worth backing off on.
+*
+* Delegates the error + `.cause` chain traversal to the deploy engine's
+* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
+* at every cause depth) and adds the canonical `Rate exceeded` message, which
+* several services return with an HTTP 400 and a service-specific error name.
+*
+* This is deliberately NARROWER than `isRetryableTransientError`: that
+* classifier also treats write-path eventual-consistency phrasings (`does not
+* exist`, `not authorized to perform`) as transient, because a just-created
+* dependency legitimately needs a moment to propagate. On a read-only walk
+* those mean the candidate really is gone or the credentials really lack the
+* permission, and retrying them burns the full backoff budget per candidate
+* before surfacing the true error.
+*
+* Exported for direct unit testing and for providers whose tag walk cannot use
+* {@link importTagWalk} verbatim.
+*/
+function isThrottlingLikeError(error, message) {
+	return isThrottlingError(error) || message.includes("Rate exceeded");
+}
+/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
+var ImportTagWalkLimitError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ImportTagWalkLimitError";
+	}
+};
+/**
+* Paginate `listPage`, `describe` each candidate, and return the first one
+* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
+* candidate matches (or when `cdkPath` is empty).
+*
+* Both callbacks are individually retried with exponential backoff on
+* throttling errors, so one rate-limited call mid-walk no longer aborts the
+* whole import.
+*/
+async function importTagWalk(options) {
+	const { cdkPath, listPage, describe, tagsOf } = options;
+	if (!cdkPath) return null;
+	const logicalId = options.logicalId ?? "import";
+	const logger = options.retry?.logger ?? getLogger();
+	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
+	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
+	const retryOpts = {
+		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
+		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
+		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
+		isRetryable: (message, error) => isThrottlingLikeError(error, message),
+		logger,
+		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
+		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
+		...options.retry?.sleep && { sleep: options.retry.sleep }
+	};
+	const startedAt = Date.now();
+	const assertWithinBudget = (stage) => {
+		const elapsed = Date.now() - startedAt;
+		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+	};
+	let marker;
+	let pages = 0;
+	do {
+		assertWithinBudget("listing candidates");
+		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+		const currentMarker = marker;
+		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
+		for (const summary of page.items ?? []) {
+			assertWithinBudget("reading candidate tags");
+			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
+			if (detail === void 0) {
+				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
+				continue;
+			}
+			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
+				summary,
+				detail
+			};
+		}
+		marker = page.nextMarker;
+	} while (marker);
+	return null;
+}
+
 //#endregion
 //#region src/provisioning/providers/docdb-provider.ts
 /**
@@ -25696,6 +25845,9 @@ var DocDBProvider = class {
 	* Identifier` / `DBClusterIdentifier` / `DBSubnetGroupName`) are usually
 	* present in CDK templates; fall back to `aws:cdk:path` tag lookup via
 	* the corresponding `Describe*` + `ListTagsForResource` pair otherwise.
+	* The fallback walk runs through the shared `importTagWalk` helper, so the
+	* N+1 `ListTagsForResource` burst is retried with exponential backoff when
+	* AWS throttles it instead of aborting the whole import.
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -25811,20 +25963,24 @@ var DocDBProvider = class {
 			if (err.name === "DBInstanceNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBInstancesCommand$1({ ...marker && { Marker: marker } }));
-			for (const inst of list.DBInstances ?? []) {
-				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
-					physicalId: inst.DBInstanceIdentifier,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new DescribeDBInstancesCommand$1({ ...marker && { Marker: marker } }));
+				return {
+					items: list.DBInstances,
+					nextMarker: list.Marker
 				};
-			}
-			marker = list.Marker;
-		} while (marker);
-		return null;
+			},
+			describe: async (inst) => inst.DBInstanceIdentifier && inst.DBInstanceArn ? await this.listTagsForResource(inst.DBInstanceArn) : void 0,
+			tagsOf: (tags) => tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.DBInstanceIdentifier,
+			attributes: {}
+		};
 	}
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
@@ -25838,20 +25994,24 @@ var DocDBProvider = class {
 			if (err.name === "DBClusterNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBClustersCommand$1({ ...marker && { Marker: marker } }));
-			for (const c of list.DBClusters ?? []) {
-				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
-					physicalId: c.DBClusterIdentifier,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new DescribeDBClustersCommand$1({ ...marker && { Marker: marker } }));
+				return {
+					items: list.DBClusters,
+					nextMarker: list.Marker
 				};
-			}
-			marker = list.Marker;
-		} while (marker);
-		return null;
+			},
+			describe: async (c) => c.DBClusterIdentifier && c.DBClusterArn ? await this.listTagsForResource(c.DBClusterArn) : void 0,
+			tagsOf: (tags) => tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.DBClusterIdentifier,
+			attributes: {}
+		};
 	}
 	async importDBSubnetGroup(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBSubnetGroupName");
@@ -25865,20 +26025,33 @@ var DocDBProvider = class {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$1({ ...marker && { Marker: marker } }));
-			for (const sg of list.DBSubnetGroups ?? []) {
-				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
-					physicalId: sg.DBSubnetGroupName,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$1({ ...marker && { Marker: marker } }));
+				return {
+					items: list.DBSubnetGroups,
+					nextMarker: list.Marker
 				};
-			}
-			marker = list.Marker;
-		} while (marker);
-		return null;
+			},
+			describe: async (sg) => sg.DBSubnetGroupName && sg.DBSubnetGroupArn ? await this.listTagsForResource(sg.DBSubnetGroupArn) : void 0,
+			tagsOf: (tags) => tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.DBSubnetGroupName,
+			attributes: {}
+		};
+	}
+	/**
+	* `ListTagsForResource` for the tag-walk import path. Returns the tag list
+	* (possibly empty) so `importTagWalk` can match `aws:cdk:path` against it;
+	* `undefined` is reserved for "skip this candidate", which the callers signal
+	* before calling this.
+	*/
+	async listTagsForResource(resourceArn) {
+		return (await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: resourceArn }))).TagList ?? [];
 	}
 };
 
@@ -34494,6 +34667,11 @@ const VARIANT_CONFIG_KEY = {
 	ONTAP: "OntapConfiguration",
 	OPENZFS: "OpenZFSConfiguration"
 };
+/**
+* Exported so a unit test can assert every declared-mutable sub-property has
+* a matching `apply*UpdateField` case — the invariant the unreachable
+* `default:` guard enforces at runtime.
+*/
 const VARIANT_MUTABLE_SUBPROPS = {
 	LustreConfiguration: LUSTRE_MUTABLE_SUBPROPS,
 	WindowsConfiguration: WINDOWS_MUTABLE_SUBPROPS,
@@ -34501,6 +34679,21 @@ const VARIANT_MUTABLE_SUBPROPS = {
 	OpenZFSConfiguration: OPENZFS_MUTABLE_SUBPROPS
 };
 /**
+* Copy `value` into `target[key]` only when AWS actually returned it, so the
+* snapshot carries no `undefined`-valued keys.
+*
+* The drift comparator walks the BASELINE's keys (`observedProperties`, or
+* `properties` when a resource predates observed-capture), not the AWS side —
+* so an omitted key here is not itself phantom drift. It matters because this
+* snapshot BECOMES the next baseline: `deploy-engine` stores it as
+* `observedProperties`, and an explicit `Foo: undefined` would then be walked
+* as a real key on every later comparison. Omitting is also what keeps the
+* emitted shape a faithful subset of the CFn input shape.
+*/
+const putIfDefined = (target, key, value) => {
+	if (value !== void 0) target[key] = value;
+};
+/**
 * Compute the Add/Remove route-table-id deltas an ONTAP / OpenZFS
 * `UpdateFileSystem` needs from the previous vs. next `RouteTableIds` list.
 * Route table membership is an unordered set, so a pure reorder yields no
@@ -34927,14 +35120,30 @@ var FSxFileSystemProvider = class {
 			const prevVal = prev[key];
 			if (JSON.stringify(nextVal) === JSON.stringify(prevVal)) continue;
 			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
-			if (configKey === "LustreConfiguration" ? this.applyLustreUpdateField(key, nextVal, diff) : configKey === "WindowsConfiguration" ? this.applyWindowsUpdateField(key, nextVal, diff) : configKey === "OntapConfiguration" ? this.applyOntapUpdateField(key, nextVal, prevVal, diff) : this.applyOpenZFSUpdateField(key, nextVal, prevVal, diff)) hasMutableDiff = true;
+			const ctx = {
+				resourceType,
+				logicalId,
+				configKey
+			};
+			if (configKey === "LustreConfiguration" ? this.applyLustreUpdateField(ctx, key, nextVal, diff) : configKey === "WindowsConfiguration" ? this.applyWindowsUpdateField(ctx, key, nextVal, diff) : configKey === "OntapConfiguration" ? this.applyOntapUpdateField(ctx, key, nextVal, prevVal, diff) : this.applyOpenZFSUpdateField(ctx, key, nextVal, prevVal, diff)) hasMutableDiff = true;
 		}
 		return {
 			diff,
 			hasMutableDiff
 		};
 	}
-	applyLustreUpdateField(key, next, diff) {
+	/**
+	* A sub-property listed in a `*_MUTABLE_SUBPROPS` set with no matching
+	* `apply*UpdateField` case. Reaching here is a cdkd bug, not user error:
+	* `computeVariantConfigDiff` already accepted the key as mutable, so
+	* falling through would issue a no-op `UpdateFileSystem` (`hasMutableDiff`
+	* true, empty diff) and silently drop the user's change. Fail loudly
+	* instead so the missing mapping surfaces the moment it is added.
+	*/
+	unmappedMutableSubprop(ctx, key) {
+		throw new ProvisioningError(`AWS FSx FileSystem ${ctx.configKey}.${key} is declared mutable but has no UpdateFileSystem mapping in cdkd. This is a cdkd bug — please report it at https://github.com/go-to-k/cdkd/issues`, ctx.resourceType, ctx.logicalId);
+	}
+	applyLustreUpdateField(ctx, key, next, diff) {
 		const out = diff;
 		switch (key) {
 			case "WeeklyMaintenanceStartTime":
@@ -34966,10 +35175,11 @@ var FSxFileSystemProvider = class {
 				} : void 0;
 				break;
 			}
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
-	applyWindowsUpdateField(key, next, diff) {
+	applyWindowsUpdateField(ctx, key, next, diff) {
 		const out = diff;
 		switch (key) {
 			case "WeeklyMaintenanceStartTime":
@@ -34992,10 +35202,11 @@ var FSxFileSystemProvider = class {
 			case "FsrmConfiguration":
 				out.FsrmConfiguration = this.toWindowsFsrmConfiguration(next);
 				break;
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
-	applyOntapUpdateField(key, next, prev, diff) {
+	applyOntapUpdateField(ctx, key, next, prev, diff) {
 		const out = diff;
 		switch (key) {
 			case "DailyAutomaticBackupStartTime":
@@ -35019,10 +35230,11 @@ var FSxFileSystemProvider = class {
 				if (remove) out.RemoveRouteTableIds = remove;
 				return add !== void 0 || remove !== void 0;
 			}
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
-	applyOpenZFSUpdateField(key, next, prev, diff) {
+	applyOpenZFSUpdateField(ctx, key, next, prev, diff) {
 		const out = diff;
 		switch (key) {
 			case "DailyAutomaticBackupStartTime":
@@ -35050,6 +35262,7 @@ var FSxFileSystemProvider = class {
 				if (remove) out.RemoveRouteTableIds = remove;
 				return add !== void 0 || remove !== void 0;
 			}
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
@@ -35223,28 +35436,122 @@ var FSxFileSystemProvider = class {
 			default: return;
 		}
 	}
+	/** Map the read-side `WindowsConfiguration` back to CFn input shape. */
+	readWindowsConfiguration(windows) {
+		const config = {};
+		putIfDefined(config, "ActiveDirectoryId", windows.ActiveDirectoryId);
+		putIfDefined(config, "DeploymentType", windows.DeploymentType);
+		putIfDefined(config, "PreferredSubnetId", windows.PreferredSubnetId);
+		putIfDefined(config, "ThroughputCapacity", windows.ThroughputCapacity);
+		putIfDefined(config, "WeeklyMaintenanceStartTime", windows.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", windows.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "AutomaticBackupRetentionDays", windows.AutomaticBackupRetentionDays);
+		putIfDefined(config, "CopyTagsToBackups", windows.CopyTagsToBackups);
+		if (windows.Aliases !== void 0) config["Aliases"] = windows.Aliases.map((alias) => alias.Name).filter((name) => name !== void 0);
+		if (windows.SelfManagedActiveDirectoryConfiguration) {
+			const ad = windows.SelfManagedActiveDirectoryConfiguration;
+			const adConfig = {};
+			putIfDefined(adConfig, "DomainName", ad.DomainName);
+			putIfDefined(adConfig, "OrganizationalUnitDistinguishedName", ad.OrganizationalUnitDistinguishedName);
+			putIfDefined(adConfig, "FileSystemAdministratorsGroup", ad.FileSystemAdministratorsGroup);
+			putIfDefined(adConfig, "UserName", ad.UserName);
+			putIfDefined(adConfig, "DnsIps", ad.DnsIps ? [...ad.DnsIps] : void 0);
+			putIfDefined(adConfig, "DomainJoinServiceAccountSecret", ad.DomainJoinServiceAccountSecret);
+			if (Object.keys(adConfig).length > 0) config["SelfManagedActiveDirectoryConfiguration"] = adConfig;
+		}
+		if (windows.AuditLogConfiguration) {
+			const audit = {};
+			putIfDefined(audit, "FileAccessAuditLogLevel", windows.AuditLogConfiguration.FileAccessAuditLogLevel);
+			putIfDefined(audit, "FileShareAccessAuditLogLevel", windows.AuditLogConfiguration.FileShareAccessAuditLogLevel);
+			putIfDefined(audit, "AuditLogDestination", windows.AuditLogConfiguration.AuditLogDestination);
+			if (Object.keys(audit).length > 0) config["AuditLogConfiguration"] = audit;
+		}
+		const diskIops = this.readDiskIopsConfiguration(windows.DiskIopsConfiguration);
+		if (diskIops) config["DiskIopsConfiguration"] = diskIops;
+		if (windows.FsrmConfiguration) {
+			const fsrm = {};
+			putIfDefined(fsrm, "FsrmServiceEnabled", windows.FsrmConfiguration.FsrmServiceEnabled);
+			putIfDefined(fsrm, "EventLogDestination", windows.FsrmConfiguration.EventLogDestination);
+			if (Object.keys(fsrm).length > 0) config["FsrmConfiguration"] = fsrm;
+		}
+		return config;
+	}
+	/** Map the read-side `OntapConfiguration` back to CFn input shape. */
+	readOntapConfiguration(ontap) {
+		const config = {};
+		putIfDefined(config, "DeploymentType", ontap.DeploymentType);
+		putIfDefined(config, "AutomaticBackupRetentionDays", ontap.AutomaticBackupRetentionDays);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", ontap.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "WeeklyMaintenanceStartTime", ontap.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "EndpointIpAddressRange", ontap.EndpointIpAddressRange);
+		putIfDefined(config, "PreferredSubnetId", ontap.PreferredSubnetId);
+		putIfDefined(config, "ThroughputCapacity", ontap.ThroughputCapacity);
+		putIfDefined(config, "ThroughputCapacityPerHAPair", ontap.ThroughputCapacityPerHAPair);
+		putIfDefined(config, "HAPairs", ontap.HAPairs);
+		putIfDefined(config, "RouteTableIds", ontap.RouteTableIds ? [...ontap.RouteTableIds] : void 0);
+		putIfDefined(config, "EndpointIpv6AddressRange", ontap.EndpointIpv6AddressRange);
+		const diskIops = this.readDiskIopsConfiguration(ontap.DiskIopsConfiguration);
+		if (diskIops) config["DiskIopsConfiguration"] = diskIops;
+		return config;
+	}
+	/** Map the read-side `OpenZFSConfiguration` back to CFn input shape. */
+	readOpenZFSConfiguration(openzfs) {
+		const config = {};
+		putIfDefined(config, "DeploymentType", openzfs.DeploymentType);
+		putIfDefined(config, "AutomaticBackupRetentionDays", openzfs.AutomaticBackupRetentionDays);
+		putIfDefined(config, "CopyTagsToBackups", openzfs.CopyTagsToBackups);
+		putIfDefined(config, "CopyTagsToVolumes", openzfs.CopyTagsToVolumes);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", openzfs.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "WeeklyMaintenanceStartTime", openzfs.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "ThroughputCapacity", openzfs.ThroughputCapacity);
+		putIfDefined(config, "PreferredSubnetId", openzfs.PreferredSubnetId);
+		putIfDefined(config, "EndpointIpAddressRange", openzfs.EndpointIpAddressRange);
+		putIfDefined(config, "RouteTableIds", openzfs.RouteTableIds ? [...openzfs.RouteTableIds] : void 0);
+		putIfDefined(config, "EndpointIpv6AddressRange", openzfs.EndpointIpv6AddressRange);
+		const diskIops = this.readDiskIopsConfiguration(openzfs.DiskIopsConfiguration);
+		if (diskIops) config["DiskIopsConfiguration"] = diskIops;
+		if (openzfs.ReadCacheConfiguration) {
+			const readCache = {};
+			putIfDefined(readCache, "SizingMode", openzfs.ReadCacheConfiguration.SizingMode);
+			putIfDefined(readCache, "SizeGiB", openzfs.ReadCacheConfiguration.SizeGiB);
+			if (Object.keys(readCache).length > 0) config["ReadCacheConfiguration"] = readCache;
+		}
+		return config;
+	}
+	/** Shared `DiskIopsConfiguration` reverse-mapper (Windows / ONTAP / OpenZFS). */
+	readDiskIopsConfiguration(diskIops) {
+		if (!diskIops) return void 0;
+		const out = {};
+		putIfDefined(out, "Mode", diskIops.Mode);
+		putIfDefined(out, "Iops", diskIops.Iops);
+		return Object.keys(out).length > 0 ? out : void 0;
+	}
 	/**
 	* State property paths this provider cannot read back from AWS:
 	*  - `SecurityGroupIds` — `DescribeFileSystems` returns network
 	*    interface ids, never the original security group list.
 	*  - `BackupId` — creation-source input, not surfaced on the deployed
 	*    file system.
-	*  - `WindowsConfiguration` / `OntapConfiguration` / `OpenZFSConfiguration`
-	*    — `readCurrentState` maps only the Lustre block back to CFn shape
-	*    today, so drift on the non-Lustre variant blocks is not yet computed;
-	*    marking them unknown avoids a guaranteed false positive on every run
-	*    (variant-config drift is a follow-up). Only the block matching the
-	*    file system's type is ever present in state, so listing all three is
-	*    harmless.
+	*  - `WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password`
+	*    / `OntapConfiguration.FsxAdminPassword` — write-only credentials; the
+	*    API never echoes them back.
+	*  - `OpenZFSConfiguration.RootVolumeConfiguration` — configured on the
+	*    root VOLUME, not the file system; `DescribeFileSystems` returns only
+	*    `RootVolumeId`, so reading it back would need a separate
+	*    `DescribeVolumes` call (out of scope here).
+	*
+	* The whole-block `WindowsConfiguration` / `OntapConfiguration` /
+	* `OpenZFSConfiguration` entries are gone as of the variant reverse-mappers
+	* — only the individually-unreadable leaves above stay unknown.
 	*/
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType !== "AWS::FSx::FileSystem") return [];
 		return [
 			"SecurityGroupIds",
 			"BackupId",
-			"WindowsConfiguration",
-			"OntapConfiguration",
-			"OpenZFSConfiguration"
+			"WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password",
+			"OntapConfiguration.FsxAdminPassword",
+			"OpenZFSConfiguration.RootVolumeConfiguration"
 		];
 	}
 	/**
@@ -35252,7 +35559,11 @@ var FSxFileSystemProvider = class {
 	* via `DescribeFileSystems`. Lustre data-repository fields (`ImportPath`
 	* / `ExportPath` / `AutoImportPolicy` / `ImportedFileChunkSize`) are
 	* mapped back from the nested `DataRepositoryConfiguration` the API
-	* returns. Returns `undefined` when the file system is gone.
+	* returns. The Windows / ONTAP / OpenZFS variant blocks are reverse-mapped
+	* by their respective `read*Configuration` helpers; the few inputs AWS
+	* never returns stay listed in {@link getDriftUnknownPaths}. At most one
+	* variant block is ever present (they key off `FileSystemType`).
+	* Returns `undefined` when the file system is gone.
 	*/
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		if (resourceType !== "AWS::FSx::FileSystem") return void 0;
@@ -35265,47 +35576,59 @@ var FSxFileSystemProvider = class {
 		}
 		if (!fs) return void 0;
 		const result = {};
-		if (fs.FileSystemType !== void 0) result["FileSystemType"] = fs.FileSystemType;
-		if (fs.StorageCapacity !== void 0) result["StorageCapacity"] = fs.StorageCapacity;
-		if (fs.StorageType !== void 0) result["StorageType"] = fs.StorageType;
-		if (fs.SubnetIds !== void 0) result["SubnetIds"] = [...fs.SubnetIds];
-		if (fs.KmsKeyId !== void 0) result["KmsKeyId"] = fs.KmsKeyId;
-		if (fs.FileSystemTypeVersion !== void 0) result["FileSystemTypeVersion"] = fs.FileSystemTypeVersion;
-		if (fs.NetworkType !== void 0) result["NetworkType"] = fs.NetworkType;
+		putIfDefined(result, "FileSystemType", fs.FileSystemType);
+		putIfDefined(result, "StorageCapacity", fs.StorageCapacity);
+		putIfDefined(result, "StorageType", fs.StorageType);
+		putIfDefined(result, "SubnetIds", fs.SubnetIds ? [...fs.SubnetIds] : void 0);
+		putIfDefined(result, "KmsKeyId", fs.KmsKeyId);
+		putIfDefined(result, "FileSystemTypeVersion", fs.FileSystemTypeVersion);
+		putIfDefined(result, "NetworkType", fs.NetworkType);
 		const lustre = fs.LustreConfiguration;
 		if (lustre) {
 			const config = {};
-			if (lustre.WeeklyMaintenanceStartTime !== void 0) config["WeeklyMaintenanceStartTime"] = lustre.WeeklyMaintenanceStartTime;
-			if (lustre.DeploymentType !== void 0) config["DeploymentType"] = lustre.DeploymentType;
-			if (lustre.PerUnitStorageThroughput !== void 0) config["PerUnitStorageThroughput"] = lustre.PerUnitStorageThroughput;
-			if (lustre.DailyAutomaticBackupStartTime !== void 0) config["DailyAutomaticBackupStartTime"] = lustre.DailyAutomaticBackupStartTime;
-			if (lustre.AutomaticBackupRetentionDays !== void 0) config["AutomaticBackupRetentionDays"] = lustre.AutomaticBackupRetentionDays;
-			if (lustre.CopyTagsToBackups !== void 0) config["CopyTagsToBackups"] = lustre.CopyTagsToBackups;
-			if (lustre.DriveCacheType !== void 0) config["DriveCacheType"] = lustre.DriveCacheType;
-			if (lustre.DataCompressionType !== void 0) config["DataCompressionType"] = lustre.DataCompressionType;
-			if (lustre.EfaEnabled !== void 0) config["EfaEnabled"] = lustre.EfaEnabled;
-			if (lustre.ThroughputCapacity !== void 0) config["ThroughputCapacity"] = lustre.ThroughputCapacity;
+			putIfDefined(config, "WeeklyMaintenanceStartTime", lustre.WeeklyMaintenanceStartTime);
+			putIfDefined(config, "DeploymentType", lustre.DeploymentType);
+			putIfDefined(config, "PerUnitStorageThroughput", lustre.PerUnitStorageThroughput);
+			putIfDefined(config, "DailyAutomaticBackupStartTime", lustre.DailyAutomaticBackupStartTime);
+			putIfDefined(config, "AutomaticBackupRetentionDays", lustre.AutomaticBackupRetentionDays);
+			putIfDefined(config, "CopyTagsToBackups", lustre.CopyTagsToBackups);
+			putIfDefined(config, "DriveCacheType", lustre.DriveCacheType);
+			putIfDefined(config, "DataCompressionType", lustre.DataCompressionType);
+			putIfDefined(config, "EfaEnabled", lustre.EfaEnabled);
+			putIfDefined(config, "ThroughputCapacity", lustre.ThroughputCapacity);
 			if (lustre.MetadataConfiguration) {
 				const metadata = {};
-				if (lustre.MetadataConfiguration.Mode !== void 0) metadata["Mode"] = lustre.MetadataConfiguration.Mode;
-				if (lustre.MetadataConfiguration.Iops !== void 0) metadata["Iops"] = lustre.MetadataConfiguration.Iops;
+				putIfDefined(metadata, "Mode", lustre.MetadataConfiguration.Mode);
+				putIfDefined(metadata, "Iops", lustre.MetadataConfiguration.Iops);
 				if (Object.keys(metadata).length > 0) config["MetadataConfiguration"] = metadata;
 			}
 			if (lustre.DataReadCacheConfiguration) {
 				const readCache = {};
-				if (lustre.DataReadCacheConfiguration.SizingMode !== void 0) readCache["SizingMode"] = lustre.DataReadCacheConfiguration.SizingMode;
-				if (lustre.DataReadCacheConfiguration.SizeGiB !== void 0) readCache["SizeGiB"] = lustre.DataReadCacheConfiguration.SizeGiB;
+				putIfDefined(readCache, "SizingMode", lustre.DataReadCacheConfiguration.SizingMode);
+				putIfDefined(readCache, "SizeGiB", lustre.DataReadCacheConfiguration.SizeGiB);
 				if (Object.keys(readCache).length > 0) config["DataReadCacheConfiguration"] = readCache;
 			}
 			const dataRepo = lustre.DataRepositoryConfiguration;
 			if (dataRepo) {
-				if (dataRepo.ImportPath !== void 0) config["ImportPath"] = dataRepo.ImportPath;
-				if (dataRepo.ExportPath !== void 0) config["ExportPath"] = dataRepo.ExportPath;
-				if (dataRepo.AutoImportPolicy !== void 0) config["AutoImportPolicy"] = dataRepo.AutoImportPolicy;
-				if (dataRepo.ImportedFileChunkSize !== void 0) config["ImportedFileChunkSize"] = dataRepo.ImportedFileChunkSize;
+				putIfDefined(config, "ImportPath", dataRepo.ImportPath);
+				putIfDefined(config, "ExportPath", dataRepo.ExportPath);
+				putIfDefined(config, "AutoImportPolicy", dataRepo.AutoImportPolicy);
+				putIfDefined(config, "ImportedFileChunkSize", dataRepo.ImportedFileChunkSize);
 			}
 			if (Object.keys(config).length > 0) result["LustreConfiguration"] = config;
 		}
+		if (fs.WindowsConfiguration) {
+			const config = this.readWindowsConfiguration(fs.WindowsConfiguration);
+			if (Object.keys(config).length > 0) result["WindowsConfiguration"] = config;
+		}
+		if (fs.OntapConfiguration) {
+			const config = this.readOntapConfiguration(fs.OntapConfiguration);
+			if (Object.keys(config).length > 0) result["OntapConfiguration"] = config;
+		}
+		if (fs.OpenZFSConfiguration) {
+			const config = this.readOpenZFSConfiguration(fs.OpenZFSConfiguration);
+			if (Object.keys(config).length > 0) result["OpenZFSConfiguration"] = config;
+		}
 		result["Tags"] = normalizeAwsTagsToCfn(fs.Tags);
 		return result;
 	}
@@ -35887,45 +36210,58 @@ var EMRClusterProvider = class {
 	*  2. Tag-based lookup: `ListClusters` filtered to the non-terminated states
 	*     (a `TERMINATED*` cluster is gone and must never be adopted), then a
 	*     `DescribeCluster` per candidate to read `Tags` (the list summaries do
-	*     NOT carry tags) and match `aws:cdk:path`.
+	*     NOT carry tags) and match `aws:cdk:path`. The walk runs through the
+	*     shared `importTagWalk` helper, so each list page / describe is retried
+	*     with exponential backoff when AWS throttles the N+1 read burst.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, null);
 		if (explicit) {
-			const cluster = await this.describeClusterOrNull(explicit);
+			const cluster = await this.describeClusterOrUndefined(explicit);
 			if (!cluster || cluster.Status?.State && TERMINAL_STATES.has(cluster.Status.State)) return null;
 			return {
 				physicalId: explicit,
 				attributes: this.buildAttributes(cluster)
 			};
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new ListClustersCommand$1({
-				ClusterStates: [...NON_TERMINATED_STATES],
-				...marker && { Marker: marker }
-			}));
-			for (const summary of list.Clusters ?? []) {
-				if (!summary.Id) continue;
-				const cluster = await this.describeClusterOrNull(summary.Id);
-				if (!cluster) continue;
-				if (matchesCdkPath(cluster.Tags, input.cdkPath)) return {
-					physicalId: summary.Id,
-					attributes: this.buildAttributes(cluster)
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListClustersCommand$1({
+					ClusterStates: [...NON_TERMINATED_STATES],
+					...marker && { Marker: marker }
+				}));
+				return {
+					items: list.Clusters,
+					nextMarker: list.Marker
 				};
-			}
-			marker = list.Marker;
-		} while (marker);
-		return null;
+			},
+			describe: async (summary) => summary.Id ? await this.describeClusterOrUndefined(summary.Id) : void 0,
+			tagsOf: (cluster) => cluster.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Id,
+			attributes: this.buildAttributes(match.detail)
+		};
 	}
 	/**
 	* `DescribeCluster` that maps a not-found (`InvalidRequestException` — the
-	* cluster id is unknown in this region / aged out of Describe) to `null`
-	* instead of throwing, so `import()` can treat it as "no match" rather than
-	* aborting the whole adoption run.
+	* cluster id is unknown in this region / aged out of Describe) to
+	* `undefined` instead of throwing, so `import()` can treat it as "no match"
+	* rather than aborting the whole adoption run.
+	*
+	* `undefined`, NOT `null`, is load-bearing: `importTagWalk` skips a candidate
+	* on `detail === undefined`, and an actual `null` would flow into `tagsOf`
+	* and `TypeError`. Also note the mapping is BROAD — `InvalidRequestException`
+	* covers more than not-found, so a genuine failure here degrades to "no
+	* match" and a subsequent deploy would CREATE a duplicate cluster rather than
+	* adopt the existing one. The walk logs each skip at debug so the case is at
+	* least visible under `--verbose`; narrowing the mapping needs a
+	* message/code-level discriminator AWS does not currently document.
 	*/
-	async describeClusterOrNull(clusterId) {
+	async describeClusterOrUndefined(clusterId) {
 		try {
 			return (await this.getClient().send(new DescribeClusterCommand({ ClusterId: clusterId }))).Cluster;
 		} catch (err) {
@@ -35964,7 +36300,7 @@ var EMRClusterProvider = class {
 	* optional `import` method's incremental opt-in shape.
 	*/
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		const cluster = await this.describeClusterOrNull(physicalId);
+		const cluster = await this.describeClusterOrUndefined(physicalId);
 		if (!cluster) return void 0;
 		let instanceGroups = [];
 		let instanceFleets = [];
@@ -36164,14 +36500,21 @@ const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
 /** Instance-group state that means "the group is up and idle/serving". */
 const READY_STATES$1 = /* @__PURE__ */ new Set(["RUNNING"]);
 /**
-* Instance-group states that mean "the group is gone / failed" — a hard
-* error during a create/resize wait (an ARRESTED group failed to provision;
-* TERMINATED/ENDED mean it will never reach RUNNING).
+* Instance-group states that mean "the group will never reach the requested
+* size" — a hard error during a create/resize wait.
+*
+* `ARRESTED` means the group failed to provision; `TERMINATED`/`ENDED` mean it
+* is gone. `SUSPENDED` means a resize could not complete: the existing
+* instances keep running but AWS can no longer add or remove any, so the wait
+* would poll to the full `maxWaitMs` timeout instead of failing fast with the
+* service's own state-change reason — the exact defect fixed on the
+* instance-fleet side in issue #1092 item 2, which applies verbatim here.
 */
 const FAILED_STATES$1 = /* @__PURE__ */ new Set([
 	"ARRESTED",
-	"TERMINATED",
-	"ENDED"
+	"ENDED",
+	"SUSPENDED",
+	"TERMINATED"
 ]);
 const toNumber$1 = (v) => {
 	if (v === void 0) return void 0;
@@ -36321,7 +36664,7 @@ var EMRInstanceGroupConfigProvider = class {
 						InstanceCount: toNumber$1(properties["InstanceCount"])
 					}]
 				}));
-				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
+				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0, true);
 			}
 			if (autoScalingChanged) {
 				if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} AutoScalingPolicy update needs JobFlowId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
@@ -36382,15 +36725,43 @@ var EMRInstanceGroupConfigProvider = class {
 	* would return before the resize even starts. Waiting on the running count
 	* reaching the requested target settles both create (0 -> N provisioning)
 	* and resize (M -> N add/remove) correctly.
-	*/
-	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount) {
+	*
+	* `toleratesStaleFailedState` MUST be true on the resize path and false on
+	* create. It exists for the RECOVERY case: `SUSPENDED` (a resize that could
+	* not complete) is precisely the state a user re-runs `cdkd deploy` to fix,
+	* but the same pre-resize read lag documented above means the first poll
+	* after `ModifyInstanceGroups` still reports `SUSPENDED`. Enforcing
+	* {@link FAILED_STATES} on that stale read would abort the very resize that
+	* recovers the group, on every attempt, making the state permanently
+	* unrecoverable through cdkd.
+	*
+	* So on a resize the failed-state check is suppressed until the group is
+	* observed LEAVING whatever state it started in; from then on it is enforced
+	* normally (a resize that transitions RUNNING -> RESIZING -> SUSPENDED still
+	* fails fast, which is the case #1092 item 2 is about). A group that never
+	* leaves its initial state falls through to the `maxWaitMs` timeout — the
+	* pre-fix behavior, and strictly better than an unrecoverable resource.
+	*
+	* Note the asymmetry that makes this specific to failed states: a stale
+	* pre-resize `RUNNING` is harmless because the instance-count mismatch keeps
+	* the loop polling. A stale `SUSPENDED` is terminal.
+	*/
+	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount, toleratesStaleFailedState = false) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
+		let initialState;
+		let hasLeftInitialState = false;
 		while (Date.now() - startTime < this.maxWaitMs) {
 			const group = await this.findGroupForPoll(clusterId, groupId, transientState);
 			const state = group?.Status?.State;
+			if (state) {
+				if (initialState === void 0) initialState = state;
+				else if (state !== initialState) hasLeftInitialState = true;
+			}
 			if (state && READY_STATES$1.has(state) && group?.RunningInstanceCount === expectedCount) return;
-			if (state && FAILED_STATES$1.has(state)) throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, groupId);
+			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
+			if (state && enforceFailedStates && FAILED_STATES$1.has(state)) throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, groupId);
+			if (state && !enforceFailedStates && FAILED_STATES$1.has(state)) this.logger.debug(`EMR instance group ${groupId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance group ${groupId} state: ${state ?? "unknown"}, running ${group?.RunningInstanceCount ?? "?"}/${expectedCount}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -36446,10 +36817,20 @@ const DEFAULT_POLL_INTERVAL_MS = 15e3;
 /** Instance-fleet state that means "the fleet is up and idle/serving". */
 const READY_STATES = /* @__PURE__ */ new Set(["RUNNING"]);
 /**
-* Instance-fleet states that mean "the fleet is gone" — a hard error during a
-* create/resize wait (it will never reach RUNNING).
+* Instance-fleet states that mean "the fleet will never reach the requested
+* capacity" — a hard error during a create/resize wait.
+*
+* `TERMINATED` means the fleet is gone. `SUSPENDED` means a resize could not
+* complete: the existing instances keep running but AWS can no longer add or
+* remove any, so the wait would poll to the full `maxWaitMs` timeout instead of
+* failing fast with the service's own state-change reason (issue #1092 item 2).
+*
+* This is the fleet-state ANALOGUE of the instance-group provider's failed set,
+* not a copy of it: the two enums differ. `ARRESTED` and `ENDED` are
+* `InstanceGroupState` members that do not exist for fleets, so `TERMINATED` is
+* the only state the two sets share.
 */
-const FAILED_STATES = /* @__PURE__ */ new Set(["TERMINATED"]);
+const FAILED_STATES = /* @__PURE__ */ new Set(["SUSPENDED", "TERMINATED"]);
 const toNumber = (v) => {
 	if (v === void 0) return void 0;
 	const n = Number(v);
@@ -36602,7 +36983,7 @@ var EMRInstanceFleetConfigProvider = class {
 			}));
 			const newTarget = this.targetCapacity(properties);
 			const prevTarget = this.targetCapacity(previousProperties);
-			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, newTarget, newTarget >= prevTarget);
+			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, newTarget, newTarget >= prevTarget, true);
 			this.logger.debug(`Successfully updated EMR instance fleet ${logicalId}`);
 			return {
 				physicalId,
@@ -36662,17 +37043,45 @@ var EMRInstanceFleetConfigProvider = class {
 	*
 	* A `targetCapacity` of 0 on the up path (never valid for a real create —
 	* at least one target must be > 0) degrades to a State-only wait.
-	*/
-	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, targetCapacity, atLeast) {
+	*
+	* `toleratesStaleFailedState` MUST be true on the resize path and false on
+	* create. It exists for the RECOVERY case: `SUSPENDED` (a resize that could
+	* not complete) is precisely the state a user re-runs `cdkd deploy` to fix,
+	* but the same pre-resize read lag documented above means the first poll
+	* after `ModifyInstanceFleet` still reports `SUSPENDED`. Enforcing
+	* {@link FAILED_STATES} on that stale read would abort the very resize that
+	* recovers the fleet, on every attempt, making the state permanently
+	* unrecoverable through cdkd.
+	*
+	* So on a resize the failed-state check is suppressed until the fleet is
+	* observed LEAVING whatever state it started in; from then on it is enforced
+	* normally (a resize that transitions RUNNING -> RESIZING -> SUSPENDED still
+	* fails fast, which is the case #1092 item 2 is about). A fleet that never
+	* leaves its initial state falls through to the `maxWaitMs` timeout — the
+	* pre-fix behavior, and strictly better than an unrecoverable resource.
+	*
+	* Note the asymmetry that makes this specific to failed states: a stale
+	* pre-resize `RUNNING` is harmless because the capacity check keeps the loop
+	* polling. A stale `SUSPENDED` is terminal.
+	*/
+	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, targetCapacity, atLeast, toleratesStaleFailedState = false) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
+		let initialState;
+		let hasLeftInitialState = false;
 		while (Date.now() - startTime < this.maxWaitMs) {
 			const fleet = await this.findFleetForPoll(clusterId, fleetId, transientState);
 			const state = fleet?.Status?.State;
 			const provisioned = (fleet?.ProvisionedOnDemandCapacity ?? 0) + (fleet?.ProvisionedSpotCapacity ?? 0);
 			const capacityReady = atLeast ? provisioned >= targetCapacity : provisioned <= targetCapacity;
+			if (state) {
+				if (initialState === void 0) initialState = state;
+				else if (state !== initialState) hasLeftInitialState = true;
+			}
 			if (state && READY_STATES.has(state) && capacityReady) return;
-			if (state && FAILED_STATES.has(state)) throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, fleetId);
+			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
+			if (state && enforceFailedStates && FAILED_STATES.has(state)) throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, fleetId);
+			if (state && !enforceFailedStates && FAILED_STATES.has(state)) this.logger.debug(`EMR instance fleet ${fleetId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance fleet ${fleetId} state: ${state ?? "unknown"}, provisioned ${provisioned}/${targetCapacity}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -61608,7 +62017,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.250.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.252.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());