@go-to-k/cdkd 0.254.0 → 0.255.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as BOOTSTRAP_MARKER_PREFIX, A as refStateLookupFromResource, At as AssemblyReader, B as TemplateParser, C as ProviderRegistry, Ct as warnDeprecatedNoPrefixCliFlag, D as isTerminationProtectionPropagationError, Dt as findLargeInlineResources, E as disableInstanceApiTermination, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as IntrinsicFunctionResolver, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as collectInlinePolicyNamesManagedBySiblings, St as resolveUseCdkBootstrapAssets, T as CloudControlProvider, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as gray, _t as resolveAutoAssetStorage, a as withRetry, at as buildDockerImage, b as yellow, bt as resolveStateBucketWithDefault, c as IMPLICIT_DELETE_DEPENDENCIES, ct as runDockerForeground, d as MULTI_REGION_RECREATE_BLOCKED_TYPES, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as isStatefulRecreateTargetSync, ft as Synthesizer, g as cyan, gt as resolveApp, h as bold, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as WAFv2WebACLProvider, k as cfnRefValueFromPhysicalId, kt as expectedOwnerParam, l as computeImplicitDeleteEdges, lt as runDockerStreaming, m as formatResourceLine, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as isRetryableTransientError, ot as formatDockerLoginError, p as renderStatefulReason, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as isThrottlingError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as extractDeploymentEventError, ut as AssetManifestLoader, v as green, vt as resolveCaptureObservedState, w as findActionableSilentDrops, wt as CFN_TEMPLATE_BODY_LIMIT, x as IAMRoleProvider, xt as resolveStateBucketWithDefaultAndSource, y as red, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-d-cwg8zS.js";
+import { $ as BOOTSTRAP_MARKER_PREFIX, A as refStateLookupFromResource, At as AssemblyReader, B as TemplateParser, C as ProviderRegistry, Ct as warnDeprecatedNoPrefixCliFlag, D as isTerminationProtectionPropagationError, Dt as findLargeInlineResources, E as disableInstanceApiTermination, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as IntrinsicFunctionResolver, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as isRetryableTransientError, St as resolveUseCdkBootstrapAssets, T as CloudControlProvider, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as yellow, _t as resolveAutoAssetStorage, a as IMPLICIT_DELETE_DEPENDENCIES, at as buildDockerImage, b as importTagWalk, bt as resolveStateBucketWithDefault, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as runDockerForeground, d as formatResourceLine, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as bold, ft as Synthesizer, g as red, gt as resolveApp, h as green, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as WAFv2WebACLProvider, k as cfnRefValueFromPhysicalId, kt as expectedOwnerParam, l as isStatefulRecreateTargetSync, lt as runDockerStreaming, m as gray, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as computeImplicitDeleteEdges, ot as formatDockerLoginError, p as cyan, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as extractDeploymentEventError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as renderStatefulReason, ut as AssetManifestLoader, v as IAMRoleProvider, vt as resolveCaptureObservedState, w as findActionableSilentDrops, wt as CFN_TEMPLATE_BODY_LIMIT, x as withRetry, xt as resolveStateBucketWithDefaultAndSource, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-CFUNbwD1.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BgcH5ymP.js";
+import { t as ASGProvider } from "./asg-provider-BPtdM67j.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1888,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.254.0";
+	return "0.255.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -3504,28 +3504,36 @@ var IAMManagedPolicyProvider = class {
 			};
 			return null;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.iamClient.send(new ListPoliciesCommand({
-				Scope: "Local",
-				...marker ? { Marker: marker } : {}
-			}));
-			for (const policy of list.Policies ?? []) {
-				if (!policy.Arn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.iamClient.send(new ListPoliciesCommand({
+					Scope: "Local",
+					...marker ? { Marker: marker } : {}
+				}));
+				return {
+					items: list.Policies,
+					nextMarker: list.IsTruncated ? list.Marker : void 0
+				};
+			},
+			describe: async (policy) => {
+				if (!policy.Arn) return void 0;
 				try {
-					if (matchesCdkPath((await this.iamClient.send(new ListPolicyTagsCommand({ PolicyArn: policy.Arn }))).Tags, input.cdkPath)) return {
-						physicalId: policy.Arn,
-						attributes: { PolicyArn: policy.Arn }
-					};
+					return await this.iamClient.send(new ListPolicyTagsCommand({ PolicyArn: policy.Arn }));
 				} catch (err) {
-					if (err instanceof NoSuchEntityException) continue;
+					if (err instanceof NoSuchEntityException) return void 0;
 					throw err;
 				}
-			}
-			marker = list.IsTruncated ? list.Marker : void 0;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tags) => tags.Tags
+		});
+		if (!match) return null;
+		const arn = match.summary.Arn;
+		return {
+			physicalId: arn,
+			attributes: { PolicyArn: arn }
+		};
 	}
 	async attachToPrincipals(policyArn, groups, roles, users) {
 		if (groups && Array.isArray(groups)) for (const groupName of groups) {
@@ -6297,22 +6305,32 @@ var S3BucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const list = await this.s3Client.send(new ListBucketsCommand({}));
-		for (const b of list.Buckets ?? []) {
-			if (!b.Name) continue;
-			try {
-				if (matchesCdkPath((await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }))).TagSet, input.cdkPath)) return {
-					physicalId: b.Name,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async () => {
+				return {
+					items: (await this.s3Client.send(new ListBucketsCommand({}))).Buckets,
+					nextMarker: void 0
 				};
-			} catch (err) {
-				const e = err;
-				if (e.name === "NoSuchTagSet" || e.name === "AccessDenied" || e.$metadata?.httpStatusCode === 301) continue;
-				throw err;
-			}
-		}
-		return null;
+			},
+			describe: async (b) => {
+				if (!b.Name) return void 0;
+				try {
+					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
+				} catch (err) {
+					const e = err;
+					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied" || e.$metadata?.httpStatusCode === 301) return;
+					throw err;
+				}
+			},
+			tagsOf: (tagging) => tagging.TagSet
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 	/**
 	* Delete a bucket, emptying it first if not empty.
@@ -7156,22 +7174,34 @@ var SQSQueueProvider = class {
 			if (err instanceof QueueDoesNotExist) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.sqsClient.send(new ListQueuesCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const url of list.QueueUrls ?? []) try {
-				if ((await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: url }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
-					physicalId: url,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.sqsClient.send(new ListQueuesCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.QueueUrls,
+					nextMarker: list.NextToken
 				};
-			} catch (err) {
-				if (err instanceof QueueDoesNotExist) continue;
-				throw err;
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			describe: async (url) => {
+				try {
+					return await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: url }));
+				} catch (err) {
+					if (err instanceof QueueDoesNotExist) return void 0;
+					throw err;
+				}
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 };
 
@@ -7841,6 +7871,15 @@ var SNSTopicProvider = class {
 	*  1. `--resource` override → trust as ARN, verify via `GetTopicAttributes`.
 	*  2. `Properties.TopicName` → `ListTopics` to find matching ARN.
 	*  3. `aws:cdk:path` tag match via `ListTopics` + `ListTagsForResource`.
+	*
+	* Steps 2 and 3 share ONE `ListTopics` walk (per candidate: name check
+	* first, then the tag read — only when a `cdkPath` is present), which runs
+	* through the shared `importTagWalk` helper so the N+1 `ListTagsForResource`
+	* burst is retried with exponential backoff when AWS throttles it instead
+	* of aborting the whole import. The name match is expressed to the walk as
+	* a synthetic `aws:cdk:path` tag carrying the walk's own lookup key, so a
+	* name-only template (no CDK path metadata) still resolves without any tag
+	* API call — matching the previous inline loop.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7854,28 +7893,40 @@ var SNSTopicProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["TopicName"] === "string" ? input.properties["TopicName"] : void 0;
-		let nextToken;
-		do {
-			const list = await this.snsClient.send(new ListTopicsCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const t of list.Topics ?? []) {
-				if (!t.TopicArn) continue;
-				const arnTail = t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1);
-				if (desiredName && arnTail === desiredName) return {
-					physicalId: t.TopicArn,
-					attributes: {}
+		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:sns-topic-name:${desiredName}` : void 0);
+		/** Sentinel detail for a candidate matched by its ARN-tail topic name. */
+		const NAME_MATCH = { nameMatch: true };
+		const match = await importTagWalk({
+			cdkPath: walkCdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.snsClient.send(new ListTopicsCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.Topics,
+					nextMarker: list.NextToken
 				};
-				if (input.cdkPath) try {
-					if (matchesCdkPath((await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: t.TopicArn }))).Tags, input.cdkPath)) return {
-						physicalId: t.TopicArn,
-						attributes: {}
-					};
+			},
+			describe: async (t) => {
+				if (!t.TopicArn) return void 0;
+				const arnTail = t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1);
+				if (desiredName && arnTail === desiredName) return NAME_MATCH;
+				if (!input.cdkPath) return void 0;
+				try {
+					return await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: t.TopicArn }));
 				} catch (err) {
-					if (err instanceof NotFoundException) continue;
+					if (err instanceof NotFoundException) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
+			},
+			tagsOf: (detail) => "nameMatch" in detail ? [{
+				Key: CDK_PATH_TAG,
+				Value: walkCdkPath
+			}] : detail.Tags
+		});
+		if (match?.summary.TopicArn) return {
+			physicalId: match.summary.TopicArn,
+			attributes: {}
+		};
 		return null;
 	}
 };
@@ -9232,8 +9283,12 @@ var LambdaFunctionProvider = class {
 	*  2. `ListFunctions` + `ListTags`, match `aws:cdk:path` tag.
 	*
 	* Lambda's `ListTags` returns a `Tags` map keyed by tag name (unlike
-	* EC2/S3 which return an array of `{Key, Value}`), so we read it directly
-	* instead of going through the shared `matchesCdkPath` helper.
+	* EC2/S3 which return an array of `{Key, Value}`), so the map is re-shaped
+	* to `{Key, Value}` entries for the walk's matcher.
+	*
+	* The tag walk runs through the shared `importTagWalk` helper, so the N+1
+	* `ListTags` burst is retried with exponential backoff when AWS throttles
+	* it instead of aborting the whole import.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "FunctionName");
@@ -9247,25 +9302,35 @@ var LambdaFunctionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.lambdaClient.send(new ListFunctionsCommand({ ...marker && { Marker: marker } }));
-			for (const fn of list.Functions ?? []) {
-				if (!fn.FunctionArn || !fn.FunctionName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.lambdaClient.send(new ListFunctionsCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.Functions,
+					nextMarker: list.NextMarker
+				};
+			},
+			describe: async (fn) => {
+				if (!fn.FunctionArn || !fn.FunctionName) return void 0;
 				try {
-					if ((await this.lambdaClient.send(new ListTagsCommand({ Resource: fn.FunctionArn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: fn.FunctionName,
-						attributes: {}
-					};
+					return await this.lambdaClient.send(new ListTagsCommand({ Resource: fn.FunctionArn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException) continue;
+					if (err instanceof ResourceNotFoundException) return void 0;
 					throw err;
 				}
-			}
-			marker = list.NextMarker;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.FunctionName,
+			attributes: {}
+		};
 	}
 };
 
@@ -11404,24 +11469,33 @@ var DynamoDBTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let exclusiveStartTableName;
-		do {
-			const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...exclusiveStartTableName && { ExclusiveStartTableName: exclusiveStartTableName } }));
-			for (const name of list.TableNames ?? []) try {
-				const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-				if (!arn) continue;
-				if (matchesCdkPath((await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }))).Tags, input.cdkPath)) return {
-					physicalId: name,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
+				return {
+					items: list.TableNames,
+					nextMarker: list.LastEvaluatedTableName
 				};
-			} catch (err) {
-				if (err instanceof ResourceNotFoundException$1) continue;
-				throw err;
-			}
-			exclusiveStartTableName = list.LastEvaluatedTableName;
-		} while (exclusiveStartTableName);
-		return null;
+			},
+			describe: async (name) => {
+				try {
+					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
+					if (!arn) return void 0;
+					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return void 0;
+					throw err;
+				}
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 };
 
@@ -13197,26 +13271,36 @@ var LogsLogGroupProvider = class {
 			if (err instanceof ResourceNotFoundException$4) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.logsClient.send(new DescribeLogGroupsCommand({ ...nextToken && { nextToken } }));
-			for (const g of list.logGroups ?? []) {
-				if (!g.logGroupName || !g.arn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.logsClient.send(new DescribeLogGroupsCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.logGroups,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (g) => {
+				if (!g.logGroupName || !g.arn) return void 0;
 				const arnForTags = g.arn.replace(/:\*$/, "");
 				try {
-					if ((await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: g.logGroupName,
-						attributes: {}
-					};
+					return await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$4) continue;
+					if (err instanceof ResourceNotFoundException$4) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.logGroupName,
+			attributes: {}
+		};
 	}
 };
 
@@ -13533,26 +13617,32 @@ var CloudWatchAlarmProvider = class {
 			if (this.isNotFound(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.cloudWatchClient.send(new DescribeAlarmsCommand({ ...nextToken && { NextToken: nextToken } }));
-			const all = [...list.MetricAlarms ?? [], ...list.CompositeAlarms ?? []];
-			for (const a of all) {
-				if (!a.AlarmArn || !a.AlarmName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.cloudWatchClient.send(new DescribeAlarmsCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: [...list.MetricAlarms ?? [], ...list.CompositeAlarms ?? []],
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (a) => {
+				if (!a.AlarmArn || !a.AlarmName) return void 0;
 				try {
-					if (matchesCdkPath((await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: a.AlarmArn }))).Tags, input.cdkPath)) return {
-						physicalId: a.AlarmName,
-						attributes: {}
-					};
+					return await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: a.AlarmArn }));
 				} catch (err) {
-					if (this.isNotFound(err)) continue;
+					if (this.isNotFound(err)) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.AlarmName,
+			attributes: {}
+		};
 	}
 	isNotFound(err) {
 		if (!(err instanceof Error)) return false;
@@ -14129,28 +14219,35 @@ var SSMParameterProvider = class {
 			if (err instanceof ParameterNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.ssmClient.send(new DescribeParametersCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const p of list.Parameters ?? []) {
-				if (!p.Name) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.ssmClient.send(new DescribeParametersCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.Parameters,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (p) => {
+				if (!p.Name) return void 0;
 				try {
-					if (matchesCdkPath((await this.ssmClient.send(new ListTagsForResourceCommand$2({
+					return await this.ssmClient.send(new ListTagsForResourceCommand$2({
 						ResourceType: "Parameter",
 						ResourceId: p.Name
-					}))).TagList, input.cdkPath)) return {
-						physicalId: p.Name,
-						attributes: {}
-					};
+					}));
 				} catch (err) {
-					if (err instanceof ParameterNotFound) continue;
+					if (err instanceof ParameterNotFound) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.TagList
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 };
 
@@ -25212,155 +25309,6 @@ var RDSDBProxyTargetGroupProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/import-tag-walk.ts
-/**
-* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
-*
-* Providers that adopt a resource without an explicit name property fall back
-* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
-* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
-* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
-* summaries usually do not carry tags. That is an inherent **N+1** read
-* pattern: an account with many resources of the type produces one API call
-* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
-*
-* Every provider previously hand-rolled this loop with NO backoff, so a single
-* throttled `Describe*` aborted the whole `cdkd import` run. This helper
-* centralises the loop and wraps BOTH the list page fetch and the per-candidate
-* describe in the deploy engine's `withRetry` with exponential backoff.
-*
-* ## Why a narrower classifier than `isRetryableTransientError`
-*
-* The deploy engine's classifier is tuned for the WRITE path: it also treats
-* eventual-consistency phrasings like `does not exist` / `not authorized to
-* perform` as transient, because a just-created dependency legitimately needs a
-* moment to propagate. On a read-only import walk those messages mean the
-* opposite — the candidate really is gone, or the caller's credentials really
-* lack the permission — and retrying them burns the full backoff budget per
-* candidate before surfacing the true error.
-*
-* So the walk retries throttling ONLY, reusing the deploy engine's throttle
-* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
-* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
-*
-* ## Batching
-*
-* Batched tag reads are deliberately NOT modelled here: the services this
-* helper currently serves (EMR `DescribeCluster`, DocDB
-* `ListTagsForResource`) expose only single-resource reads. A service that
-* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
-* satisfy several candidates from one call inside its own `describe` callback,
-* or bypass the helper entirely.
-*/
-/** Max number of retries after the first attempt, per API call in the walk. */
-const DEFAULT_MAX_RETRIES = 5;
-/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
-const DEFAULT_INITIAL_DELAY_MS = 500;
-/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
-const DEFAULT_MAX_DELAY_MS = 5e3;
-/**
-* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
-* one call. Backoff is per-call, so without this a sustained throttle against a
-* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
-* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
-* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
-* DocDB account completes in seconds when AWS is not throttling) and bounds the
-* pathological case to something a user will wait through.
-*/
-const DEFAULT_MAX_WALK_MS = 10 * 6e4;
-/**
-* Ceiling on pages fetched. A service that returns a non-advancing pagination
-* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
-* forever. This is now the shared path every migrated provider runs on, so the
-* guard belongs here rather than in each caller.
-*/
-const DEFAULT_MAX_PAGES = 1e3;
-/**
-* Whether an error hit during the read-only tag walk is a rate-limit rejection
-* worth backing off on.
-*
-* Delegates the error + `.cause` chain traversal to the deploy engine's
-* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
-* at every cause depth) and adds the canonical `Rate exceeded` message, which
-* several services return with an HTTP 400 and a service-specific error name.
-*
-* This is deliberately NARROWER than `isRetryableTransientError`: that
-* classifier also treats write-path eventual-consistency phrasings (`does not
-* exist`, `not authorized to perform`) as transient, because a just-created
-* dependency legitimately needs a moment to propagate. On a read-only walk
-* those mean the candidate really is gone or the credentials really lack the
-* permission, and retrying them burns the full backoff budget per candidate
-* before surfacing the true error.
-*
-* Exported for direct unit testing and for providers whose tag walk cannot use
-* {@link importTagWalk} verbatim.
-*/
-function isThrottlingLikeError(error, message) {
-	return isThrottlingError(error) || message.includes("Rate exceeded");
-}
-/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
-var ImportTagWalkLimitError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ImportTagWalkLimitError";
-	}
-};
-/**
-* Paginate `listPage`, `describe` each candidate, and return the first one
-* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
-* candidate matches (or when `cdkPath` is empty).
-*
-* Both callbacks are individually retried with exponential backoff on
-* throttling errors, so one rate-limited call mid-walk no longer aborts the
-* whole import.
-*/
-async function importTagWalk(options) {
-	const { cdkPath, listPage, describe, tagsOf } = options;
-	if (!cdkPath) return null;
-	const logicalId = options.logicalId ?? "import";
-	const logger = options.retry?.logger ?? getLogger();
-	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
-	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
-	const retryOpts = {
-		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
-		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
-		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
-		isRetryable: (message, error) => isThrottlingLikeError(error, message),
-		logger,
-		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
-		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
-		...options.retry?.sleep && { sleep: options.retry.sleep }
-	};
-	const startedAt = Date.now();
-	const assertWithinBudget = (stage) => {
-		const elapsed = Date.now() - startedAt;
-		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-	};
-	let marker;
-	let pages = 0;
-	do {
-		assertWithinBudget("listing candidates");
-		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-		const currentMarker = marker;
-		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
-		for (const summary of page.items ?? []) {
-			assertWithinBudget("reading candidate tags");
-			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
-			if (detail === void 0) {
-				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
-				continue;
-			}
-			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
-				summary,
-				detail
-			};
-		}
-		marker = page.nextMarker;
-	} while (marker);
-	return null;
-}
-
 //#endregion
 //#region src/provisioning/providers/docdb-provider.ts
 /**
@@ -33297,9 +33245,12 @@ var KinesisStreamProvider = class {
 	*     with `DescribeStream`.
 	*  2. Walk `ListStreams` (paged via `ExclusiveStartStreamName`) and
 	*     match the `aws:cdk:path` tag via `ListTagsForStream(StreamName)`.
+	*     The walk runs through the shared `importTagWalk` helper, so the N+1
+	*     tag-read burst is retried with exponential backoff when AWS
+	*     throttles it instead of aborting the whole import.
 	*
 	* Kinesis tags use the standard `Tag[]` array shape (`Key`/`Value`),
-	* so `matchesCdkPath` from import-helpers applies directly.
+	* so the walk's `matchesCdkPath` matcher applies directly.
 	*/
 	/**
 	* Read the AWS-current Kinesis stream configuration in CFn-property shape.
@@ -33363,19 +33314,25 @@ var KinesisStreamProvider = class {
 			if (err instanceof ResourceNotFoundException$8) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let exclusiveStartStreamName;
-		while (true) {
-			const list = await this.getClient().send(new ListStreamsCommand({ ...exclusiveStartStreamName && { ExclusiveStartStreamName: exclusiveStartStreamName } }));
-			const names = list.StreamNames ?? [];
-			for (const streamName of names) if (matchesCdkPath((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: streamName }))).Tags, input.cdkPath)) return {
-				physicalId: streamName,
-				attributes: {}
-			};
-			if (!list.HasMoreStreams || names.length === 0) break;
-			exclusiveStartStreamName = names[names.length - 1];
-		}
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListStreamsCommand({ ...marker && { ExclusiveStartStreamName: marker } }));
+				const names = list.StreamNames ?? [];
+				return {
+					items: names,
+					nextMarker: list.HasMoreStreams && names.length > 0 ? names[names.length - 1] : void 0
+				};
+			},
+			describe: async (streamName) => await this.getClient().send(new ListTagsForStreamCommand({ StreamName: streamName })),
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 	/**
 	* Poll DescribeStream until the stream reaches ACTIVE status
@@ -35042,7 +34999,10 @@ var FSxFileSystemProvider = class {
 			diff: {},
 			hasMutableDiff: false
 		};
-		const storageCapacityChanged = changed("StorageCapacity");
+		const resolvedStorageCapacity = toNumber$3(properties["StorageCapacity"]);
+		const storageCapacityIsPlaceholder = resolvedStorageCapacity !== void 0 && resolvedStorageCapacity <= 0;
+		if (storageCapacityIsPlaceholder && changed("StorageCapacity")) this.logger.debug(`Suppressing non-positive StorageCapacity (${resolvedStorageCapacity}) for FSx FileSystem ${logicalId}: this is the readCurrentState placeholder for a capacity-less file system (Lustre Intelligent-Tiering), not a desired value.`);
+		const storageCapacityChanged = changed("StorageCapacity") && !storageCapacityIsPlaceholder;
 		const storageTypeChanged = changed("StorageType");
 		const typeVersionChanged = changed("FileSystemTypeVersion");
 		const networkTypeChanged = changed("NetworkType");
@@ -35430,6 +35390,40 @@ var FSxFileSystemProvider = class {
 			default: return;
 		}
 	}
+	/** Map the read-side `LustreConfiguration` back to CFn input shape. */
+	readLustreConfiguration(lustre) {
+		const config = {};
+		putIfDefined(config, "WeeklyMaintenanceStartTime", lustre.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "DeploymentType", lustre.DeploymentType);
+		putIfDefined(config, "PerUnitStorageThroughput", lustre.PerUnitStorageThroughput);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", lustre.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "AutomaticBackupRetentionDays", lustre.AutomaticBackupRetentionDays);
+		putIfDefined(config, "CopyTagsToBackups", lustre.CopyTagsToBackups);
+		putIfDefined(config, "DriveCacheType", lustre.DriveCacheType);
+		putIfDefined(config, "DataCompressionType", lustre.DataCompressionType);
+		putIfDefined(config, "EfaEnabled", lustre.EfaEnabled);
+		putIfDefined(config, "ThroughputCapacity", lustre.ThroughputCapacity);
+		if (lustre.MetadataConfiguration) {
+			const metadata = {};
+			putIfDefined(metadata, "Mode", lustre.MetadataConfiguration.Mode);
+			putIfDefined(metadata, "Iops", lustre.MetadataConfiguration.Iops);
+			if (Object.keys(metadata).length > 0) config["MetadataConfiguration"] = metadata;
+		}
+		if (lustre.DataReadCacheConfiguration) {
+			const readCache = {};
+			putIfDefined(readCache, "SizingMode", lustre.DataReadCacheConfiguration.SizingMode);
+			putIfDefined(readCache, "SizeGiB", lustre.DataReadCacheConfiguration.SizeGiB);
+			if (Object.keys(readCache).length > 0) config["DataReadCacheConfiguration"] = readCache;
+		}
+		const dataRepo = lustre.DataRepositoryConfiguration;
+		if (dataRepo) {
+			putIfDefined(config, "ImportPath", dataRepo.ImportPath);
+			putIfDefined(config, "ExportPath", dataRepo.ExportPath);
+			putIfDefined(config, "AutoImportPolicy", dataRepo.AutoImportPolicy);
+			putIfDefined(config, "ImportedFileChunkSize", dataRepo.ImportedFileChunkSize);
+		}
+		return config;
+	}
 	/** Map the read-side `WindowsConfiguration` back to CFn input shape. */
 	readWindowsConfiguration(windows) {
 		const config = {};
@@ -35587,8 +35581,14 @@ var FSxFileSystemProvider = class {
 	* mapped back from the nested `DataRepositoryConfiguration` the API
 	* returns. The Windows / ONTAP / OpenZFS variant blocks are reverse-mapped
 	* by their respective `read*Configuration` helpers; the few inputs AWS
-	* never returns stay listed in {@link getDriftUnknownPaths}. At most one
-	* variant block is ever present (they key off `FileSystemType`).
+	* never returns stay listed in {@link getDriftUnknownPaths}.
+	*
+	* Emission follows `docs/provider-development.md` §3b: every top-level
+	* property `update()` can mutate is emitted unconditionally with a
+	* placeholder, registry-createOnly properties keep their guard, and the
+	* `<Variant>Configuration` blocks take the Class 1 type-discriminator
+	* carve-out — exactly the ONE block matching `FileSystemType` is emitted
+	* (at most one is ever legal on AWS), never the other three.
 	* Returns `undefined` when the file system is gone.
 	*/
 	async readCurrentState(physicalId, _logicalId, resourceType) {
@@ -35603,59 +35603,31 @@ var FSxFileSystemProvider = class {
 		if (!fs) return void 0;
 		const result = {};
 		putIfDefined(result, "FileSystemType", fs.FileSystemType);
-		putIfDefined(result, "StorageCapacity", fs.StorageCapacity);
-		putIfDefined(result, "StorageType", fs.StorageType);
 		putIfDefined(result, "SubnetIds", fs.SubnetIds ? [...fs.SubnetIds] : void 0);
 		putIfDefined(result, "KmsKeyId", fs.KmsKeyId);
-		putIfDefined(result, "FileSystemTypeVersion", fs.FileSystemTypeVersion);
-		putIfDefined(result, "NetworkType", fs.NetworkType);
-		const lustre = fs.LustreConfiguration;
-		if (lustre) {
-			const config = {};
-			putIfDefined(config, "WeeklyMaintenanceStartTime", lustre.WeeklyMaintenanceStartTime);
-			putIfDefined(config, "DeploymentType", lustre.DeploymentType);
-			putIfDefined(config, "PerUnitStorageThroughput", lustre.PerUnitStorageThroughput);
-			putIfDefined(config, "DailyAutomaticBackupStartTime", lustre.DailyAutomaticBackupStartTime);
-			putIfDefined(config, "AutomaticBackupRetentionDays", lustre.AutomaticBackupRetentionDays);
-			putIfDefined(config, "CopyTagsToBackups", lustre.CopyTagsToBackups);
-			putIfDefined(config, "DriveCacheType", lustre.DriveCacheType);
-			putIfDefined(config, "DataCompressionType", lustre.DataCompressionType);
-			putIfDefined(config, "EfaEnabled", lustre.EfaEnabled);
-			putIfDefined(config, "ThroughputCapacity", lustre.ThroughputCapacity);
-			if (lustre.MetadataConfiguration) {
-				const metadata = {};
-				putIfDefined(metadata, "Mode", lustre.MetadataConfiguration.Mode);
-				putIfDefined(metadata, "Iops", lustre.MetadataConfiguration.Iops);
-				if (Object.keys(metadata).length > 0) config["MetadataConfiguration"] = metadata;
-			}
-			if (lustre.DataReadCacheConfiguration) {
-				const readCache = {};
-				putIfDefined(readCache, "SizingMode", lustre.DataReadCacheConfiguration.SizingMode);
-				putIfDefined(readCache, "SizeGiB", lustre.DataReadCacheConfiguration.SizeGiB);
-				if (Object.keys(readCache).length > 0) config["DataReadCacheConfiguration"] = readCache;
-			}
-			const dataRepo = lustre.DataRepositoryConfiguration;
-			if (dataRepo) {
-				putIfDefined(config, "ImportPath", dataRepo.ImportPath);
-				putIfDefined(config, "ExportPath", dataRepo.ExportPath);
-				putIfDefined(config, "AutoImportPolicy", dataRepo.AutoImportPolicy);
-				putIfDefined(config, "ImportedFileChunkSize", dataRepo.ImportedFileChunkSize);
-			}
-			if (Object.keys(config).length > 0) result["LustreConfiguration"] = config;
-		}
-		if (fs.WindowsConfiguration) {
-			const config = this.readWindowsConfiguration(fs.WindowsConfiguration);
-			if (Object.keys(config).length > 0) result["WindowsConfiguration"] = config;
-		}
-		if (fs.OntapConfiguration) {
-			const config = this.readOntapConfiguration(fs.OntapConfiguration);
-			if (Object.keys(config).length > 0) result["OntapConfiguration"] = config;
-		}
-		if (fs.OpenZFSConfiguration) {
-			const config = this.readOpenZFSConfiguration(fs.OpenZFSConfiguration);
-			if (Object.keys(config).length > 0) result["OpenZFSConfiguration"] = config;
-		}
+		result["StorageCapacity"] = fs.StorageCapacity ?? 0;
+		result["StorageType"] = fs.StorageType ?? "SSD";
+		result["FileSystemTypeVersion"] = fs.FileSystemTypeVersion ?? "";
+		result["NetworkType"] = fs.NetworkType ?? "IPV4";
 		result["Tags"] = normalizeAwsTagsToCfn(fs.Tags);
+		const variantKey = fs.FileSystemType ? VARIANT_CONFIG_KEY[fs.FileSystemType] : void 0;
+		switch (variantKey) {
+			case "LustreConfiguration":
+				result[variantKey] = this.readLustreConfiguration(fs.LustreConfiguration ?? {});
+				break;
+			case "WindowsConfiguration":
+				result[variantKey] = this.readWindowsConfiguration(fs.WindowsConfiguration ?? {});
+				break;
+			case "OntapConfiguration":
+				result[variantKey] = this.readOntapConfiguration(fs.OntapConfiguration ?? {});
+				break;
+			case "OpenZFSConfiguration":
+				result[variantKey] = this.readOpenZFSConfiguration(fs.OpenZFSConfiguration ?? {});
+				break;
+			default:
+				this.logger.warn(`FSx FileSystem ${physicalId} has FileSystemType '${fs.FileSystemType ?? "(unset)"}', which cdkd does not recognize (expected one of ${Object.keys(VARIANT_CONFIG_KEY).join(" / ")}). Its variant configuration is NOT included in the drift snapshot, so drift in that block cannot be detected. Please report this at https://github.com/go-to-k/cdkd/issues`);
+				break;
+		}
 		return result;
 	}
 	/**
@@ -41422,25 +41394,32 @@ var ECRProvider = class {
 			if (err instanceof RepositoryNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new DescribeRepositoriesCommand({ ...nextToken && { nextToken } }));
-			for (const repo of list.repositories ?? []) {
-				if (!repo.repositoryArn || !repo.repositoryName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new DescribeRepositoriesCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.repositories,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (repo) => {
+				if (!repo.repositoryArn || !repo.repositoryName) return void 0;
 				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: repo.repositoryArn }))).tags, input.cdkPath)) return {
-						physicalId: repo.repositoryName,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: repo.repositoryArn }));
 				} catch (err) {
-					if (err instanceof RepositoryNotFoundException) continue;
+					if (err instanceof RepositoryNotFoundException) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.repositoryName,
+			attributes: {}
+		};
 	}
 };
 
@@ -62069,6 +62048,47 @@ function createMigrateCommand() {
 	return new Command("migrate").description("Adopt a plain (non-CDK) CloudFormation stack into a cdkd-managed CDK app. Generates new CDK code via upstream `cdk migrate`, builds a logical-ID mapping between the source CFn template and the synth template, writes cdkd state, and (optionally) retires the source CFn stack. AWS resources are never modified.").argument("[stack]", "Source CFn stack name. Alias for --from-cfn-stack.").addOption(new Option("--from-cfn-stack <name>", "Source CloudFormation stack name to adopt. Required (or pass positionally).")).addOption(new Option("--output-dir <dir>", "Directory to write the generated CDK app to. Defaults to <cwd>/<CfnStackName>.")).addOption(new Option("--language <choice>", "Generated code language. v1: typescript only.").choices(["typescript"]).default("typescript")).addOption(new Option("--region <region>", "AWS region. Defaults to AWS_REGION env / profile.")).addOption(new Option("--account <id>", "AWS account ID. Auto-detected via STS when omitted.")).addOption(new Option("--retire-cfn-stack", "After cdkd state is written, inject DeletionPolicy=Retain on every resource in the source CFn stack and DeleteStack. AWS resources stay; the CFn stack record is gone. Off by default.").default(false)).addOption(new Option("--filter <key=value>", "Pass-through to `cdk migrate --filter` for resource subsetting. Repeatable.").argParser((value, previous) => [...previous ?? [], value]).default([])).addOption(new Option("--skip-install", "Skip `npm install` after codegen.").default(false)).addOption(new Option("--skip-synth", "Skip `cdk synth` (does NOT write cdkd state). Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("--dry-run", "Print the import plan without writing state or retiring the CFn stack. Mutually exclusive with --retire-cfn-stack.").default(false)).addOption(new Option("-y, --yes", "Auto-confirm the import + retirement prompts.").default(false)).addOption(new Option("--cdk-bin <path>", "Override the `cdk` binary path.")).addOption(new Option("--resource-mapping <file>", `Path to a JSON file of {sourceLogicalId: synthLogicalId} overrides. Same shape as the auto-written ${RESOURCE_MAPPING_FILENAME}.`)).addOption(new Option("--state-bucket <name>", "cdkd state bucket. Defaults to cdkd-state-<accountId>.")).addOption(new Option("--state-prefix <prefix>", "cdkd state prefix inside the bucket.").default("cdkd")).addOption(new Option("--profile <name>", "AWS profile name.")).addOption(new Option("--role-arn <arn>", "IAM role to assume before any AWS call.")).addOption(new Option("--verbose", "Enable debug-level logging.").default(false)).action(withErrorHandling(migrateCommandAction));
 }
 
+//#endregion
+//#region src/cli/program.ts
+/**
+* Builds the full `cdkd` command tree.
+*
+* Lives in its own module rather than in `index.ts` because importing
+* `index.ts` runs `main()` as a side effect — the same reason
+* `pipe-close-handler.ts` was split out. Tooling can import this one safely.
+*
+* The consumer that motivated the split is
+* `scripts/check-integ-cli-flags.ts`, which validates every CLI invocation in
+* the integ fixtures against the option set of the subcommand that actually
+* declares the flag. Reading the real tree matters: `--help` omits hidden
+* options, and `src/cli/options.ts` is a flat global list with no command
+* attachment — so a flag declared there but never attached to a given
+* subcommand (the `cdkd import --region` case, which silently meant an entire
+* fixture's import round-trip never ran) is invisible to both.
+*/
+function buildProgram() {
+	const program = new Command();
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.255.0");
+	program.addCommand(createBootstrapCommand());
+	program.addCommand(createSynthCommand());
+	program.addCommand(createListCommand());
+	program.addCommand(createDeployCommand());
+	program.addCommand(createDiffCommand());
+	program.addCommand(createDriftCommand());
+	program.addCommand(createDestroyCommand());
+	program.addCommand(createEventsCommand());
+	program.addCommand(createGcCommand());
+	program.addCommand(createOrphanCommand());
+	program.addCommand(createImportCommand());
+	program.addCommand(createPublishAssetsCommand());
+	program.addCommand(createForceUnlockCommand());
+	program.addCommand(createStateCommand());
+	program.addCommand(createLocalCommand());
+	program.addCommand(createExportCommand());
+	program.addCommand(createMigrateCommand());
+	return program;
+}
+
 //#endregion
 //#region src/cli/pipe-close-handler.ts
 /**
@@ -62137,25 +62157,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	installPipeCloseHandler();
-	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.254.0");
-	program.addCommand(createBootstrapCommand());
-	program.addCommand(createSynthCommand());
-	program.addCommand(createListCommand());
-	program.addCommand(createDeployCommand());
-	program.addCommand(createDiffCommand());
-	program.addCommand(createDriftCommand());
-	program.addCommand(createDestroyCommand());
-	program.addCommand(createEventsCommand());
-	program.addCommand(createGcCommand());
-	program.addCommand(createOrphanCommand());
-	program.addCommand(createImportCommand());
-	program.addCommand(createPublishAssetsCommand());
-	program.addCommand(createForceUnlockCommand());
-	program.addCommand(createStateCommand());
-	program.addCommand(createLocalCommand());
-	program.addCommand(createExportCommand());
-	program.addCommand(createMigrateCommand());
+	const program = buildProgram();
 	const args = reorderArgs(process.argv);
 	await program.parseAsync(args);
 }