@go-to-k/cdkd 0.251.0 → 0.252.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as ensureAssetStorage, A as WAFv2WebACLProvider, B as LockManager, Bt as LocalInvokeBuildError$1, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_BODY_LIMIT, D as IntrinsicFunctionResolver, Dt as uploadCfnTemplate, E as isTerminationProtectionPropagationError, Et as findLargeInlineResources, F as assertRegionMatch, Ft as setAwsClients, G as stringifyValue, Gt as NestedStackChildDirectDestroyError, H as rebuildClientForBucketRegion, Ht as LocalStartServiceError, I as applyRoleArnIfSet, J as createAssetRedirectResolver, Jt as ResourceTimeoutError, K as WorkGraph, Kt as PartialFailureError, L as DiffCalculator, Lt as CdkdError, M as matchesCdkPath, Mt as AwsClients, N as normalizeAwsTagsToCfn, Nt as getAwsClients, O as cfnRefValueFromPhysicalId, Ot as expectedOwnerParam, P as resolveExplicitPhysicalId, Pt as resetAwsClients, Q as BOOTSTRAP_MARKER_PREFIX, R as DagBuilder, S as ProviderRegistry, St as warnDeprecatedNoPrefixCliFlag, T as disableInstanceApiTermination, Tt as MIGRATE_TMP_PREFIX, U as shouldRetainResource, V as S3StateBackend, Vt as LocalMigrateError, W as AssetPublisher, Wt as MissingCdkCliError, X as rewriteTemplateAssetReferences, Xt as StackHasActiveImportsError, Y as loadPublishableAssetManifest, Yt as ResourceUpdateNotSupportedError, Z as AssetModeResolver, Zt as StackTerminationProtectionError, _ as green, _t as resolveCaptureObservedState, a as withRetry, at as formatDockerLoginError, b as IAMRoleProvider, bt as resolveStateBucketWithDefaultAndSource, c as computeImplicitDeleteEdges, ct as runDockerStreaming, d as isStatefulRecreateTargetSync, dt as Synthesizer, et as getBootstrapMarkerKey, f as renderStatefulReason, ft as synthesisStatusMessage, g as gray, gt as resolveAutoAssetStorage, h as cyan, ht as resolveApp, i as withResourceDeadline, it as buildDockerImage, j as CDK_PATH_TAG, jt as resolveBucketRegion, k as refStateLookupFromResource, kt as AssemblyReader, l as extractDeploymentEventError, lt as AssetManifestLoader, m as bold, mt as getLegacyStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as normalizeAwsError, nt as validateAssetBucketName, o as isRetryableTransientError, ot as getDockerCmd, p as formatResourceLine, pt as getDefaultStateBucketName, q as buildAssetRedirectMap, qt as ProvisioningError, r as DeployEngine, rn as withErrorHandling, rt as validateContainerRepoName, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerForeground, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as parseBootstrapMarker, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as getDockerImageBySourceHash, v as red, vt as resolveSkipPrefix, w as CloudControlProvider, wt as CFN_TEMPLATE_URL_LIMIT, x as collectInlinePolicyNamesManagedBySiblings, xt as resolveUseCdkBootstrapAssets, y as yellow, yt as resolveStateBucketWithDefault, z as TemplateParser } from "./deploy-engine-D-gBbMiZ.js";
+import { $ as BOOTSTRAP_MARKER_PREFIX, A as refStateLookupFromResource, At as AssemblyReader, B as TemplateParser, C as ProviderRegistry, Ct as warnDeprecatedNoPrefixCliFlag, D as isTerminationProtectionPropagationError, Dt as findLargeInlineResources, E as disableInstanceApiTermination, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as IntrinsicFunctionResolver, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as collectInlinePolicyNamesManagedBySiblings, St as resolveUseCdkBootstrapAssets, T as CloudControlProvider, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as gray, _t as resolveAutoAssetStorage, a as withRetry, at as buildDockerImage, b as yellow, bt as resolveStateBucketWithDefault, c as IMPLICIT_DELETE_DEPENDENCIES, ct as runDockerForeground, d as MULTI_REGION_RECREATE_BLOCKED_TYPES, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as isStatefulRecreateTargetSync, ft as Synthesizer, g as cyan, gt as resolveApp, h as bold, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as WAFv2WebACLProvider, k as cfnRefValueFromPhysicalId, kt as expectedOwnerParam, l as computeImplicitDeleteEdges, lt as runDockerStreaming, m as formatResourceLine, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as isRetryableTransientError, ot as formatDockerLoginError, p as renderStatefulReason, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as isThrottlingError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as extractDeploymentEventError, ut as AssetManifestLoader, v as green, vt as resolveCaptureObservedState, w as findActionableSilentDrops, wt as CFN_TEMPLATE_BODY_LIMIT, x as IAMRoleProvider, xt as resolveStateBucketWithDefaultAndSource, y as red, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-IkhnJXWR.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-er3xGYRo.js";
+import { t as ASGProvider } from "./asg-provider-BzBdoSYp.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1888,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.251.0";
+	return "0.252.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -25221,6 +25221,155 @@ var RDSDBProxyTargetGroupProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/import-tag-walk.ts
+/**
+* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
+*
+* Providers that adopt a resource without an explicit name property fall back
+* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
+* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
+* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
+* summaries usually do not carry tags. That is an inherent **N+1** read
+* pattern: an account with many resources of the type produces one API call
+* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
+*
+* Every provider previously hand-rolled this loop with NO backoff, so a single
+* throttled `Describe*` aborted the whole `cdkd import` run. This helper
+* centralises the loop and wraps BOTH the list page fetch and the per-candidate
+* describe in the deploy engine's `withRetry` with exponential backoff.
+*
+* ## Why a narrower classifier than `isRetryableTransientError`
+*
+* The deploy engine's classifier is tuned for the WRITE path: it also treats
+* eventual-consistency phrasings like `does not exist` / `not authorized to
+* perform` as transient, because a just-created dependency legitimately needs a
+* moment to propagate. On a read-only import walk those messages mean the
+* opposite — the candidate really is gone, or the caller's credentials really
+* lack the permission — and retrying them burns the full backoff budget per
+* candidate before surfacing the true error.
+*
+* So the walk retries throttling ONLY, reusing the deploy engine's throttle
+* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
+* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
+*
+* ## Batching
+*
+* Batched tag reads are deliberately NOT modelled here: the services this
+* helper currently serves (EMR `DescribeCluster`, DocDB
+* `ListTagsForResource`) expose only single-resource reads. A service that
+* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
+* satisfy several candidates from one call inside its own `describe` callback,
+* or bypass the helper entirely.
+*/
+/** Max number of retries after the first attempt, per API call in the walk. */
+const DEFAULT_MAX_RETRIES = 5;
+/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
+const DEFAULT_INITIAL_DELAY_MS = 500;
+/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
+const DEFAULT_MAX_DELAY_MS = 5e3;
+/**
+* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
+* one call. Backoff is per-call, so without this a sustained throttle against a
+* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
+* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
+* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
+* DocDB account completes in seconds when AWS is not throttling) and bounds the
+* pathological case to something a user will wait through.
+*/
+const DEFAULT_MAX_WALK_MS = 10 * 6e4;
+/**
+* Ceiling on pages fetched. A service that returns a non-advancing pagination
+* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
+* forever. This is now the shared path every migrated provider runs on, so the
+* guard belongs here rather than in each caller.
+*/
+const DEFAULT_MAX_PAGES = 1e3;
+/**
+* Whether an error hit during the read-only tag walk is a rate-limit rejection
+* worth backing off on.
+*
+* Delegates the error + `.cause` chain traversal to the deploy engine's
+* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
+* at every cause depth) and adds the canonical `Rate exceeded` message, which
+* several services return with an HTTP 400 and a service-specific error name.
+*
+* This is deliberately NARROWER than `isRetryableTransientError`: that
+* classifier also treats write-path eventual-consistency phrasings (`does not
+* exist`, `not authorized to perform`) as transient, because a just-created
+* dependency legitimately needs a moment to propagate. On a read-only walk
+* those mean the candidate really is gone or the credentials really lack the
+* permission, and retrying them burns the full backoff budget per candidate
+* before surfacing the true error.
+*
+* Exported for direct unit testing and for providers whose tag walk cannot use
+* {@link importTagWalk} verbatim.
+*/
+function isThrottlingLikeError(error, message) {
+	return isThrottlingError(error) || message.includes("Rate exceeded");
+}
+/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
+var ImportTagWalkLimitError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ImportTagWalkLimitError";
+	}
+};
+/**
+* Paginate `listPage`, `describe` each candidate, and return the first one
+* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
+* candidate matches (or when `cdkPath` is empty).
+*
+* Both callbacks are individually retried with exponential backoff on
+* throttling errors, so one rate-limited call mid-walk no longer aborts the
+* whole import.
+*/
+async function importTagWalk(options) {
+	const { cdkPath, listPage, describe, tagsOf } = options;
+	if (!cdkPath) return null;
+	const logicalId = options.logicalId ?? "import";
+	const logger = options.retry?.logger ?? getLogger();
+	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
+	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
+	const retryOpts = {
+		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
+		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
+		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
+		isRetryable: (message, error) => isThrottlingLikeError(error, message),
+		logger,
+		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
+		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
+		...options.retry?.sleep && { sleep: options.retry.sleep }
+	};
+	const startedAt = Date.now();
+	const assertWithinBudget = (stage) => {
+		const elapsed = Date.now() - startedAt;
+		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+	};
+	let marker;
+	let pages = 0;
+	do {
+		assertWithinBudget("listing candidates");
+		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+		const currentMarker = marker;
+		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
+		for (const summary of page.items ?? []) {
+			assertWithinBudget("reading candidate tags");
+			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
+			if (detail === void 0) {
+				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
+				continue;
+			}
+			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
+				summary,
+				detail
+			};
+		}
+		marker = page.nextMarker;
+	} while (marker);
+	return null;
+}
+
 //#endregion
 //#region src/provisioning/providers/docdb-provider.ts
 /**
@@ -25696,6 +25845,9 @@ var DocDBProvider = class {
 	* Identifier` / `DBClusterIdentifier` / `DBSubnetGroupName`) are usually
 	* present in CDK templates; fall back to `aws:cdk:path` tag lookup via
 	* the corresponding `Describe*` + `ListTagsForResource` pair otherwise.
+	* The fallback walk runs through the shared `importTagWalk` helper, so the
+	* N+1 `ListTagsForResource` burst is retried with exponential backoff when
+	* AWS throttles it instead of aborting the whole import.
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -25811,20 +25963,24 @@ var DocDBProvider = class {
 			if (err.name === "DBInstanceNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBInstancesCommand$1({ ...marker && { Marker: marker } }));
-			for (const inst of list.DBInstances ?? []) {
-				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
-					physicalId: inst.DBInstanceIdentifier,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new DescribeDBInstancesCommand$1({ ...marker && { Marker: marker } }));
+				return {
+					items: list.DBInstances,
+					nextMarker: list.Marker
 				};
-			}
-			marker = list.Marker;
-		} while (marker);
-		return null;
+			},
+			describe: async (inst) => inst.DBInstanceIdentifier && inst.DBInstanceArn ? await this.listTagsForResource(inst.DBInstanceArn) : void 0,
+			tagsOf: (tags) => tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.DBInstanceIdentifier,
+			attributes: {}
+		};
 	}
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
@@ -25838,20 +25994,24 @@ var DocDBProvider = class {
 			if (err.name === "DBClusterNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBClustersCommand$1({ ...marker && { Marker: marker } }));
-			for (const c of list.DBClusters ?? []) {
-				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
-					physicalId: c.DBClusterIdentifier,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new DescribeDBClustersCommand$1({ ...marker && { Marker: marker } }));
+				return {
+					items: list.DBClusters,
+					nextMarker: list.Marker
 				};
-			}
-			marker = list.Marker;
-		} while (marker);
-		return null;
+			},
+			describe: async (c) => c.DBClusterIdentifier && c.DBClusterArn ? await this.listTagsForResource(c.DBClusterArn) : void 0,
+			tagsOf: (tags) => tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.DBClusterIdentifier,
+			attributes: {}
+		};
 	}
 	async importDBSubnetGroup(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBSubnetGroupName");
@@ -25865,20 +26025,33 @@ var DocDBProvider = class {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$1({ ...marker && { Marker: marker } }));
-			for (const sg of list.DBSubnetGroups ?? []) {
-				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
-					physicalId: sg.DBSubnetGroupName,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$1({ ...marker && { Marker: marker } }));
+				return {
+					items: list.DBSubnetGroups,
+					nextMarker: list.Marker
 				};
-			}
-			marker = list.Marker;
-		} while (marker);
-		return null;
+			},
+			describe: async (sg) => sg.DBSubnetGroupName && sg.DBSubnetGroupArn ? await this.listTagsForResource(sg.DBSubnetGroupArn) : void 0,
+			tagsOf: (tags) => tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.DBSubnetGroupName,
+			attributes: {}
+		};
+	}
+	/**
+	* `ListTagsForResource` for the tag-walk import path. Returns the tag list
+	* (possibly empty) so `importTagWalk` can match `aws:cdk:path` against it;
+	* `undefined` is reserved for "skip this candidate", which the callers signal
+	* before calling this.
+	*/
+	async listTagsForResource(resourceArn) {
+		return (await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: resourceArn }))).TagList ?? [];
 	}
 };
 
@@ -35382,6 +35555,38 @@ var FSxFileSystemProvider = class {
 		];
 	}
 	/**
+	* Plain-string arrays FSx returns as unordered sets.
+	*
+	*  - `WindowsConfiguration.Aliases` — DNS alias names (`files.example.com`).
+	*    Alternate names the file system answers to; the API documents no
+	*    ordering semantics and no name is privileged over another, so a
+	*    `DescribeFileSystems` reorder carries no meaning.
+	*
+	* This does not match the shared normalizer's AWS-id / ARN heuristic, so
+	* without the declaration a reorder would surface as phantom drift. Declared
+	* here rather than sorted in `readWindowsConfiguration` so the sort applies
+	* to BOTH comparison sides — see
+	* {@link ResourceProvider.getDriftUnorderedPaths}.
+	*
+	* Deliberately NOT declared:
+	*
+	*  - `WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.DnsIps` —
+	*    the API reference describes it only as "A list of IP addresses of DNS
+	*    servers or domain controllers in the self-managed AD directory"
+	*    (https://docs.aws.amazon.com/fsx/latest/APIReference/API_SelfManagedActiveDirectoryConfiguration.html),
+	*    with no statement that order is insignificant. DNS resolver lists are
+	*    conventionally preference-ordered (primary first), and if FSx honors
+	*    that when joining the domain, sorting would HIDE a real reorder. A
+	*    false positive is visible and correctable; silently hiding drift is
+	*    not. Same reasoning excludes ElastiCache `PreferredAvailabilityZones`.
+	*  - `OntapConfiguration.RouteTableIds` / `OpenZFSConfiguration.RouteTableIds`
+	*    — their `rtb-` elements already match the shared id heuristic.
+	*/
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::FSx::FileSystem") return [];
+		return ["WindowsConfiguration.Aliases"];
+	}
+	/**
 	* Read the AWS-current file system configuration in CFn-property shape
 	* via `DescribeFileSystems`. Lustre data-repository fields (`ImportPath`
 	* / `ExportPath` / `AutoImportPolicy` / `ImportedFileChunkSize`) are
@@ -36037,45 +36242,58 @@ var EMRClusterProvider = class {
 	*  2. Tag-based lookup: `ListClusters` filtered to the non-terminated states
 	*     (a `TERMINATED*` cluster is gone and must never be adopted), then a
 	*     `DescribeCluster` per candidate to read `Tags` (the list summaries do
-	*     NOT carry tags) and match `aws:cdk:path`.
+	*     NOT carry tags) and match `aws:cdk:path`. The walk runs through the
+	*     shared `importTagWalk` helper, so each list page / describe is retried
+	*     with exponential backoff when AWS throttles the N+1 read burst.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, null);
 		if (explicit) {
-			const cluster = await this.describeClusterOrNull(explicit);
+			const cluster = await this.describeClusterOrUndefined(explicit);
 			if (!cluster || cluster.Status?.State && TERMINAL_STATES.has(cluster.Status.State)) return null;
 			return {
 				physicalId: explicit,
 				attributes: this.buildAttributes(cluster)
 			};
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new ListClustersCommand$1({
-				ClusterStates: [...NON_TERMINATED_STATES],
-				...marker && { Marker: marker }
-			}));
-			for (const summary of list.Clusters ?? []) {
-				if (!summary.Id) continue;
-				const cluster = await this.describeClusterOrNull(summary.Id);
-				if (!cluster) continue;
-				if (matchesCdkPath(cluster.Tags, input.cdkPath)) return {
-					physicalId: summary.Id,
-					attributes: this.buildAttributes(cluster)
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListClustersCommand$1({
+					ClusterStates: [...NON_TERMINATED_STATES],
+					...marker && { Marker: marker }
+				}));
+				return {
+					items: list.Clusters,
+					nextMarker: list.Marker
 				};
-			}
-			marker = list.Marker;
-		} while (marker);
-		return null;
+			},
+			describe: async (summary) => summary.Id ? await this.describeClusterOrUndefined(summary.Id) : void 0,
+			tagsOf: (cluster) => cluster.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Id,
+			attributes: this.buildAttributes(match.detail)
+		};
 	}
 	/**
 	* `DescribeCluster` that maps a not-found (`InvalidRequestException` — the
-	* cluster id is unknown in this region / aged out of Describe) to `null`
-	* instead of throwing, so `import()` can treat it as "no match" rather than
-	* aborting the whole adoption run.
+	* cluster id is unknown in this region / aged out of Describe) to
+	* `undefined` instead of throwing, so `import()` can treat it as "no match"
+	* rather than aborting the whole adoption run.
+	*
+	* `undefined`, NOT `null`, is load-bearing: `importTagWalk` skips a candidate
+	* on `detail === undefined`, and an actual `null` would flow into `tagsOf`
+	* and `TypeError`. Also note the mapping is BROAD — `InvalidRequestException`
+	* covers more than not-found, so a genuine failure here degrades to "no
+	* match" and a subsequent deploy would CREATE a duplicate cluster rather than
+	* adopt the existing one. The walk logs each skip at debug so the case is at
+	* least visible under `--verbose`; narrowing the mapping needs a
+	* message/code-level discriminator AWS does not currently document.
 	*/
-	async describeClusterOrNull(clusterId) {
+	async describeClusterOrUndefined(clusterId) {
 		try {
 			return (await this.getClient().send(new DescribeClusterCommand({ ClusterId: clusterId }))).Cluster;
 		} catch (err) {
@@ -36114,7 +36332,7 @@ var EMRClusterProvider = class {
 	* optional `import` method's incremental opt-in shape.
 	*/
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
-		const cluster = await this.describeClusterOrNull(physicalId);
+		const cluster = await this.describeClusterOrUndefined(physicalId);
 		if (!cluster) return void 0;
 		let instanceGroups = [];
 		let instanceFleets = [];
@@ -36314,14 +36532,21 @@ const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
 /** Instance-group state that means "the group is up and idle/serving". */
 const READY_STATES$1 = /* @__PURE__ */ new Set(["RUNNING"]);
 /**
-* Instance-group states that mean "the group is gone / failed" — a hard
-* error during a create/resize wait (an ARRESTED group failed to provision;
-* TERMINATED/ENDED mean it will never reach RUNNING).
+* Instance-group states that mean "the group will never reach the requested
+* size" — a hard error during a create/resize wait.
+*
+* `ARRESTED` means the group failed to provision; `TERMINATED`/`ENDED` mean it
+* is gone. `SUSPENDED` means a resize could not complete: the existing
+* instances keep running but AWS can no longer add or remove any, so the wait
+* would poll to the full `maxWaitMs` timeout instead of failing fast with the
+* service's own state-change reason — the exact defect fixed on the
+* instance-fleet side in issue #1092 item 2, which applies verbatim here.
 */
 const FAILED_STATES$1 = /* @__PURE__ */ new Set([
 	"ARRESTED",
-	"TERMINATED",
-	"ENDED"
+	"ENDED",
+	"SUSPENDED",
+	"TERMINATED"
 ]);
 const toNumber$1 = (v) => {
 	if (v === void 0) return void 0;
@@ -36471,7 +36696,7 @@ var EMRInstanceGroupConfigProvider = class {
 						InstanceCount: toNumber$1(properties["InstanceCount"])
 					}]
 				}));
-				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
+				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0, true);
 			}
 			if (autoScalingChanged) {
 				if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} AutoScalingPolicy update needs JobFlowId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
@@ -36532,15 +36757,43 @@ var EMRInstanceGroupConfigProvider = class {
 	* would return before the resize even starts. Waiting on the running count
 	* reaching the requested target settles both create (0 -> N provisioning)
 	* and resize (M -> N add/remove) correctly.
-	*/
-	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount) {
+	*
+	* `toleratesStaleFailedState` MUST be true on the resize path and false on
+	* create. It exists for the RECOVERY case: `SUSPENDED` (a resize that could
+	* not complete) is precisely the state a user re-runs `cdkd deploy` to fix,
+	* but the same pre-resize read lag documented above means the first poll
+	* after `ModifyInstanceGroups` still reports `SUSPENDED`. Enforcing
+	* {@link FAILED_STATES} on that stale read would abort the very resize that
+	* recovers the group, on every attempt, making the state permanently
+	* unrecoverable through cdkd.
+	*
+	* So on a resize the failed-state check is suppressed until the group is
+	* observed LEAVING whatever state it started in; from then on it is enforced
+	* normally (a resize that transitions RUNNING -> RESIZING -> SUSPENDED still
+	* fails fast, which is the case #1092 item 2 is about). A group that never
+	* leaves its initial state falls through to the `maxWaitMs` timeout — the
+	* pre-fix behavior, and strictly better than an unrecoverable resource.
+	*
+	* Note the asymmetry that makes this specific to failed states: a stale
+	* pre-resize `RUNNING` is harmless because the instance-count mismatch keeps
+	* the loop polling. A stale `SUSPENDED` is terminal.
+	*/
+	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount, toleratesStaleFailedState = false) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
+		let initialState;
+		let hasLeftInitialState = false;
 		while (Date.now() - startTime < this.maxWaitMs) {
 			const group = await this.findGroupForPoll(clusterId, groupId, transientState);
 			const state = group?.Status?.State;
+			if (state) {
+				if (initialState === void 0) initialState = state;
+				else if (state !== initialState) hasLeftInitialState = true;
+			}
 			if (state && READY_STATES$1.has(state) && group?.RunningInstanceCount === expectedCount) return;
-			if (state && FAILED_STATES$1.has(state)) throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, groupId);
+			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
+			if (state && enforceFailedStates && FAILED_STATES$1.has(state)) throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, groupId);
+			if (state && !enforceFailedStates && FAILED_STATES$1.has(state)) this.logger.debug(`EMR instance group ${groupId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance group ${groupId} state: ${state ?? "unknown"}, running ${group?.RunningInstanceCount ?? "?"}/${expectedCount}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -36596,10 +36849,20 @@ const DEFAULT_POLL_INTERVAL_MS = 15e3;
 /** Instance-fleet state that means "the fleet is up and idle/serving". */
 const READY_STATES = /* @__PURE__ */ new Set(["RUNNING"]);
 /**
-* Instance-fleet states that mean "the fleet is gone" — a hard error during a
-* create/resize wait (it will never reach RUNNING).
+* Instance-fleet states that mean "the fleet will never reach the requested
+* capacity" — a hard error during a create/resize wait.
+*
+* `TERMINATED` means the fleet is gone. `SUSPENDED` means a resize could not
+* complete: the existing instances keep running but AWS can no longer add or
+* remove any, so the wait would poll to the full `maxWaitMs` timeout instead of
+* failing fast with the service's own state-change reason (issue #1092 item 2).
+*
+* This is the fleet-state ANALOGUE of the instance-group provider's failed set,
+* not a copy of it: the two enums differ. `ARRESTED` and `ENDED` are
+* `InstanceGroupState` members that do not exist for fleets, so `TERMINATED` is
+* the only state the two sets share.
 */
-const FAILED_STATES = /* @__PURE__ */ new Set(["TERMINATED"]);
+const FAILED_STATES = /* @__PURE__ */ new Set(["SUSPENDED", "TERMINATED"]);
 const toNumber = (v) => {
 	if (v === void 0) return void 0;
 	const n = Number(v);
@@ -36752,7 +37015,7 @@ var EMRInstanceFleetConfigProvider = class {
 			}));
 			const newTarget = this.targetCapacity(properties);
 			const prevTarget = this.targetCapacity(previousProperties);
-			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, newTarget, newTarget >= prevTarget);
+			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, newTarget, newTarget >= prevTarget, true);
 			this.logger.debug(`Successfully updated EMR instance fleet ${logicalId}`);
 			return {
 				physicalId,
@@ -36812,17 +37075,45 @@ var EMRInstanceFleetConfigProvider = class {
 	*
 	* A `targetCapacity` of 0 on the up path (never valid for a real create —
 	* at least one target must be > 0) degrades to a State-only wait.
-	*/
-	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, targetCapacity, atLeast) {
+	*
+	* `toleratesStaleFailedState` MUST be true on the resize path and false on
+	* create. It exists for the RECOVERY case: `SUSPENDED` (a resize that could
+	* not complete) is precisely the state a user re-runs `cdkd deploy` to fix,
+	* but the same pre-resize read lag documented above means the first poll
+	* after `ModifyInstanceFleet` still reports `SUSPENDED`. Enforcing
+	* {@link FAILED_STATES} on that stale read would abort the very resize that
+	* recovers the fleet, on every attempt, making the state permanently
+	* unrecoverable through cdkd.
+	*
+	* So on a resize the failed-state check is suppressed until the fleet is
+	* observed LEAVING whatever state it started in; from then on it is enforced
+	* normally (a resize that transitions RUNNING -> RESIZING -> SUSPENDED still
+	* fails fast, which is the case #1092 item 2 is about). A fleet that never
+	* leaves its initial state falls through to the `maxWaitMs` timeout — the
+	* pre-fix behavior, and strictly better than an unrecoverable resource.
+	*
+	* Note the asymmetry that makes this specific to failed states: a stale
+	* pre-resize `RUNNING` is harmless because the capacity check keeps the loop
+	* polling. A stale `SUSPENDED` is terminal.
+	*/
+	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, targetCapacity, atLeast, toleratesStaleFailedState = false) {
 		const startTime = Date.now();
 		const transientState = { count: 0 };
+		let initialState;
+		let hasLeftInitialState = false;
 		while (Date.now() - startTime < this.maxWaitMs) {
 			const fleet = await this.findFleetForPoll(clusterId, fleetId, transientState);
 			const state = fleet?.Status?.State;
 			const provisioned = (fleet?.ProvisionedOnDemandCapacity ?? 0) + (fleet?.ProvisionedSpotCapacity ?? 0);
 			const capacityReady = atLeast ? provisioned >= targetCapacity : provisioned <= targetCapacity;
+			if (state) {
+				if (initialState === void 0) initialState = state;
+				else if (state !== initialState) hasLeftInitialState = true;
+			}
 			if (state && READY_STATES.has(state) && capacityReady) return;
-			if (state && FAILED_STATES.has(state)) throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, fleetId);
+			const enforceFailedStates = !toleratesStaleFailedState || hasLeftInitialState;
+			if (state && enforceFailedStates && FAILED_STATES.has(state)) throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, fleetId);
+			if (state && !enforceFailedStates && FAILED_STATES.has(state)) this.logger.debug(`EMR instance fleet ${fleetId} still reads ${state} from before the resize; waiting for it to leave that state before treating it as failed`);
 			this.logger.debug(`EMR instance fleet ${fleetId} state: ${state ?? "unknown"}, provisioned ${provisioned}/${targetCapacity}, waiting...`);
 			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
 		}
@@ -44432,6 +44723,19 @@ function createDiffCommand() {
 * on BOTH sides before the diff. These two passes were surfaced by dogfooding
 * the sibling cdk-real-drift (cdkrd) tool, which hit the same false-positive
 * classes against the same kind of AWS-snapshot baseline.
+*
+* Plain-string arrays are NOT canonicalized by the two heuristic passes above,
+* because a scalar list can be order-significant. But several CFn inputs are
+* semantically unordered sets of plain strings (FSx `WindowsConfiguration.Aliases`,
+* `...SelfManagedActiveDirectoryConfiguration.DnsIps`, ...), so
+* {@link canonicalizeUnorderedArraysAtPaths} sorts them at an explicit,
+* provider-declared path list only — an opt-in seam mirroring
+* `getDriftUnknownPaths` (see `ResourceProvider.getDriftUnorderedPaths`).
+* Doing it HERE rather than inside the provider's reverse-mapper is load-bearing:
+* the normalizer runs on BOTH comparison sides, so it stays correct for the
+* `properties`-fallback baseline (a resource deployed before observed-capture,
+* whose baseline is the user's TEMPLATE order). Sorting only the AWS read side
+* would manufacture drift on exactly that path.
 */
 function canonicalizeTagListsDeep(v) {
 	if (Array.isArray(v)) {
@@ -44466,6 +44770,72 @@ function canonicalizeIdArraysDeep(v) {
 	}
 	return v;
 }
+/**
+* Match a dotted property path against a provider-declared path list.
+*
+* An entry matches when the path is exactly equal to it, OR when the entry is
+* a prefix followed by `.`. Every entry is therefore a SUBTREE declaration:
+* `'VpcConfig'` matches `VpcConfig`, `VpcConfig.SubnetIds`, and anything
+* deeper. There is no leaf-only form.
+*
+* Shared by the two provider-declared path lists so their semantics cannot
+* drift apart: `getDriftUnknownPaths` (via `isIgnoredPath` in
+* `drift-calculator.ts`) and `getDriftUnorderedPaths` (via
+* {@link canonicalizeUnorderedArraysAtPaths} below).
+*/
+function matchesPathPrefix(path, entries) {
+	for (const entry of entries) {
+		if (path === entry) return true;
+		if (path.startsWith(`${entry}.`)) return true;
+	}
+	return false;
+}
+/**
+* Sort plain-string arrays found at one of the provider-declared `paths`, and
+* ONLY there. Unlike the two heuristic passes above, this one is opt-in per
+* resource type via `ResourceProvider.getDriftUnorderedPaths` — a scalar list
+* is order-significant unless the provider says otherwise.
+*
+* Paths use dot-notation for nested keys and are matched by the shared
+* {@link matchesPathPrefix} rule, the same one `getDriftUnknownPaths` uses. So
+* `'WindowsConfiguration'` covers every plain-string array in that subtree, and
+* `'WindowsConfiguration.Aliases'` covers that path and everything beneath it
+* (every entry is a subtree declaration — there is no leaf-only form).
+*
+* One semantic DIVERGENCE from `getDriftUnknownPaths`, required for this pass
+* to work: `isIgnoredPath` never sees a path that crosses an array, because the
+* comparator's `diffAt` compares arrays wholesale via `deepEqual` and never
+* descends into elements. This walk DOES descend into array elements, giving
+* each element its parent's path (array indices never appear in paths). So
+* `'Items.Aliases'` is meaningful here — it reaches an `Aliases` array inside
+* each element of `Items` — while being inert as an ignore-path. The divergence
+* is strictly more permissive; nothing that matches for ignore-paths fails to
+* match here.
+*
+* Only arrays whose every element is a plain string are sorted, so a
+* mis-declared path can never reorder object or mixed-type elements. Nested
+* arrays are also left alone: an array element that is itself an array is not
+* descended into, so `{P: [['b','a']]}` never has its INNER list sorted by a
+* `'P'` declaration (no CFn shape in tree is an array-of-arrays, and sorting
+* one would contradict the plain-string-elements-only rule).
+*/
+function canonicalizeUnorderedArraysAtPaths(v, paths) {
+	if (paths.length === 0) return v;
+	return walkUnordered(v, "", paths);
+}
+function walkUnordered(v, path, paths) {
+	if (Array.isArray(v)) {
+		const mapped = v.map((el) => Array.isArray(el) ? el : walkUnordered(el, path, paths));
+		if (mapped.length > 1 && matchesPathPrefix(path, paths) && mapped.every((el) => typeof el === "string")) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+		return mapped;
+	}
+	if (v && typeof v === "object") {
+		const out = {};
+		for (const [k, val] of Object.entries(v)) out[k] = walkUnordered(val, path === "" ? k : `${path}.${k}`, paths);
+		return out;
+	}
+	return v;
+}
 
 //#endregion
 //#region src/analyzer/drift-calculator.ts
@@ -44525,25 +44895,35 @@ function canonicalizeIdArraysDeep(v) {
 * it is exactly equal to the entry, or when the entry is a prefix followed
 * by `.` — so `'Code'` excludes the whole `Code` subtree, and
 * `'VpcConfig.SubnetIds'` excludes only that leaf.
+*
+* `options.unorderedPaths` is supplied by the provider (via
+* `getDriftUnorderedPaths`) for plain-string arrays that are semantically
+* UNORDERED sets — e.g. FSx `WindowsConfiguration.Aliases`. Those are sorted on
+* BOTH sides before comparison so an AWS-side reorder is not phantom drift.
+* Path matching uses the same prefix rule as `ignorePaths`.
 */
 function calculateResourceDrift(stateProperties, awsProperties, options) {
 	const drifts = [];
 	const ignore = options?.ignorePaths ?? [];
 	const union = options?.unionWalkObjects ?? false;
-	stateProperties = canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties));
-	awsProperties = canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties));
+	const unordered = options?.unorderedPaths ?? [];
+	stateProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties)), unordered);
+	awsProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties)), unordered);
 	for (const key of Object.keys(stateProperties)) {
 		if (isIgnoredPath(key, ignore)) continue;
 		diffAt(key, stateProperties[key], awsProperties[key], drifts, ignore, union);
 	}
 	return drifts;
 }
+/**
+* Thin alias over the shared {@link matchesPathPrefix} rule, kept as a named
+* function because "ignored" is what the path list means at these call sites.
+* Sharing the implementation with `getDriftUnorderedPaths` is deliberate: both
+* lists are provider-declared and documented as reading the same way, so they
+* must not be able to drift apart.
+*/
 function isIgnoredPath(path, ignorePaths) {
-	for (const entry of ignorePaths) {
-		if (path === entry) return true;
-		if (path.startsWith(`${entry}.`)) return true;
-	}
-	return false;
+	return matchesPathPrefix(path, ignorePaths);
 }
 /**
 * Recursive worker. Pushes drift entries into `out` rather than
@@ -44945,10 +45325,12 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				continue;
 			}
 			const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType) : [];
+			const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
 			const useObserved = resource.observedProperties !== void 0;
 			const changes = calculateResourceDrift(useObserved ? resource.observedProperties : resource.properties ?? {}, aws, {
 				ignorePaths,
-				unionWalkObjects: useObserved
+				unionWalkObjects: useObserved,
+				unorderedPaths
 			});
 			if (changes.length === 0) outcomes.push({
 				kind: "clean",
@@ -61758,7 +62140,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.251.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.252.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());