@go-to-k/cdkd 0.254.1 → 0.256.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as BOOTSTRAP_MARKER_PREFIX, A as refStateLookupFromResource, At as AssemblyReader, B as TemplateParser, C as ProviderRegistry, Ct as warnDeprecatedNoPrefixCliFlag, D as isTerminationProtectionPropagationError, Dt as findLargeInlineResources, E as disableInstanceApiTermination, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as IntrinsicFunctionResolver, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as collectInlinePolicyNamesManagedBySiblings, St as resolveUseCdkBootstrapAssets, T as CloudControlProvider, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as gray, _t as resolveAutoAssetStorage, a as withRetry, at as buildDockerImage, b as yellow, bt as resolveStateBucketWithDefault, c as IMPLICIT_DELETE_DEPENDENCIES, ct as runDockerForeground, d as MULTI_REGION_RECREATE_BLOCKED_TYPES, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as isStatefulRecreateTargetSync, ft as Synthesizer, g as cyan, gt as resolveApp, h as bold, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as WAFv2WebACLProvider, k as cfnRefValueFromPhysicalId, kt as expectedOwnerParam, l as computeImplicitDeleteEdges, lt as runDockerStreaming, m as formatResourceLine, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as isRetryableTransientError, ot as formatDockerLoginError, p as renderStatefulReason, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as isThrottlingError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as extractDeploymentEventError, ut as AssetManifestLoader, v as green, vt as resolveCaptureObservedState, w as findActionableSilentDrops, wt as CFN_TEMPLATE_BODY_LIMIT, x as IAMRoleProvider, xt as resolveStateBucketWithDefaultAndSource, y as red, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-d-cwg8zS.js";
+import { $ as BOOTSTRAP_MARKER_PREFIX, A as refStateLookupFromResource, At as AssemblyReader, B as TemplateParser, C as ProviderRegistry, Ct as warnDeprecatedNoPrefixCliFlag, D as isTerminationProtectionPropagationError, Dt as findLargeInlineResources, E as disableInstanceApiTermination, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as IntrinsicFunctionResolver, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as isRetryableTransientError, St as resolveUseCdkBootstrapAssets, T as CloudControlProvider, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as yellow, _t as resolveAutoAssetStorage, a as IMPLICIT_DELETE_DEPENDENCIES, at as buildDockerImage, b as importTagWalk, bt as resolveStateBucketWithDefault, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as runDockerForeground, d as formatResourceLine, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as bold, ft as Synthesizer, g as red, gt as resolveApp, h as green, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as WAFv2WebACLProvider, k as cfnRefValueFromPhysicalId, kt as expectedOwnerParam, l as isStatefulRecreateTargetSync, lt as runDockerStreaming, m as gray, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as computeImplicitDeleteEdges, ot as formatDockerLoginError, p as cyan, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as extractDeploymentEventError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as renderStatefulReason, ut as AssetManifestLoader, v as IAMRoleProvider, vt as resolveCaptureObservedState, w as findActionableSilentDrops, wt as CFN_TEMPLATE_BODY_LIMIT, x as withRetry, xt as resolveStateBucketWithDefaultAndSource, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-vUgwldVH.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BgcH5ymP.js";
+import { t as ASGProvider } from "./asg-provider-DbIC4hWG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -505,6 +505,16 @@ const replaceOption = new Option("--replace", "Replace (DELETE + CREATE) a resou
 * (see `resolveUseCdkBootstrapAssets` in config-loader.ts).
 */
 const useCdkBootstrapAssetsOption = new Option("--use-cdk-bootstrap-assets", "Publish assets to the CDK bootstrap bucket/repo named by the asset manifest verbatim, skipping the cdkd asset-storage redirection even when this region is opted in via 'cdkd bootstrap'. For apps deployed via both CloudFormation and cdkd during a migration window. Per-app pin: cdk.json context.cdkd.useCdkBootstrapAssets. Also suppresses the legacy-mode 'cdk gc' notice.").default(false);
+/**
+* Issue #1111 — `--strict-getatt` (deploy only). By default, an
+* `Fn::GetAtt` for an attribute cdkd cannot construct falls back to the
+* resource's physical ID with a warning (hard-failing only on knowably-wrong
+* shapes: `*Arn` attributes with a non-ARN fallback, `*Url` with a
+* non-http(s) fallback — issue #1106). This flag promotes EVERY such
+* fallback to a hard error, and additionally fails the deploy when a stack
+* Output cannot be resolved (default: warn and store no value).
+*/
+const strictGetattOption = new Option("--strict-getatt", "Fail the deploy on ANY Fn::GetAtt that falls back to the physical ID because cdkd cannot construct the attribute (default: warn and use the physical ID, hard-failing only when the fallback is knowably wrong — an *Arn attribute with a non-ARN value or a *Url attribute with a non-http(s) value). Also fails the deploy when a stack Output cannot be resolved (default: warn and store no value).").default(false);
 const deployOptions = [
 	new Option("--concurrency <number>", "Maximum concurrent resource operations").default(10).argParser((value) => parseInt(value, 10)),
 	new Option("--stack-concurrency <number>", "Maximum concurrent stack deployments").default(4).argParser((value) => parseInt(value, 10)),
@@ -526,6 +536,7 @@ const deployOptions = [
 	forceStatefulRecreationOption,
 	replaceOption,
 	useCdkBootstrapAssetsOption,
+	strictGetattOption,
 	...resourceTimeoutOptions
 ];
 /**
@@ -1888,7 +1899,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.254.1";
+	return "0.256.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -3504,28 +3515,36 @@ var IAMManagedPolicyProvider = class {
 			};
 			return null;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.iamClient.send(new ListPoliciesCommand({
-				Scope: "Local",
-				...marker ? { Marker: marker } : {}
-			}));
-			for (const policy of list.Policies ?? []) {
-				if (!policy.Arn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.iamClient.send(new ListPoliciesCommand({
+					Scope: "Local",
+					...marker ? { Marker: marker } : {}
+				}));
+				return {
+					items: list.Policies,
+					nextMarker: list.IsTruncated ? list.Marker : void 0
+				};
+			},
+			describe: async (policy) => {
+				if (!policy.Arn) return void 0;
 				try {
-					if (matchesCdkPath((await this.iamClient.send(new ListPolicyTagsCommand({ PolicyArn: policy.Arn }))).Tags, input.cdkPath)) return {
-						physicalId: policy.Arn,
-						attributes: { PolicyArn: policy.Arn }
-					};
+					return await this.iamClient.send(new ListPolicyTagsCommand({ PolicyArn: policy.Arn }));
 				} catch (err) {
-					if (err instanceof NoSuchEntityException) continue;
+					if (err instanceof NoSuchEntityException) return void 0;
 					throw err;
 				}
-			}
-			marker = list.IsTruncated ? list.Marker : void 0;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tags) => tags.Tags
+		});
+		if (!match) return null;
+		const arn = match.summary.Arn;
+		return {
+			physicalId: arn,
+			attributes: { PolicyArn: arn }
+		};
 	}
 	async attachToPrincipals(policyArn, groups, roles, users) {
 		if (groups && Array.isArray(groups)) for (const groupName of groups) {
@@ -6297,22 +6316,32 @@ var S3BucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const list = await this.s3Client.send(new ListBucketsCommand({}));
-		for (const b of list.Buckets ?? []) {
-			if (!b.Name) continue;
-			try {
-				if (matchesCdkPath((await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }))).TagSet, input.cdkPath)) return {
-					physicalId: b.Name,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async () => {
+				return {
+					items: (await this.s3Client.send(new ListBucketsCommand({}))).Buckets,
+					nextMarker: void 0
 				};
-			} catch (err) {
-				const e = err;
-				if (e.name === "NoSuchTagSet" || e.name === "AccessDenied" || e.$metadata?.httpStatusCode === 301) continue;
-				throw err;
-			}
-		}
-		return null;
+			},
+			describe: async (b) => {
+				if (!b.Name) return void 0;
+				try {
+					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
+				} catch (err) {
+					const e = err;
+					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied" || e.$metadata?.httpStatusCode === 301) return;
+					throw err;
+				}
+			},
+			tagsOf: (tagging) => tagging.TagSet
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 	/**
 	* Delete a bucket, emptying it first if not empty.
@@ -7156,22 +7185,34 @@ var SQSQueueProvider = class {
 			if (err instanceof QueueDoesNotExist) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.sqsClient.send(new ListQueuesCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const url of list.QueueUrls ?? []) try {
-				if ((await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: url }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
-					physicalId: url,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.sqsClient.send(new ListQueuesCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.QueueUrls,
+					nextMarker: list.NextToken
 				};
-			} catch (err) {
-				if (err instanceof QueueDoesNotExist) continue;
-				throw err;
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			describe: async (url) => {
+				try {
+					return await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: url }));
+				} catch (err) {
+					if (err instanceof QueueDoesNotExist) return void 0;
+					throw err;
+				}
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 };
 
@@ -7841,6 +7882,15 @@ var SNSTopicProvider = class {
 	*  1. `--resource` override → trust as ARN, verify via `GetTopicAttributes`.
 	*  2. `Properties.TopicName` → `ListTopics` to find matching ARN.
 	*  3. `aws:cdk:path` tag match via `ListTopics` + `ListTagsForResource`.
+	*
+	* Steps 2 and 3 share ONE `ListTopics` walk (per candidate: name check
+	* first, then the tag read — only when a `cdkPath` is present), which runs
+	* through the shared `importTagWalk` helper so the N+1 `ListTagsForResource`
+	* burst is retried with exponential backoff when AWS throttles it instead
+	* of aborting the whole import. The name match is expressed to the walk as
+	* a synthetic `aws:cdk:path` tag carrying the walk's own lookup key, so a
+	* name-only template (no CDK path metadata) still resolves without any tag
+	* API call — matching the previous inline loop.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7854,28 +7904,40 @@ var SNSTopicProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["TopicName"] === "string" ? input.properties["TopicName"] : void 0;
-		let nextToken;
-		do {
-			const list = await this.snsClient.send(new ListTopicsCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const t of list.Topics ?? []) {
-				if (!t.TopicArn) continue;
-				const arnTail = t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1);
-				if (desiredName && arnTail === desiredName) return {
-					physicalId: t.TopicArn,
-					attributes: {}
+		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:sns-topic-name:${desiredName}` : void 0);
+		/** Sentinel detail for a candidate matched by its ARN-tail topic name. */
+		const NAME_MATCH = { nameMatch: true };
+		const match = await importTagWalk({
+			cdkPath: walkCdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.snsClient.send(new ListTopicsCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.Topics,
+					nextMarker: list.NextToken
 				};
-				if (input.cdkPath) try {
-					if (matchesCdkPath((await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: t.TopicArn }))).Tags, input.cdkPath)) return {
-						physicalId: t.TopicArn,
-						attributes: {}
-					};
+			},
+			describe: async (t) => {
+				if (!t.TopicArn) return void 0;
+				const arnTail = t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1);
+				if (desiredName && arnTail === desiredName) return NAME_MATCH;
+				if (!input.cdkPath) return void 0;
+				try {
+					return await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: t.TopicArn }));
 				} catch (err) {
-					if (err instanceof NotFoundException) continue;
+					if (err instanceof NotFoundException) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
+			},
+			tagsOf: (detail) => "nameMatch" in detail ? [{
+				Key: CDK_PATH_TAG,
+				Value: walkCdkPath
+			}] : detail.Tags
+		});
+		if (match?.summary.TopicArn) return {
+			physicalId: match.summary.TopicArn,
+			attributes: {}
+		};
 		return null;
 	}
 };
@@ -9232,8 +9294,12 @@ var LambdaFunctionProvider = class {
 	*  2. `ListFunctions` + `ListTags`, match `aws:cdk:path` tag.
 	*
 	* Lambda's `ListTags` returns a `Tags` map keyed by tag name (unlike
-	* EC2/S3 which return an array of `{Key, Value}`), so we read it directly
-	* instead of going through the shared `matchesCdkPath` helper.
+	* EC2/S3 which return an array of `{Key, Value}`), so the map is re-shaped
+	* to `{Key, Value}` entries for the walk's matcher.
+	*
+	* The tag walk runs through the shared `importTagWalk` helper, so the N+1
+	* `ListTags` burst is retried with exponential backoff when AWS throttles
+	* it instead of aborting the whole import.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "FunctionName");
@@ -9247,25 +9313,35 @@ var LambdaFunctionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.lambdaClient.send(new ListFunctionsCommand({ ...marker && { Marker: marker } }));
-			for (const fn of list.Functions ?? []) {
-				if (!fn.FunctionArn || !fn.FunctionName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.lambdaClient.send(new ListFunctionsCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.Functions,
+					nextMarker: list.NextMarker
+				};
+			},
+			describe: async (fn) => {
+				if (!fn.FunctionArn || !fn.FunctionName) return void 0;
 				try {
-					if ((await this.lambdaClient.send(new ListTagsCommand({ Resource: fn.FunctionArn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: fn.FunctionName,
-						attributes: {}
-					};
+					return await this.lambdaClient.send(new ListTagsCommand({ Resource: fn.FunctionArn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException) continue;
+					if (err instanceof ResourceNotFoundException) return void 0;
 					throw err;
 				}
-			}
-			marker = list.NextMarker;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.FunctionName,
+			attributes: {}
+		};
 	}
 };
 
@@ -11404,24 +11480,33 @@ var DynamoDBTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let exclusiveStartTableName;
-		do {
-			const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...exclusiveStartTableName && { ExclusiveStartTableName: exclusiveStartTableName } }));
-			for (const name of list.TableNames ?? []) try {
-				const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-				if (!arn) continue;
-				if (matchesCdkPath((await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }))).Tags, input.cdkPath)) return {
-					physicalId: name,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
+				return {
+					items: list.TableNames,
+					nextMarker: list.LastEvaluatedTableName
 				};
-			} catch (err) {
-				if (err instanceof ResourceNotFoundException$1) continue;
-				throw err;
-			}
-			exclusiveStartTableName = list.LastEvaluatedTableName;
-		} while (exclusiveStartTableName);
-		return null;
+			},
+			describe: async (name) => {
+				try {
+					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
+					if (!arn) return void 0;
+					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return void 0;
+					throw err;
+				}
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 };
 
@@ -13197,26 +13282,36 @@ var LogsLogGroupProvider = class {
 			if (err instanceof ResourceNotFoundException$4) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.logsClient.send(new DescribeLogGroupsCommand({ ...nextToken && { nextToken } }));
-			for (const g of list.logGroups ?? []) {
-				if (!g.logGroupName || !g.arn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.logsClient.send(new DescribeLogGroupsCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.logGroups,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (g) => {
+				if (!g.logGroupName || !g.arn) return void 0;
 				const arnForTags = g.arn.replace(/:\*$/, "");
 				try {
-					if ((await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: g.logGroupName,
-						attributes: {}
-					};
+					return await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$4) continue;
+					if (err instanceof ResourceNotFoundException$4) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.logGroupName,
+			attributes: {}
+		};
 	}
 };
 
@@ -13533,26 +13628,32 @@ var CloudWatchAlarmProvider = class {
 			if (this.isNotFound(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.cloudWatchClient.send(new DescribeAlarmsCommand({ ...nextToken && { NextToken: nextToken } }));
-			const all = [...list.MetricAlarms ?? [], ...list.CompositeAlarms ?? []];
-			for (const a of all) {
-				if (!a.AlarmArn || !a.AlarmName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.cloudWatchClient.send(new DescribeAlarmsCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: [...list.MetricAlarms ?? [], ...list.CompositeAlarms ?? []],
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (a) => {
+				if (!a.AlarmArn || !a.AlarmName) return void 0;
 				try {
-					if (matchesCdkPath((await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: a.AlarmArn }))).Tags, input.cdkPath)) return {
-						physicalId: a.AlarmName,
-						attributes: {}
-					};
+					return await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: a.AlarmArn }));
 				} catch (err) {
-					if (this.isNotFound(err)) continue;
+					if (this.isNotFound(err)) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.AlarmName,
+			attributes: {}
+		};
 	}
 	isNotFound(err) {
 		if (!(err instanceof Error)) return false;
@@ -14129,28 +14230,35 @@ var SSMParameterProvider = class {
 			if (err instanceof ParameterNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.ssmClient.send(new DescribeParametersCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const p of list.Parameters ?? []) {
-				if (!p.Name) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.ssmClient.send(new DescribeParametersCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.Parameters,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (p) => {
+				if (!p.Name) return void 0;
 				try {
-					if (matchesCdkPath((await this.ssmClient.send(new ListTagsForResourceCommand$2({
+					return await this.ssmClient.send(new ListTagsForResourceCommand$2({
 						ResourceType: "Parameter",
 						ResourceId: p.Name
-					}))).TagList, input.cdkPath)) return {
-						physicalId: p.Name,
-						attributes: {}
-					};
+					}));
 				} catch (err) {
-					if (err instanceof ParameterNotFound) continue;
+					if (err instanceof ParameterNotFound) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.TagList
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 };
 
@@ -25212,155 +25320,6 @@ var RDSDBProxyTargetGroupProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/import-tag-walk.ts
-/**
-* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
-*
-* Providers that adopt a resource without an explicit name property fall back
-* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
-* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
-* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
-* summaries usually do not carry tags. That is an inherent **N+1** read
-* pattern: an account with many resources of the type produces one API call
-* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
-*
-* Every provider previously hand-rolled this loop with NO backoff, so a single
-* throttled `Describe*` aborted the whole `cdkd import` run. This helper
-* centralises the loop and wraps BOTH the list page fetch and the per-candidate
-* describe in the deploy engine's `withRetry` with exponential backoff.
-*
-* ## Why a narrower classifier than `isRetryableTransientError`
-*
-* The deploy engine's classifier is tuned for the WRITE path: it also treats
-* eventual-consistency phrasings like `does not exist` / `not authorized to
-* perform` as transient, because a just-created dependency legitimately needs a
-* moment to propagate. On a read-only import walk those messages mean the
-* opposite — the candidate really is gone, or the caller's credentials really
-* lack the permission — and retrying them burns the full backoff budget per
-* candidate before surfacing the true error.
-*
-* So the walk retries throttling ONLY, reusing the deploy engine's throttle
-* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
-* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
-*
-* ## Batching
-*
-* Batched tag reads are deliberately NOT modelled here: the services this
-* helper currently serves (EMR `DescribeCluster`, DocDB
-* `ListTagsForResource`) expose only single-resource reads. A service that
-* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
-* satisfy several candidates from one call inside its own `describe` callback,
-* or bypass the helper entirely.
-*/
-/** Max number of retries after the first attempt, per API call in the walk. */
-const DEFAULT_MAX_RETRIES = 5;
-/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
-const DEFAULT_INITIAL_DELAY_MS = 500;
-/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
-const DEFAULT_MAX_DELAY_MS = 5e3;
-/**
-* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
-* one call. Backoff is per-call, so without this a sustained throttle against a
-* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
-* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
-* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
-* DocDB account completes in seconds when AWS is not throttling) and bounds the
-* pathological case to something a user will wait through.
-*/
-const DEFAULT_MAX_WALK_MS = 10 * 6e4;
-/**
-* Ceiling on pages fetched. A service that returns a non-advancing pagination
-* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
-* forever. This is now the shared path every migrated provider runs on, so the
-* guard belongs here rather than in each caller.
-*/
-const DEFAULT_MAX_PAGES = 1e3;
-/**
-* Whether an error hit during the read-only tag walk is a rate-limit rejection
-* worth backing off on.
-*
-* Delegates the error + `.cause` chain traversal to the deploy engine's
-* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
-* at every cause depth) and adds the canonical `Rate exceeded` message, which
-* several services return with an HTTP 400 and a service-specific error name.
-*
-* This is deliberately NARROWER than `isRetryableTransientError`: that
-* classifier also treats write-path eventual-consistency phrasings (`does not
-* exist`, `not authorized to perform`) as transient, because a just-created
-* dependency legitimately needs a moment to propagate. On a read-only walk
-* those mean the candidate really is gone or the credentials really lack the
-* permission, and retrying them burns the full backoff budget per candidate
-* before surfacing the true error.
-*
-* Exported for direct unit testing and for providers whose tag walk cannot use
-* {@link importTagWalk} verbatim.
-*/
-function isThrottlingLikeError(error, message) {
-	return isThrottlingError(error) || message.includes("Rate exceeded");
-}
-/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
-var ImportTagWalkLimitError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ImportTagWalkLimitError";
-	}
-};
-/**
-* Paginate `listPage`, `describe` each candidate, and return the first one
-* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
-* candidate matches (or when `cdkPath` is empty).
-*
-* Both callbacks are individually retried with exponential backoff on
-* throttling errors, so one rate-limited call mid-walk no longer aborts the
-* whole import.
-*/
-async function importTagWalk(options) {
-	const { cdkPath, listPage, describe, tagsOf } = options;
-	if (!cdkPath) return null;
-	const logicalId = options.logicalId ?? "import";
-	const logger = options.retry?.logger ?? getLogger();
-	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
-	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
-	const retryOpts = {
-		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
-		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
-		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
-		isRetryable: (message, error) => isThrottlingLikeError(error, message),
-		logger,
-		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
-		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
-		...options.retry?.sleep && { sleep: options.retry.sleep }
-	};
-	const startedAt = Date.now();
-	const assertWithinBudget = (stage) => {
-		const elapsed = Date.now() - startedAt;
-		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-	};
-	let marker;
-	let pages = 0;
-	do {
-		assertWithinBudget("listing candidates");
-		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-		const currentMarker = marker;
-		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
-		for (const summary of page.items ?? []) {
-			assertWithinBudget("reading candidate tags");
-			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
-			if (detail === void 0) {
-				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
-				continue;
-			}
-			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
-				summary,
-				detail
-			};
-		}
-		marker = page.nextMarker;
-	} while (marker);
-	return null;
-}
-
 //#endregion
 //#region src/provisioning/providers/docdb-provider.ts
 /**
@@ -33297,9 +33256,12 @@ var KinesisStreamProvider = class {
 	*     with `DescribeStream`.
 	*  2. Walk `ListStreams` (paged via `ExclusiveStartStreamName`) and
 	*     match the `aws:cdk:path` tag via `ListTagsForStream(StreamName)`.
+	*     The walk runs through the shared `importTagWalk` helper, so the N+1
+	*     tag-read burst is retried with exponential backoff when AWS
+	*     throttles it instead of aborting the whole import.
 	*
 	* Kinesis tags use the standard `Tag[]` array shape (`Key`/`Value`),
-	* so `matchesCdkPath` from import-helpers applies directly.
+	* so the walk's `matchesCdkPath` matcher applies directly.
 	*/
 	/**
 	* Read the AWS-current Kinesis stream configuration in CFn-property shape.
@@ -33363,19 +33325,25 @@ var KinesisStreamProvider = class {
 			if (err instanceof ResourceNotFoundException$8) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let exclusiveStartStreamName;
-		while (true) {
-			const list = await this.getClient().send(new ListStreamsCommand({ ...exclusiveStartStreamName && { ExclusiveStartStreamName: exclusiveStartStreamName } }));
-			const names = list.StreamNames ?? [];
-			for (const streamName of names) if (matchesCdkPath((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: streamName }))).Tags, input.cdkPath)) return {
-				physicalId: streamName,
-				attributes: {}
-			};
-			if (!list.HasMoreStreams || names.length === 0) break;
-			exclusiveStartStreamName = names[names.length - 1];
-		}
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListStreamsCommand({ ...marker && { ExclusiveStartStreamName: marker } }));
+				const names = list.StreamNames ?? [];
+				return {
+					items: names,
+					nextMarker: list.HasMoreStreams && names.length > 0 ? names[names.length - 1] : void 0
+				};
+			},
+			describe: async (streamName) => await this.getClient().send(new ListTagsForStreamCommand({ StreamName: streamName })),
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 	/**
 	* Poll DescribeStream until the stream reaches ACTIVE status
@@ -41437,25 +41405,32 @@ var ECRProvider = class {
 			if (err instanceof RepositoryNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new DescribeRepositoriesCommand({ ...nextToken && { nextToken } }));
-			for (const repo of list.repositories ?? []) {
-				if (!repo.repositoryArn || !repo.repositoryName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new DescribeRepositoriesCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.repositories,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (repo) => {
+				if (!repo.repositoryArn || !repo.repositoryName) return void 0;
 				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: repo.repositoryArn }))).tags, input.cdkPath)) return {
-						physicalId: repo.repositoryName,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: repo.repositoryArn }));
 				} catch (err) {
-					if (err instanceof RepositoryNotFoundException) continue;
+					if (err instanceof RepositoryNotFoundException) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.repositoryName,
+			attributes: {}
+		};
 	}
 };
 
@@ -43204,6 +43179,7 @@ async function deployCommand(stacks, options) {
 					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
 					...options.replace && { replace: true },
 					...options.forceStatefulRecreation && { forceStatefulRecreation: true },
+					...options.strictGetatt && { strictGetAtt: true },
 					captureObservedState: resolveCaptureObservedState(options.captureObservedState),
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 					...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
@@ -43234,6 +43210,7 @@ async function deployCommand(stacks, options) {
 				logger.info(`  Deleted: ${deployResult.deleted > 0 ? red(deployResult.deleted) : gray(deployResult.deleted)}`);
 				logger.info(`  Unchanged: ${gray(deployResult.unchanged)}`);
 				logger.info(`  Duration: ${cyan((deployResult.durationMs / 1e3).toFixed(2) + "s")}`);
+				if (deployResult.attributeFallbackCount > 0) logger.warn(`${deployResult.attributeFallbackCount} attribute resolution(s) fell back to the physical ID (potentially wrong values); re-run with --strict-getatt to fail on these`);
 				if (deployResult.outputs && Object.keys(deployResult.outputs).length > 0) {
 					logger.info("\nOutputs:");
 					for (const [key, value] of Object.entries(deployResult.outputs)) logger.info(`  ${deployResult.stackName}.${key} = ${String(value)}`);
@@ -62104,7 +62081,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.254.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.256.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());