@go-to-k/cdkd 0.255.0 → 0.257.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as BOOTSTRAP_MARKER_PREFIX, A as refStateLookupFromResource, At as AssemblyReader, B as TemplateParser, C as ProviderRegistry, Ct as warnDeprecatedNoPrefixCliFlag, D as isTerminationProtectionPropagationError, Dt as findLargeInlineResources, E as disableInstanceApiTermination, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as IntrinsicFunctionResolver, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as isRetryableTransientError, St as resolveUseCdkBootstrapAssets, T as CloudControlProvider, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as yellow, _t as resolveAutoAssetStorage, a as IMPLICIT_DELETE_DEPENDENCIES, at as buildDockerImage, b as importTagWalk, bt as resolveStateBucketWithDefault, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as runDockerForeground, d as formatResourceLine, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as bold, ft as Synthesizer, g as red, gt as resolveApp, h as green, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as WAFv2WebACLProvider, k as cfnRefValueFromPhysicalId, kt as expectedOwnerParam, l as isStatefulRecreateTargetSync, lt as runDockerStreaming, m as gray, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as computeImplicitDeleteEdges, ot as formatDockerLoginError, p as cyan, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as extractDeploymentEventError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as renderStatefulReason, ut as AssetManifestLoader, v as IAMRoleProvider, vt as resolveCaptureObservedState, w as findActionableSilentDrops, wt as CFN_TEMPLATE_BODY_LIMIT, x as withRetry, xt as resolveStateBucketWithDefaultAndSource, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-CFUNbwD1.js";
+import { $ as BOOTSTRAP_MARKER_PREFIX, A as withRetry, At as AssemblyReader, B as TemplateParser, C as disableInstanceApiTermination, Ct as warnDeprecatedNoPrefixCliFlag, D as refStateLookupFromResource, Dt as findLargeInlineResources, E as cfnRefValueFromPhysicalId, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as WAFv2WebACLProvider, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as CloudControlProvider, St as resolveUseCdkBootstrapAssets, T as IntrinsicFunctionResolver, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as yellow, _t as resolveAutoAssetStorage, a as IMPLICIT_DELETE_DEPENDENCIES, at as buildDockerImage, b as ProviderRegistry, bt as resolveStateBucketWithDefault, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as runDockerForeground, d as formatResourceLine, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as bold, ft as Synthesizer, g as red, gt as resolveApp, h as green, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as isRetryableTransientError, k as importTagWalk, kt as expectedOwnerParam, l as isStatefulRecreateTargetSync, lt as runDockerStreaming, m as gray, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as computeImplicitDeleteEdges, ot as formatDockerLoginError, p as cyan, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as extractDeploymentEventError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as renderStatefulReason, ut as AssetManifestLoader, v as IAMRoleProvider, vt as resolveCaptureObservedState, w as isTerminationProtectionPropagationError, wt as CFN_TEMPLATE_BODY_LIMIT, x as findActionableSilentDrops, xt as resolveStateBucketWithDefaultAndSource, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-DOPBIRKR.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BPtdM67j.js";
+import { t as ASGProvider } from "./asg-provider-6IZKZOKp.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -505,6 +505,16 @@ const replaceOption = new Option("--replace", "Replace (DELETE + CREATE) a resou
 * (see `resolveUseCdkBootstrapAssets` in config-loader.ts).
 */
 const useCdkBootstrapAssetsOption = new Option("--use-cdk-bootstrap-assets", "Publish assets to the CDK bootstrap bucket/repo named by the asset manifest verbatim, skipping the cdkd asset-storage redirection even when this region is opted in via 'cdkd bootstrap'. For apps deployed via both CloudFormation and cdkd during a migration window. Per-app pin: cdk.json context.cdkd.useCdkBootstrapAssets. Also suppresses the legacy-mode 'cdk gc' notice.").default(false);
+/**
+* Issue #1111 — `--strict-getatt` (deploy only). By default, an
+* `Fn::GetAtt` for an attribute cdkd cannot construct falls back to the
+* resource's physical ID with a warning (hard-failing only on knowably-wrong
+* shapes: `*Arn` attributes with a non-ARN fallback, `*Url` with a
+* non-http(s) fallback — issue #1106). This flag promotes EVERY such
+* fallback to a hard error, and additionally fails the deploy when a stack
+* Output cannot be resolved (default: warn and store no value).
+*/
+const strictGetattOption = new Option("--strict-getatt", "Fail the deploy on ANY Fn::GetAtt that falls back to the physical ID because cdkd cannot construct the attribute (default: warn and use the physical ID, hard-failing only when the fallback is knowably wrong — an *Arn attribute with a non-ARN value or a *Url attribute with a non-http(s) value). Also fails the deploy when a stack Output cannot be resolved (default: warn and store no value).").default(false);
 const deployOptions = [
 	new Option("--concurrency <number>", "Maximum concurrent resource operations").default(10).argParser((value) => parseInt(value, 10)),
 	new Option("--stack-concurrency <number>", "Maximum concurrent stack deployments").default(4).argParser((value) => parseInt(value, 10)),
@@ -526,6 +536,7 @@ const deployOptions = [
 	forceStatefulRecreationOption,
 	replaceOption,
 	useCdkBootstrapAssetsOption,
+	strictGetattOption,
 	...resourceTimeoutOptions
 ];
 /**
@@ -1888,7 +1899,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.255.0";
+	return "0.257.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -12687,24 +12698,33 @@ var DynamoDBGlobalTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let exclusiveStartTableName;
-		do {
-			const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...exclusiveStartTableName && { ExclusiveStartTableName: exclusiveStartTableName } }));
-			for (const name of list.TableNames ?? []) try {
-				const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-				if (!arn) continue;
-				if (matchesCdkPath((await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }))).Tags, input.cdkPath)) return {
-					physicalId: name,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
+				return {
+					items: list.TableNames,
+					nextMarker: list.LastEvaluatedTableName
 				};
-			} catch (err) {
-				if (err instanceof ResourceNotFoundException$1) continue;
-				throw err;
-			}
-			exclusiveStartTableName = list.LastEvaluatedTableName;
-		} while (exclusiveStartTableName);
-		return null;
+			},
+			describe: async (name) => {
+				try {
+					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
+					if (!arn) return void 0;
+					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return void 0;
+					throw err;
+				}
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 	async waitForTableActive(tableName, logicalId, maxAttempts = 120) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -14568,23 +14588,30 @@ var EventBridgeRuleProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.eventBridgeClient.send(new ListRulesCommand({
-				...eventBusName && { EventBusName: eventBusName },
-				...nextToken && { NextToken: nextToken }
-			}));
-			for (const rule of list.Rules ?? []) {
-				if (!rule.Arn) continue;
-				if (matchesCdkPath((await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: rule.Arn }))).Tags, input.cdkPath)) return {
-					physicalId: rule.Arn,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.eventBridgeClient.send(new ListRulesCommand({
+					...eventBusName && { EventBusName: eventBusName },
+					...marker && { NextToken: marker }
+				}));
+				return {
+					items: list.Rules,
+					nextMarker: list.NextToken
 				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			describe: async (rule) => {
+				if (!rule.Arn) return void 0;
+				return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: rule.Arn }));
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Arn,
+			attributes: {}
+		};
 	}
 	/**
 	* Extract rule name from an ARN
@@ -14869,25 +14896,32 @@ var EventBridgeBusProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.eventBridgeClient.send(new ListEventBusesCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const bus of list.EventBuses ?? []) {
-				if (!bus.Name || !bus.Arn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.eventBridgeClient.send(new ListEventBusesCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.EventBuses,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (bus) => {
+				if (!bus.Name || !bus.Arn) return void 0;
 				try {
-					if (matchesCdkPath((await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: bus.Arn }))).Tags, input.cdkPath)) return {
-						physicalId: bus.Name,
-						attributes: {}
-					};
+					return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: bus.Arn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$2) continue;
+					if (err instanceof ResourceNotFoundException$2) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 };
 
@@ -20438,25 +20472,32 @@ var CloudFrontDistributionProvider = class {
 			if (err instanceof NoSuchDistribution) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.cloudFrontClient.send(new ListDistributionsCommand({ ...marker && { Marker: marker } }));
-			for (const d of list.DistributionList?.Items ?? []) {
-				if (!d.Id || !d.ARN) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.cloudFrontClient.send(new ListDistributionsCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.DistributionList?.Items,
+					nextMarker: list.DistributionList?.IsTruncated ? list.DistributionList?.NextMarker : void 0
+				};
+			},
+			describe: async (d) => {
+				if (!d.Id || !d.ARN) return void 0;
 				try {
-					if (matchesCdkPath((await this.cloudFrontClient.send(new ListTagsForResourceCommand$3({ Resource: d.ARN }))).Tags?.Items, input.cdkPath)) return {
-						physicalId: d.Id,
-						attributes: {}
-					};
+					return await this.cloudFrontClient.send(new ListTagsForResourceCommand$3({ Resource: d.ARN }));
 				} catch (err) {
-					if (err instanceof NoSuchDistribution) continue;
+					if (err instanceof NoSuchDistribution) return void 0;
 					throw err;
 				}
-			}
-			marker = list.DistributionList?.IsTruncated ? list.DistributionList?.NextMarker : void 0;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags?.Items
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Id,
+			attributes: {}
+		};
 	}
 };
 
@@ -21457,10 +21498,10 @@ var StepFunctionsProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource <id>=<arn>` override → verify with `DescribeStateMachine`.
-	*  2. Walk `ListStateMachines` paginator → `ListTagsForResource(arn)`,
-	*     match the lowercase `key`/`value` `aws:cdk:path` tag (SFN uses
-	*     lowercase tags, so `matchesCdkPath` from import-helpers does not
-	*     apply directly).
+	*  2. Walk `ListStateMachines` → `ListTagsForResource(arn)` via the shared
+	*     `importTagWalk` helper. SFN returns lowercase `key`/`value` tags, so
+	*     `tagsOf` maps them to the `Key`/`Value` shape the walk's
+	*     `aws:cdk:path` matcher expects.
 	*
 	* SFN state machines do not expose a template-supplied name field
 	* usable as a stable physicalId — the physicalId is the ARN — so the
@@ -21478,21 +21519,30 @@ var StepFunctionsProvider = class {
 			if (err instanceof StateMachineDoesNotExist) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListStateMachinesCommand({ ...nextToken && { nextToken } }));
-			for (const sm of list.stateMachines ?? []) {
-				if (!sm.stateMachineArn) continue;
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: sm.stateMachineArn }));
-				if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
-					physicalId: sm.stateMachineArn,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListStateMachinesCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.stateMachines,
+					nextMarker: list.nextToken
 				};
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
-		return null;
+			},
+			describe: async (sm) => {
+				if (!sm.stateMachineArn) return void 0;
+				return await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: sm.stateMachineArn }));
+			},
+			tagsOf: (tagsResp) => (tagsResp.tags ?? []).map((t) => ({
+				Key: t.key,
+				Value: t.value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.stateMachineArn,
+			attributes: {}
+		};
 	}
 	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via SFN's
@@ -21530,14 +21580,6 @@ var StepFunctionsProvider = class {
 		}
 	}
 	/**
-	* Match SFN's lowercase `key`/`value` tag shape against the CDK path.
-	*/
-	tagsMatchCdkPath(tags, cdkPath) {
-		if (!tags) return false;
-		for (const t of tags) if (t.key === "aws:cdk:path" && t.value === cdkPath) return true;
-		return false;
-	}
-	/**
 	* Build the state-machine definition string from CDK properties.
 	*
 	* Precedence (mirrors CloudFormation): an inline `DefinitionString` /
@@ -27948,6 +27990,16 @@ var CognitoUserPoolProvider = class {
 	*  3. `aws:cdk:path` tag match via `ListUserPools` +
 	*     `ListTagsForResource(<arn>)`. Cognito's tag map uses the same
 	*     `Tags: { [key]: value }` shape as Lambda.
+	*
+	* Steps 2 and 3 share ONE `ListUserPools` walk (per candidate: name check
+	* first, then the two tag reads, only when a `cdkPath` is present), which
+	* runs through the shared `importTagWalk` helper so the N+1 read burst
+	* (DescribeUserPool for the ARN, then ListTagsForResource) is retried with
+	* exponential backoff when AWS throttles it instead of aborting the whole
+	* import. The name match is expressed to the walk as a synthetic
+	* `aws:cdk:path` tag carrying the walk's own lookup key, so a name-only
+	* template (no CDK path metadata) still resolves without any per-candidate
+	* API call, matching the previous inline loop.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -27961,33 +28013,48 @@ var CognitoUserPoolProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListUserPoolsCommand({
-				MaxResults: 60,
-				...nextToken && { NextToken: nextToken }
-			}));
-			for (const pool of list.UserPools ?? []) {
-				if (!pool.Id) continue;
-				if (desiredName && pool.Name === desiredName) return {
-					physicalId: pool.Id,
-					attributes: {}
+		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:cognito-user-pool-name:${desiredName}` : void 0);
+		/** Sentinel detail for a candidate matched by its user pool name. */
+		const NAME_MATCH = { nameMatch: true };
+		const match = await importTagWalk({
+			cdkPath: walkCdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListUserPoolsCommand({
+					MaxResults: 60,
+					...marker && { NextToken: marker }
+				}));
+				return {
+					items: list.UserPools,
+					nextMarker: list.NextToken
 				};
-				if (input.cdkPath) try {
+			},
+			describe: async (pool) => {
+				if (!pool.Id) return void 0;
+				if (desiredName && pool.Name === desiredName) return NAME_MATCH;
+				if (!input.cdkPath) return void 0;
+				try {
 					const arn = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }))).UserPool?.Arn;
-					if (!arn) continue;
-					if ((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceArn: arn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: pool.Id,
-						attributes: {}
-					};
+					if (!arn) return void 0;
+					return await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceArn: arn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$7) continue;
+					if (err instanceof ResourceNotFoundException$7) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (detail) => "nameMatch" in detail ? [{
+				Key: CDK_PATH_TAG,
+				Value: walkCdkPath
+			}] : Object.entries(detail.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Id,
+			attributes: {}
+		};
 	}
 };
 
@@ -32973,23 +33040,31 @@ var BudgetsBudgetProvider = class {
 			if (error instanceof NotFoundException$5) return null;
 			throw error;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await client.send(new DescribeBudgetsCommand({
-				AccountId: accountId,
-				...nextToken && { NextToken: nextToken }
-			}));
-			for (const budget of list.Budgets ?? []) {
-				if (!budget.BudgetName) continue;
-				if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$17({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }))).ResourceTags, input.cdkPath)) return {
-					physicalId: budget.BudgetName,
-					attributes: { Arn: this.budgetArn(accountId, budget.BudgetName) }
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await client.send(new DescribeBudgetsCommand({
+					AccountId: accountId,
+					...marker && { NextToken: marker }
+				}));
+				return {
+					items: list.Budgets,
+					nextMarker: list.NextToken
 				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			describe: async (budget) => {
+				if (!budget.BudgetName) return void 0;
+				return await client.send(new ListTagsForResourceCommand$17({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }));
+			},
+			tagsOf: (tags) => tags.ResourceTags
+		});
+		if (!match) return null;
+		const budgetName = match.summary.BudgetName;
+		return {
+			physicalId: budgetName,
+			attributes: { Arn: this.budgetArn(accountId, budgetName) }
+		};
 	}
 };
 
@@ -38189,19 +38264,25 @@ var FirehoseProvider = class {
 			if (err instanceof ResourceNotFoundException$10) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let exclusiveStartDeliveryStreamName;
-		while (true) {
-			const list = await this.getClient().send(new ListDeliveryStreamsCommand({ ...exclusiveStartDeliveryStreamName && { ExclusiveStartDeliveryStreamName: exclusiveStartDeliveryStreamName } }));
-			const names = list.DeliveryStreamNames ?? [];
-			for (const name of names) if (matchesCdkPath((await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: name }))).Tags, input.cdkPath)) return {
-				physicalId: name,
-				attributes: {}
-			};
-			if (!list.HasMoreDeliveryStreams || names.length === 0) break;
-			exclusiveStartDeliveryStreamName = names[names.length - 1];
-		}
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListDeliveryStreamsCommand({ ...marker && { ExclusiveStartDeliveryStreamName: marker } }));
+				const names = list.DeliveryStreamNames ?? [];
+				return {
+					items: names,
+					nextMarker: list.HasMoreDeliveryStreams && names.length > 0 ? names[names.length - 1] : void 0
+				};
+			},
+			describe: async (name) => await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: name })),
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 	/**
 	* Wait for a delivery stream to become ACTIVE.
@@ -38707,26 +38788,32 @@ var CloudTrailProvider = class {
 			if (err instanceof TrailNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListTrailsCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const trail of list.Trails ?? []) {
-				if (!trail.TrailARN || !trail.Name) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListTrailsCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.Trails,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (trail) => {
+				if (!trail.TrailARN || !trail.Name) return void 0;
 				try {
-					const list2 = (await this.getClient().send(new ListTagsCommand$1({ ResourceIdList: [trail.TrailARN] }))).ResourceTagList?.[0];
-					if (matchesCdkPath(list2?.TagsList, input.cdkPath)) return {
-						physicalId: trail.Name,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListTagsCommand$1({ ResourceIdList: [trail.TrailARN] }));
 				} catch (err) {
-					if (err instanceof TrailNotFoundException) continue;
+					if (err instanceof TrailNotFoundException) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.ResourceTagList?.[0]?.TagsList
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 };
 
@@ -40447,26 +40534,33 @@ var S3DirectoryBucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let token;
-		do {
-			const list = await this.s3Client.send(new ListDirectoryBucketsCommand({ ...token && { ContinuationToken: token } }));
-			for (const b of list.Buckets ?? []) {
-				if (!b.Name) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (token) => {
+				const list = await this.s3Client.send(new ListDirectoryBucketsCommand({ ...token && { ContinuationToken: token } }));
+				return {
+					items: list.Buckets,
+					nextMarker: list.ContinuationToken
+				};
+			},
+			describe: async (b) => {
+				if (!b.Name) return void 0;
 				try {
-					if (matchesCdkPath((await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }))).TagSet, input.cdkPath)) return {
-						physicalId: b.Name,
-						attributes: {}
-					};
+					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
 				} catch (err) {
 					const e = err;
-					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied") continue;
+					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied") return void 0;
 					throw err;
 				}
-			}
-			token = list.ContinuationToken;
-		} while (token);
-		return null;
+			},
+			tagsOf: (tagging) => tagging.TagSet
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 };
 
@@ -42499,28 +42593,36 @@ var ACMCertificateProvider = class {
 				throw err;
 			}
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.acmClient.send(new ListCertificatesCommand({ ...nextToken ? { NextToken: nextToken } : {} }));
-			for (const summary of list.CertificateSummaryList ?? []) {
-				if (!summary.CertificateArn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.acmClient.send(new ListCertificatesCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.CertificateSummaryList,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (summary) => {
+				if (!summary.CertificateArn) return void 0;
 				try {
-					if (matchesCdkPath((await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: summary.CertificateArn }))).Tags, input.cdkPath)) return {
-						physicalId: summary.CertificateArn,
-						attributes: {
-							Arn: summary.CertificateArn,
-							CertificateArn: summary.CertificateArn
-						}
-					};
+					return await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: summary.CertificateArn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$6) continue;
+					if (err instanceof ResourceNotFoundException$6) return void 0;
 					throw err;
 				}
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		const arn = match.summary.CertificateArn;
+		return {
+			physicalId: arn,
+			attributes: {
+				Arn: arn,
+				CertificateArn: arn
 			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+		};
 	}
 	/**
 	* Poll `DescribeCertificate` until status === `ISSUED`. On the FIRST poll
@@ -43168,6 +43270,7 @@ async function deployCommand(stacks, options) {
 					...recreateViaSdkProviderTargets && recreateViaSdkProviderTargets.size > 0 && { recreateViaSdkProviderTargets },
 					...options.replace && { replace: true },
 					...options.forceStatefulRecreation && { forceStatefulRecreation: true },
+					...options.strictGetatt && { strictGetAtt: true },
 					captureObservedState: resolveCaptureObservedState(options.captureObservedState),
 					...options.resourceWarnAfter?.globalMs !== void 0 && { resourceWarnAfterMs: options.resourceWarnAfter.globalMs },
 					...options.resourceTimeout?.globalMs !== void 0 && { resourceTimeoutMs: options.resourceTimeout.globalMs },
@@ -43198,6 +43301,7 @@ async function deployCommand(stacks, options) {
 				logger.info(`  Deleted: ${deployResult.deleted > 0 ? red(deployResult.deleted) : gray(deployResult.deleted)}`);
 				logger.info(`  Unchanged: ${gray(deployResult.unchanged)}`);
 				logger.info(`  Duration: ${cyan((deployResult.durationMs / 1e3).toFixed(2) + "s")}`);
+				if (deployResult.attributeFallbackCount > 0) logger.warn(`${deployResult.attributeFallbackCount} attribute resolution(s) fell back to the physical ID (potentially wrong values); re-run with --strict-getatt to fail on these`);
 				if (deployResult.outputs && Object.keys(deployResult.outputs).length > 0) {
 					logger.info("\nOutputs:");
 					for (const [key, value] of Object.entries(deployResult.outputs)) logger.info(`  ${deployResult.stackName}.${key} = ${String(value)}`);
@@ -62068,7 +62172,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.255.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());