@go-to-k/cdkd 0.255.0 → 0.257.0

package/dist/{deploy-engine-CFUNbwD1.js → deploy-engine-DOPBIRKR.js}

@@ -8216,128 +8216,452 @@ function normalizeAwsTagsToCfn(tags) {
 }
 
 //#endregion
-//#region src/provisioning/providers/wafv2-provider.ts
+//#region src/deployment/retryable-errors.ts
 /**
-* Translate the empty-string placeholder `readCurrentState` emits for an
-* absent `Description` to `undefined` before shipping it to AWS.
+* Patterns that mark an AWS error as a transient/retryable failure.
+* Each entry is a substring match against the error message; all of these
+* are situations where the same call typically succeeds after a short delay
+* because of eventual consistency or just-created-dependency propagation.
+*/
+const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
+	"cannot be assumed",
+	"Firehose is unable to assume role",
+	"is unable to assume provided role",
+	"role defined for the function",
+	"not authorized to perform",
+	"execution role",
+	"trust policy",
+	"Role validation failed",
+	"does not have required permissions",
+	"Trusted Entity",
+	"currently in the following state: Pending",
+	"has dependencies and cannot be deleted",
+	"can't be deleted since it has",
+	"DependencyViolation",
+	"does not exist",
+	"Schema is currently being altered",
+	"Invalid principal in policy",
+	"Policy Error: PrincipalNotFound",
+	"Invalid value for the parameter Policy",
+	"required permissions for: ENHANCED_MONITORING",
+	"Caught ServiceAccessDeniedException",
+	"permissions required to assume the role",
+	"authorized to assume the provided role",
+	"conflicting conditional operation",
+	"scheduled for deletion",
+	"Cannot access stream",
+	"Please ensure the role can perform",
+	"KMS key is invalid for CreateGrant",
+	"Policy contains a statement with one or more invalid principals",
+	"Invalid IAM Instance Profile",
+	"Invalid InstanceProfile",
+	"Failed to authorize instance profile",
+	"Could not deliver test message",
+	"wait 60 seconds",
+	"concurrent update operation",
+	"because it is in use",
+	"Rate exceeded"
+];
+/**
+* HTTP status codes that always indicate a transient failure worth retrying.
+* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
+*/
+const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
+/**
+* AWS SDK v3 canonical throttling error names. Mirrors
+* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
+* error (or wrapped cause) whose `name` is one of these is a transient rate-
+* limit rejection worth retrying with backoff. Detecting by NAME is more
+* robust than by HTTP status because most AWS throttles surface as HTTP 400
+* (not 429) with the throttling signal carried only in the error code / name
+* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
+*/
+const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"BandwidthLimitExceeded",
+	"EC2ThrottledException",
+	"LimitExceededException",
+	"PriorRequestNotComplete",
+	"ProvisionedThroughputExceededException",
+	"RequestLimitExceeded",
+	"RequestThrottled",
+	"RequestThrottledException",
+	"SlowDown",
+	"ThrottledException",
+	"Throttling",
+	"ThrottlingException",
+	"TooManyRequestsException",
+	"TransactionInProgressException"
+]);
+/**
+* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
+* signal — either an AWS SDK v3 throttling error `name`
+* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
+* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
 *
-* `readCurrentState` always-emits `Description: ''` on a WebACL with no
-* description (the comparator's top-level walk is state-keys-only, so
-* the placeholder is required to detect a console-side description add).
-* AWS WAFv2 `CreateWebACL` / `UpdateWebACL` reject `Description: ''`
-* with `Member must have length greater than or equal to 1` (min 1 / max
-* 256). On `cdkd drift --revert` the placeholder would round-trip
-* through `update()` and surface as a hard AWS rejection, so we sanitize
-* the wire-layer payload while keeping the read-side placeholder
-* intact. This is the Class 2 pattern from
-* `docs/provider-development.md § 3b`.
+* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
+* typically one cause-link deep; the bounded walk also tolerates SDK errors
+* that nest a `$response`/cause without exploding on a cyclic chain.
+*
+* BOTH signals are checked at EVERY depth. An earlier version checked the name
+* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
+* links deep was missed. This is the single shared cause-walk: the read-only
+* import tag walk (`src/provisioning/import-tag-walk.ts`) composes its own
+* classifier on top of this function rather than re-implementing the traversal,
+* so the two cannot drift apart again.
 */
-function sanitizeDescription(value) {
-	if (value === void 0 || value === null) return void 0;
-	if (typeof value === "string" && value.length === 0) return void 0;
-	return value;
+function isThrottlingError(error) {
+	let current = error;
+	for (let depth = 0; depth < 5 && current != null; depth++) {
+		const name = current.name;
+		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
+		const status = current.$metadata?.httpStatusCode;
+		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
+		current = current.cause;
+	}
+	return false;
 }
 /**
-* Parse WAFv2 WebACL ARN to extract Id, Name, and Scope.
-*
-* ARN format:
-*   arn:aws:wafv2:{region}:{account}:regional/webacl/{name}/{id}
-*   arn:aws:wafv2:{region}:{account}:global/webacl/{name}/{id}
+* Determine whether an AWS error should be retried.
 *
-* A short / malformed ARN yields `undefined` for `name` / `id` (the path
-* segments simply are not there) — callers must guard. `scope` is always
-* defined (anything not `global` maps to `REGIONAL`).
+* Checks (in order):
+*   1. Rate-limit signal on the error or any wrapped cause — throttling error
+*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
+*      429, so the name check carries most of the weight). See
+*      {@link isThrottlingError}.
+*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
 */
-function parseWebACLArn(arn) {
-	const segments = arn.split(":").slice(5).join(":").split("/");
-	const scopeRaw = segments[0];
-	const name = segments[2];
-	return {
-		id: segments[3],
-		name,
-		scope: scopeRaw === "global" ? "CLOUDFRONT" : "REGIONAL"
-	};
+function isRetryableTransientError(error, message) {
+	if (isThrottlingError(error)) return true;
+	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
 }
+
+//#endregion
+//#region src/deployment/retry.ts
 /**
-* AWS WAFv2 WebACL Provider
+* Retry helper for resource provisioning operations that hit transient
+* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
+* dependency violations, etc.).
 *
-* Implements resource provisioning for AWS::WAFv2::WebACL using the WAFv2 SDK.
-* WHY: WAFv2 CreateWebACL is synchronous - the CC API adds unnecessary polling
-* overhead for an operation that completes immediately.
-* This SDK provider eliminates that polling and returns instantly.
+* Extracted from DeployEngine so the backoff schedule can be unit-tested
+* in isolation. The retryable-error classifier itself lives in
+* `./retryable-errors.ts`.
 */
-var WAFv2WebACLProvider = class {
-	wafv2Client;
-	providerRegion = process.env["AWS_REGION"];
-	logger = getLogger().child("WAFv2WebACLProvider");
-	handledProperties = /* @__PURE__ */ new Map([["AWS::WAFv2::WebACL", /* @__PURE__ */ new Set([
-		"Name",
-		"Scope",
-		"Tags",
-		"DefaultAction",
-		"Description",
-		"Rules",
-		"VisibilityConfig",
-		"CustomResponseBodies",
-		"CaptchaConfig",
-		"ChallengeConfig",
-		"TokenDomains",
-		"AssociationConfig"
-	])]]);
-	getClient() {
-		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client(this.providerRegion ? { region: this.providerRegion } : {});
-		return this.wafv2Client;
-	}
-	/**
-	* Create a WAFv2 WebACL
-	*/
-	async create(logicalId, resourceType, properties) {
-		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
-		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
-		const scope = properties["Scope"] || "REGIONAL";
-		try {
-			const tags = [];
-			if (properties["Tags"]) {
-				const tagList = properties["Tags"];
-				for (const tag of tagList) tags.push({
-					Key: tag.Key,
-					Value: tag.Value
-				});
-			}
-			const summary = (await this.getClient().send(new CreateWebACLCommand({
-				Name: name,
-				Scope: scope,
-				DefaultAction: properties["DefaultAction"],
-				Description: sanitizeDescription(properties["Description"]),
-				Rules: properties["Rules"] || [],
-				VisibilityConfig: properties["VisibilityConfig"],
-				...tags.length > 0 && { Tags: tags },
-				CustomResponseBodies: properties["CustomResponseBodies"],
-				CaptchaConfig: properties["CaptchaConfig"],
-				ChallengeConfig: properties["ChallengeConfig"],
-				TokenDomains: properties["TokenDomains"],
-				AssociationConfig: properties["AssociationConfig"]
-			}))).Summary;
-			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
-			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
-			return {
-				physicalId: summary.ARN,
-				attributes: {
-					Arn: summary.ARN,
-					Id: summary.Id,
-					LabelNamespace: summary["LabelNamespace"]
-				}
-			};
-		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+* Run `operation`, retrying transient failures with exponential backoff
+* capped at `maxDelayMs`.
+*
+* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
+*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
+*
+* Non-retryable errors are rethrown immediately. The transient-error
+* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
+*/
+async function withRetry(operation, logicalId, opts = {}) {
+	const maxRetries = opts.maxRetries ?? 8;
+	const initialDelayMs = opts.initialDelayMs ?? 1e3;
+	const maxDelayMs = opts.maxDelayMs ?? 8e3;
+	const sleep = opts.sleep ?? defaultSleep;
+	let lastError;
+	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
+		return await operation();
+	} catch (error) {
+		lastError = error;
+		const message = error instanceof Error ? error.message : String(error);
+		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
+		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
+		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
+		for (let waited = 0; waited < delay; waited += 1e3) {
+			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
+			await sleep(Math.min(1e3, delay - waited));
 		}
 	}
-	/**
-	* Update a WAFv2 WebACL
-	*
-	* Name and Scope are immutable - changes to those require replacement.
+	throw lastError;
+}
+
+//#endregion
+//#region src/provisioning/import-tag-walk.ts
+/**
+* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
+*
+* Providers that adopt a resource without an explicit name property fall back
+* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
+* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
+* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
+* summaries usually do not carry tags. That is an inherent **N+1** read
+* pattern: an account with many resources of the type produces one API call
+* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
+*
+* Every provider previously hand-rolled this loop with NO backoff, so a single
+* throttled `Describe*` aborted the whole `cdkd import` run. This helper
+* centralises the loop and wraps BOTH the list page fetch and the per-candidate
+* describe in the deploy engine's `withRetry` with exponential backoff.
+*
+* ## Why a narrower classifier than `isRetryableTransientError`
+*
+* The deploy engine's classifier is tuned for the WRITE path: it also treats
+* eventual-consistency phrasings like `does not exist` / `not authorized to
+* perform` as transient, because a just-created dependency legitimately needs a
+* moment to propagate. On a read-only import walk those messages mean the
+* opposite — the candidate really is gone, or the caller's credentials really
+* lack the permission — and retrying them burns the full backoff budget per
+* candidate before surfacing the true error.
+*
+* So the walk retries throttling ONLY, reusing the deploy engine's throttle
+* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
+* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
+*
+* ## Batching
+*
+* Batched tag reads are deliberately NOT modelled here: the services this
+* helper currently serves (EMR `DescribeCluster`, DocDB
+* `ListTagsForResource`) expose only single-resource reads. A service that
+* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
+* satisfy several candidates from one call inside its own `describe` callback,
+* or bypass the helper entirely.
+*/
+/** Max number of retries after the first attempt, per API call in the walk. */
+const DEFAULT_MAX_RETRIES = 5;
+/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
+const DEFAULT_INITIAL_DELAY_MS = 500;
+/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
+const DEFAULT_MAX_DELAY_MS = 5e3;
+/**
+* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
+* one call. Backoff is per-call, so without this a sustained throttle against a
+* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
+* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
+* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
+* DocDB account completes in seconds when AWS is not throttling) and bounds the
+* pathological case to something a user will wait through.
+*/
+const DEFAULT_MAX_WALK_MS = 10 * 6e4;
+/**
+* Ceiling on pages fetched. A service that returns a non-advancing pagination
+* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
+* forever. This is now the shared path every migrated provider runs on, so the
+* guard belongs here rather than in each caller.
+*/
+const DEFAULT_MAX_PAGES = 1e3;
+/**
+* Whether an error hit during the read-only tag walk is a rate-limit rejection
+* worth backing off on.
+*
+* Delegates the error + `.cause` chain traversal to the deploy engine's
+* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
+* at every cause depth) and adds the canonical `Rate exceeded` message, which
+* several services return with an HTTP 400 and a service-specific error name.
+*
+* This is deliberately NARROWER than `isRetryableTransientError`: that
+* classifier also treats write-path eventual-consistency phrasings (`does not
+* exist`, `not authorized to perform`) as transient, because a just-created
+* dependency legitimately needs a moment to propagate. On a read-only walk
+* those mean the candidate really is gone or the credentials really lack the
+* permission, and retrying them burns the full backoff budget per candidate
+* before surfacing the true error.
+*
+* Exported for direct unit testing and for providers whose tag walk cannot use
+* {@link importTagWalk} verbatim.
+*/
+function isThrottlingLikeError(error, message) {
+	return isThrottlingError(error) || message.includes("Rate exceeded");
+}
+/**
+* Module-level test hooks for the walk's backoff.
+*
+* Providers do not expose a retry option on `import()`, so their wiring tests
+* cannot inject `retry.sleep` per call — without this hook every throttle-path
+* wiring test pays a real 0.5s+ backoff wait. Tests set `sleep` to a resolved
+* no-op in `beforeEach` (and clear it in `afterEach`); a per-call
+* `retry.sleep` still wins when supplied. Never set this in production code.
+*/
+const importTagWalkTestHooks = {};
+/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
+var ImportTagWalkLimitError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ImportTagWalkLimitError";
+	}
+};
+/**
+* Paginate `listPage`, `describe` each candidate, and return the first one
+* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
+* candidate matches (or when `cdkPath` is empty).
+*
+* Both callbacks are individually retried with exponential backoff on
+* throttling errors, so one rate-limited call mid-walk no longer aborts the
+* whole import.
+*/
+async function importTagWalk(options) {
+	const { cdkPath, listPage, describe, tagsOf } = options;
+	if (!cdkPath) return null;
+	const logicalId = options.logicalId ?? "import";
+	const logger = options.retry?.logger ?? getLogger();
+	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
+	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
+	const sleep = options.retry?.sleep ?? importTagWalkTestHooks.sleep;
+	const retryOpts = {
+		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
+		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
+		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
+		isRetryable: (message, error) => isThrottlingLikeError(error, message),
+		logger,
+		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
+		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
+		...sleep && { sleep }
+	};
+	const startedAt = Date.now();
+	const assertWithinBudget = (stage) => {
+		const elapsed = Date.now() - startedAt;
+		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+	};
+	let marker;
+	let pages = 0;
+	do {
+		assertWithinBudget("listing candidates");
+		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
+		const currentMarker = marker;
+		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
+		for (const summary of page.items ?? []) {
+			assertWithinBudget("reading candidate tags");
+			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
+			if (detail === void 0) {
+				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
+				continue;
+			}
+			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
+				summary,
+				detail
+			};
+		}
+		marker = page.nextMarker;
+	} while (marker);
+	return null;
+}
+
+//#endregion
+//#region src/provisioning/providers/wafv2-provider.ts
+/**
+* Translate the empty-string placeholder `readCurrentState` emits for an
+* absent `Description` to `undefined` before shipping it to AWS.
+*
+* `readCurrentState` always-emits `Description: ''` on a WebACL with no
+* description (the comparator's top-level walk is state-keys-only, so
+* the placeholder is required to detect a console-side description add).
+* AWS WAFv2 `CreateWebACL` / `UpdateWebACL` reject `Description: ''`
+* with `Member must have length greater than or equal to 1` (min 1 / max
+* 256). On `cdkd drift --revert` the placeholder would round-trip
+* through `update()` and surface as a hard AWS rejection, so we sanitize
+* the wire-layer payload while keeping the read-side placeholder
+* intact. This is the Class 2 pattern from
+* `docs/provider-development.md § 3b`.
+*/
+function sanitizeDescription(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "string" && value.length === 0) return void 0;
+	return value;
+}
+/**
+* Parse WAFv2 WebACL ARN to extract Id, Name, and Scope.
+*
+* ARN format:
+*   arn:aws:wafv2:{region}:{account}:regional/webacl/{name}/{id}
+*   arn:aws:wafv2:{region}:{account}:global/webacl/{name}/{id}
+*
+* A short / malformed ARN yields `undefined` for `name` / `id` (the path
+* segments simply are not there) — callers must guard. `scope` is always
+* defined (anything not `global` maps to `REGIONAL`).
+*/
+function parseWebACLArn(arn) {
+	const segments = arn.split(":").slice(5).join(":").split("/");
+	const scopeRaw = segments[0];
+	const name = segments[2];
+	return {
+		id: segments[3],
+		name,
+		scope: scopeRaw === "global" ? "CLOUDFRONT" : "REGIONAL"
+	};
+}
+/**
+* AWS WAFv2 WebACL Provider
+*
+* Implements resource provisioning for AWS::WAFv2::WebACL using the WAFv2 SDK.
+* WHY: WAFv2 CreateWebACL is synchronous - the CC API adds unnecessary polling
+* overhead for an operation that completes immediately.
+* This SDK provider eliminates that polling and returns instantly.
+*/
+var WAFv2WebACLProvider = class {
+	wafv2Client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("WAFv2WebACLProvider");
+	handledProperties = /* @__PURE__ */ new Map([["AWS::WAFv2::WebACL", /* @__PURE__ */ new Set([
+		"Name",
+		"Scope",
+		"Tags",
+		"DefaultAction",
+		"Description",
+		"Rules",
+		"VisibilityConfig",
+		"CustomResponseBodies",
+		"CaptchaConfig",
+		"ChallengeConfig",
+		"TokenDomains",
+		"AssociationConfig"
+	])]]);
+	getClient() {
+		if (!this.wafv2Client) this.wafv2Client = new WAFV2Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.wafv2Client;
+	}
+	/**
+	* Create a WAFv2 WebACL
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating WAFv2 WebACL ${logicalId}`);
+		const name = properties["Name"] || generateResourceName(logicalId, { maxLength: 128 });
+		const scope = properties["Scope"] || "REGIONAL";
+		try {
+			const tags = [];
+			if (properties["Tags"]) {
+				const tagList = properties["Tags"];
+				for (const tag of tagList) tags.push({
+					Key: tag.Key,
+					Value: tag.Value
+				});
+			}
+			const summary = (await this.getClient().send(new CreateWebACLCommand({
+				Name: name,
+				Scope: scope,
+				DefaultAction: properties["DefaultAction"],
+				Description: sanitizeDescription(properties["Description"]),
+				Rules: properties["Rules"] || [],
+				VisibilityConfig: properties["VisibilityConfig"],
+				...tags.length > 0 && { Tags: tags },
+				CustomResponseBodies: properties["CustomResponseBodies"],
+				CaptchaConfig: properties["CaptchaConfig"],
+				ChallengeConfig: properties["ChallengeConfig"],
+				TokenDomains: properties["TokenDomains"],
+				AssociationConfig: properties["AssociationConfig"]
+			}))).Summary;
+			if (!summary?.ARN || !summary?.Id) throw new Error("CreateWebACL did not return Summary with ARN and Id");
+			this.logger.debug(`Successfully created WAFv2 WebACL ${logicalId}: ${summary.ARN}`);
+			return {
+				physicalId: summary.ARN,
+				attributes: {
+					Arn: summary.ARN,
+					Id: summary.Id,
+					LabelNamespace: summary["LabelNamespace"]
+				}
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create WAFv2 WebACL ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Update a WAFv2 WebACL
+	*
+	* Name and Scope are immutable - changes to those require replacement.
 	* UpdateWebACL requires LockToken obtained from GetWebACL.
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -8529,25 +8853,31 @@ var WAFv2WebACLProvider = class {
 			if (err instanceof WAFNonexistentItemException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
 		const scope = input.properties["Scope"] || "REGIONAL";
-		let nextMarker;
-		do {
-			const list = await this.getClient().send(new ListWebACLsCommand({
-				Scope: scope,
-				...nextMarker && { NextMarker: nextMarker }
-			}));
-			for (const item of list.WebACLs ?? []) {
-				if (!item.ARN) continue;
-				const tagList = (await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: item.ARN }))).TagInfoForResource?.TagList;
-				if (matchesCdkPath(tagList, input.cdkPath)) return {
-					physicalId: item.ARN,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListWebACLsCommand({
+					Scope: scope,
+					...marker && { NextMarker: marker }
+				}));
+				return {
+					items: list.WebACLs,
+					nextMarker: list.NextMarker
 				};
-			}
-			nextMarker = list.NextMarker;
-		} while (nextMarker);
-		return null;
+			},
+			describe: async (item) => {
+				if (!item.ARN) return void 0;
+				return await this.getClient().send(new ListTagsForResourceCommand$11({ ResourceARN: item.ARN }));
+			},
+			tagsOf: (tagsResp) => tagsResp.TagInfoForResource?.TagList
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.ARN,
+			attributes: {}
+		};
 	}
 };
 
@@ -8917,8 +9247,37 @@ function collectReferencedParameterNames(template) {
 var IntrinsicFunctionResolver = class {
 	logger = getLogger().child("IntrinsicFunctionResolver");
 	resolverRegion;
-	constructor(region) {
+	strictGetAtt;
+	/**
+	* Number of unknown-attribute resolutions that fell back to the physical
+	* ID (the warn path) since construction / the last
+	* {@link resetPhysicalIdFallbackCount}. Counting semantics (issue #1111
+	* item 3): the deploy engine resets this at the start of each `deploy()`
+	* run AND again right before provisioning on the change path — the diff
+	* phase resolves through this same counted resolver, so without the
+	* second reset a fallback site on a to-be-updated resource would count
+	* once during diff and again during provisioning (~2x distinct sites in
+	* the summary). Each distinct fallback site therefore counts once per
+	* run: the surfaced summary covers provisioning + output resolution on
+	* the change path, diff + output resolution on the no-change path, and
+	* diff only under --dry-run. Instance-scoped, so parallel stacks (each
+	* with their own engine + resolver) never share a counter; for the same
+	* reason a nested-stack CHILD engine's fallbacks are counted by the
+	* child's own resolver and are NOT aggregated into the parent stack's
+	* deploy summary.
+	*/
+	physicalIdFallbackCount = 0;
+	constructor(region, options) {
 		this.resolverRegion = region || process.env["AWS_REGION"] || "us-east-1";
+		this.strictGetAtt = options?.strictGetAtt ?? false;
+	}
+	/** Unknown-attribute physicalId fallbacks recorded since the last reset. */
+	getPhysicalIdFallbackCount() {
+		return this.physicalIdFallbackCount;
+	}
+	/** Reset the per-run fallback counter (called at the start of each deploy). */
+	resetPhysicalIdFallbackCount() {
+		this.physicalIdFallbackCount = 0;
 	}
 	/**
 	* Resolve parameter values from template Parameters section
@@ -9210,19 +9569,19 @@ var IntrinsicFunctionResolver = class {
 		if (resourceType === "AWS::DynamoDB::Table" || resourceType === "AWS::DynamoDB::GlobalTable") switch (attributeName) {
 			case "Arn": return `arn:${partition}:dynamodb:${region}:${accountId}:table/${physicalId}`;
 			case "StreamArn": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::S3::Bucket") switch (attributeName) {
 			case "Arn": return `arn:${partition}:s3:::${physicalId}`;
 			case "DomainName": return `${physicalId}.s3.amazonaws.com`;
 			case "RegionalDomainName": return `${physicalId}.s3.${region}.amazonaws.com`;
 			case "WebsiteURL": return `http://${physicalId}.s3-website-${region}.amazonaws.com`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Role") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:role/${physicalId}`;
 			case "RoleId": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::VPC") switch (attributeName) {
 			case "VpcId": return physicalId;
@@ -9252,37 +9611,38 @@ var IntrinsicFunctionResolver = class {
 				return [];
 			}
 			case "DefaultSecurityGroup": return resource.attributes?.["DefaultSecurityGroup"] || physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Policy") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:policy/${physicalId}`;
 			case "PolicyId": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::User") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:user/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::Group") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:group/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::IAM::InstanceProfile") switch (attributeName) {
 			case "Arn": return `arn:${partition}:iam::${accountId}:instance-profile/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::KMS::Key") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kms:${region}:${accountId}:key/${physicalId}`;
 			case "KeyId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Cognito::UserPool") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cognito-idp:${region}:${accountId}:userpool/${physicalId}`;
-			default: return physicalId;
+			case "UserPoolId": return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Kinesis::Stream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:kinesis:${region}:${accountId}:stream/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Events::Rule") switch (attributeName) {
 			case "Arn": {
@@ -9292,36 +9652,36 @@ var IntrinsicFunctionResolver = class {
 				const busName = bus.startsWith("arn:") ? bus.split("/").pop() || "" : bus;
 				return busName ? `arn:${partition}:events:${region}:${accountId}:rule/${busName}/${physicalId}` : `arn:${partition}:events:${region}:${accountId}:rule/${physicalId}`;
 			}
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Events::EventBus") switch (attributeName) {
 			case "Arn": return `arn:${partition}:events:${region}:${accountId}:event-bus/${physicalId}`;
 			case "Name": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EFS::FileSystem") switch (attributeName) {
 			case "Arn": return `arn:${partition}:elasticfilesystem:${region}:${accountId}:file-system/${physicalId}`;
 			case "FileSystemId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::KinesisFirehose::DeliveryStream") switch (attributeName) {
 			case "Arn": return `arn:${partition}:firehose:${region}:${accountId}:deliverystream/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CodeBuild::Project") switch (attributeName) {
 			case "Arn": return `arn:${partition}:codebuild:${region}:${accountId}:project/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CloudTrail::Trail") switch (attributeName) {
 			case "Arn":
 				if (physicalId.startsWith("arn:")) return physicalId;
 				return `arn:${partition}:cloudtrail:${region}:${accountId}:trail/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::AppSync::GraphQLApi") switch (attributeName) {
 			case "Arn": return `arn:${partition}:appsync:${region}:${accountId}:apis/${physicalId}`;
 			case "ApiId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace" || resourceType === "AWS::ServiceDiscovery::HttpNamespace" || resourceType === "AWS::ServiceDiscovery::PublicDnsNamespace") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:namespace/${physicalId}`;
@@ -9333,38 +9693,38 @@ var IntrinsicFunctionResolver = class {
 				this.logger.warn(`Failed to fetch HostedZoneId for namespace ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				return;
 			}
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ServiceDiscovery::Service") switch (attributeName) {
 			case "Arn": return `arn:${partition}:servicediscovery:${region}:${accountId}:service/${physicalId}`;
 			case "Id": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CloudWatch::Alarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::CloudWatch::CompositeAlarm") switch (attributeName) {
 			case "Arn": return `arn:${partition}:cloudwatch:${region}:${accountId}:alarm:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::RDS::DBInstance" || resourceType === "AWS::DocDB::DBInstance" || resourceType === "AWS::Neptune::DBInstance") switch (attributeName) {
 			case "DBInstanceArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:db:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::RDS::DBCluster" || resourceType === "AWS::DocDB::DBCluster" || resourceType === "AWS::Neptune::DBCluster") switch (attributeName) {
 			case "DBClusterArn":
 			case "Arn": return `arn:${partition}:rds:${region}:${accountId}:cluster:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::S3Express::DirectoryBucket") switch (attributeName) {
 			case "Arn": return `arn:${partition}:s3express:${region}:${accountId}:bucket/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Lambda::Function") switch (attributeName) {
 			case "Arn": return `arn:${partition}:lambda:${region}:${accountId}:function:${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::SQS::Queue") {
 			let queueName = physicalId;
@@ -9376,25 +9736,26 @@ var IntrinsicFunctionResolver = class {
 				case "Arn": return `arn:${partition}:sqs:${region}:${accountId}:${queueName}`;
 				case "QueueUrl": return physicalId;
 				case "QueueName": return queueName;
-				default: return physicalId;
+				default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 			}
 		}
 		if (resourceType === "AWS::SNS::Topic") switch (attributeName) {
 			case "TopicArn": return `arn:${partition}:sns:${region}:${accountId}:${physicalId}`;
-			default: return physicalId;
+			case "TopicName": return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::Logs::LogGroup") switch (attributeName) {
 			case "Arn": return `arn:${partition}:logs:${region}:${accountId}:log-group:${physicalId}:*`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECR::Repository") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecr:${region}:${accountId}:repository/${physicalId}`;
 			case "RepositoryUri": return `${accountId}.dkr.ecr.${region}.amazonaws.com/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECS::Cluster") switch (attributeName) {
 			case "Arn": return `arn:${partition}:ecs:${region}:${accountId}:cluster/${physicalId}`;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::ECS::Service") switch (attributeName) {
 			case "Name": {
@@ -9407,18 +9768,30 @@ var IntrinsicFunctionResolver = class {
 				if (pipeIdx >= 0) return physicalId.substring(pipeIdx + 1);
 				return physicalId;
 			}
-			default: return physicalId;
+			case "ServiceArn": {
+				const pipeIdx = physicalId.indexOf("|");
+				if (pipeIdx < 0) return physicalId;
+				const left = physicalId.substring(0, pipeIdx);
+				if (left.includes(":service/")) return left;
+				const clusterIdx = left.indexOf(":cluster/");
+				if (clusterIdx < 0) return physicalId;
+				const clusterName = left.substring(clusterIdx + 9);
+				const serviceName = physicalId.substring(pipeIdx + 1);
+				return `${left.substring(0, clusterIdx)}:service/${clusterName}/${serviceName}`;
+			}
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::SecurityGroup") switch (attributeName) {
 			case "GroupId": return physicalId;
 			case "VpcId": return;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::Subnet") switch (attributeName) {
 			case "SubnetId": return physicalId;
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::Instance") switch (attributeName) {
+			case "InstanceId": return physicalId;
 			case "PrivateIp":
 			case "PublicIp":
 			case "PrivateDnsName":
@@ -9457,7 +9830,7 @@ var IntrinsicFunctionResolver = class {
 				}
 				return physicalId;
 			}
-			default: return physicalId;
+			default: return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
 		if (resourceType === "AWS::EC2::LaunchTemplate") {
 			if (attributeName === "LatestVersionNumber" || attributeName === "DefaultVersionNumber") {
@@ -9470,11 +9843,44 @@ var IntrinsicFunctionResolver = class {
 				}
 				return attributeName === "LatestVersionNumber" ? "$Latest" : "$Default";
 			}
-			return physicalId;
+			if (attributeName === "LaunchTemplateId") return physicalId;
+			return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
 		}
+		return this.guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId);
+	}
+	/**
+	* Shared unknown-attribute physicalId fallback (issues #1106 / #1111).
+	*
+	* Applied by BOTH the final unknown-type fallback of
+	* {@link constructAttribute} and every per-type handler's
+	* `default:`-for-an-unknown-attribute branch:
+	*
+	* - An attribute name ending in `Arn` whose fallback value is not
+	*   ARN-shaped (or ending in `Url` whose fallback is not an http(s) URL)
+	*   cannot be what CloudFormation would return — hard-fail. The #1103
+	*   incident shipped four resource NAMES into stack Outputs where ARNs
+	*   were requested, with a green deploy. A physicalId that already IS an
+	*   ARN / URL passes the shape check and remains a valid fallback.
+	* - Under `--strict-getatt`, EVERY unknown-attribute fallback (any
+	*   suffix) is a hard error.
+	* - Otherwise: `Alias` / `Endpoint` and every other suffix keep the
+	*   warn-and-return behavior (an alias or endpoint is
+	*   shape-indistinguishable from a plain name, so a hard-fail there
+	*   would risk failing correct deploys — false positives are
+	*   unacceptable). Each warn-and-return increments the per-run fallback
+	*   counter surfaced in the deploy summary.
+	*
+	* A `return physicalId` that is the CORRECT value for a KNOWN attribute
+	* (e.g. `AWS::KMS::Key.KeyId`, `AWS::SNS::Topic.TopicName`) must NOT
+	* route through this helper — those are explicit `case`s in the
+	* per-type handlers.
+	*/
+	guardedPhysicalIdFallback(logicalId, attributeName, resourceType, physicalId) {
 		const expectsArnShape = attributeName.endsWith("Arn") && !physicalId.startsWith("arn:");
 		const expectsUrlShape = attributeName.endsWith("Url") && !/^https?:\/\//.test(physicalId);
 		if (expectsArnShape || expectsUrlShape) throw new Error(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and the physical ID fallback "${physicalId}" is not ${expectsArnShape ? "an ARN (arn:...)" : "a URL (http(s)://...)"}. CloudFormation would return a different value here, so falling back to the physical ID would silently produce a wrong value (e.g. in stack Outputs). Avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
+		if (this.strictGetAtt) throw new Error(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}] for ${resourceType}: attributes are not enriched for this resource type, and --strict-getatt rejects the physical ID fallback "${physicalId}" (which may not be the value CloudFormation would return). Drop --strict-getatt to fall back with a warning, avoid this Fn::GetAtt, or file an issue at https://github.com/go-to-k/cdkd/issues so cdkd can enrich ${resourceType}.${attributeName}.`);
+		this.physicalIdFallbackCount++;
 		this.logger.warn(`Unknown attribute ${attributeName} for resource type ${resourceType}, returning physical ID`);
 		return physicalId;
 	}
@@ -10878,7 +11284,7 @@ var CloudControlProvider = class {
 		this.logger.debug(`Deleting resource ${logicalId} (${resourceType}), physical ID: ${physicalId}`);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BPtdM67j.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-6IZKZOKp.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -14538,456 +14944,143 @@ var ProviderRegistry = class {
 	/**
 	* Get the Cloud Control provider instance (for resource state lookup)
 	*/
-	getCloudControlProvider() {
-		return this.cloudControlProvider;
-	}
-	/**
-	* Get all registered resource types (excluding Cloud Control)
-	*/
-	getRegisteredTypes() {
-		return Array.from(this.providers.keys());
-	}
-	/**
-	* Get provider type for a resource type
-	*
-	* @returns 'sdk' | 'cloud-control' | null
-	*/
-	getProviderType(resourceType) {
-		if (this.providers.has(resourceType)) return "sdk";
-		if (CloudControlProvider.isSupportedResourceType(resourceType)) return "cloud-control";
-		if (this.allowedUnsupportedTypes.has(resourceType)) return "cloud-control";
-		return null;
-	}
-	/**
-	* Validate that all resource types have available providers
-	*
-	* This should be called before deployment starts to ensure all resources can be provisioned.
-	*
-	* @param resourceTypes Set of resource types to validate
-	* @throws Error if any resource type doesn't have a provider
-	*/
-	validateResourceTypes(resourceTypes) {
-		const unsupportedTypes = [];
-		for (const resourceType of resourceTypes) if (!this.hasProvider(resourceType)) unsupportedTypes.push(resourceType);
-		if (unsupportedTypes.length > 0) {
-			const details = unsupportedTypes.map((type) => {
-				return `  - ${type}\n      ${isNonProvisionable(type) ? "AWS reports this type as NON_PROVISIONABLE (Cloud Control API cannot manage it) and cdkd has no SDK provider for it." : "cdkd does not currently support this type — no SDK provider is registered, and the type is either on cdkd's Cloud Control blocklist (pending a dedicated SDK provider) or is not an AWS:: namespace."}\n      Request support: ${unsupportedTypeIssueUrl(type)}`;
-			}).join("\n");
-			throw new Error(`The following resource types are not supported by cdkd:\n` + details + `\n\nTo attempt deployment anyway (Cloud Control will likely fail for NON_PROVISIONABLE types), re-run with: --allow-unsupported-types ${unsupportedTypes.join(",")}`);
-		}
-		this.logger.debug(`Validated ${resourceTypes.size} resource types: all have available providers`);
-	}
-	/**
-	* Walk every resource in the template and identify top-level CFn
-	* properties cdkd's SDK provider would silently drop on write. As of
-	* issue [#614](https://github.com/go-to-k/cdkd/issues/614), silent drops
-	* auto-route the resource through Cloud Control API by default (see
-	* {@link getProviderFor}) — the method emits info-level routing decisions
-	* for each silent-drop resource, plus warn-level lines for resources
-	* where the user explicitly opted into the silent drop via
-	* `--allow-unsupported-properties`. The ONE remaining throw path is the
-	* CC-route viability guard: when the auto-route target cannot manage the
-	* type (`NON_PROVISIONABLE` or a provider-level `disableCcApiFallback`
-	* opt-out — e.g. AWS::FSx::FileSystem's Windows/ONTAP/OpenZFS blocks),
-	* this rejects pre-flight with a clear per-property error instead of
-	* letting provisioning fail opaquely.
-	*
-	* Must be called AFTER {@link validateResourceTypes} — type-level errors
-	* are still hard rejects. For a type allowed via `--allow-unsupported-types`,
-	* the property check is a no-op (`findSilentDropProperties` returns `[]`
-	* for non-Tier-1 / unknown types).
-	*
-	* @see findAutoRouteHits for the pure-functional pre-deploy plan-builder
-	*      that returns the same information without logging.
+	getCloudControlProvider() {
+		return this.cloudControlProvider;
+	}
+	/**
+	* Get all registered resource types (excluding Cloud Control)
 	*/
-	validateResourceProperties(resources) {
-		this.reportSilentDropDecisions(resources);
+	getRegisteredTypes() {
+		return Array.from(this.providers.keys());
 	}
 	/**
-	* Info-log every silent-drop routing decision (auto-route via CC API) and
-	* warn-log every silent drop the user explicitly opted into via
-	* `--allow-unsupported-properties` (forced SDK path, the property will
-	* be dropped). Does not mutate state; throws ONLY for the CC-route
-	* viability guard (un-allowed silent drops on a type Cloud Control cannot
-	* manage — see {@link buildUnroutableSilentDropMessage}).
-	*
-	* Issue [#614](https://github.com/go-to-k/cdkd/issues/614). Replaces the
-	* pre-v0.16x throw path: silent drops are now a routing signal, not an
-	* error (except the viability guard above).
+	* Get provider type for a resource type
 	*
-	* When the optional `provisionedBy` (from existing state) is `'cc-api'`,
-	* the auto-route info line is demoted to `debug` — the resource has been
-	* on CC for at least one prior deploy, so the routing decision is
-	* **continuation of sticky state, not a fresh auto-route**. Surfacing the
-	* info line every deploy would be repetitive noise. The warn line for
-	* explicit `--allow-unsupported-properties` overrides is NOT demoted —
-	* that override is an active user choice for THIS deploy and should
-	* surface every time.
+	* @returns 'sdk' | 'cloud-control' | null
 	*/
-	reportSilentDropDecisions(resources) {
-		for (const { logicalId, resourceType, properties, provisionedBy } of resources) {
-			const drops = findSilentDropProperties(resourceType, properties);
-			if (drops.length === 0) continue;
-			const overridden = [];
-			const autoRouted = [];
-			for (const { property } of drops) {
-				const allowKey = `${resourceType}:${property}`;
-				if (this.allowedUnsupportedProperties.has(allowKey)) overridden.push(property);
-				else autoRouted.push(property);
-			}
-			if (autoRouted.length > 0) {
-				const provider = this.providers.get(resourceType);
-				if (isNonProvisionable(resourceType) || provider?.disableCcApiFallback === true) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)))}`);
-				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${autoRouted.join(", ")} — CC API will forward the full property map. Override via --allow-unsupported-properties ${autoRouted.map((p) => `${resourceType}:${p}`).join(",")}.)`;
-				if (provisionedBy === "cc-api") this.logger.debug(message);
-				else this.logger.info(message);
-			}
-			if (overridden.length > 0) {
-				const propList = overridden.join(", ");
-				this.logger.warn(`${logicalId} (${resourceType}): ${propList} will be silently dropped (--allow-unsupported-properties override accepted). Remove the override to route this resource via Cloud Control API instead.`);
-			}
-		}
+	getProviderType(resourceType) {
+		if (this.providers.has(resourceType)) return "sdk";
+		if (CloudControlProvider.isSupportedResourceType(resourceType)) return "cloud-control";
+		if (this.allowedUnsupportedTypes.has(resourceType)) return "cloud-control";
+		return null;
 	}
 	/**
-	* Pure-functional discovery of every resource whose template uses one or
-	* more silent-drop properties that are NOT in the
-	* `--allow-unsupported-properties` allow set — i.e. every resource that
-	* {@link getProviderFor} would auto-route via Cloud Control. Returned
-	* entries carry the silent-drop property names so plan / diff renderers
-	* can show `[via CC API: RuntimeManagementConfig]`.
+	* Validate that all resource types have available providers
 	*
-	* Does NOT log or throw. Use {@link reportSilentDropDecisions} for the
-	* side-effecting info / warn surface.
+	* This should be called before deployment starts to ensure all resources can be provisioned.
+	*
+	* @param resourceTypes Set of resource types to validate
+	* @throws Error if any resource type doesn't have a provider
 	*/
-	findAutoRouteHits(resources) {
-		const hits = [];
-		for (const { logicalId, resourceType, properties } of resources) {
-			const actionable = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
-			if (actionable.length === 0) continue;
-			hits.push({
-				logicalId,
-				resourceType,
-				properties: actionable.map((d) => d.property)
-			});
-		}
-		return hits;
-	}
-};
-function isCustomResource(resourceType) {
-	return resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::CustomResource";
-}
-
-//#endregion
-//#region src/deployment/retryable-errors.ts
-/**
-* Patterns that mark an AWS error as a transient/retryable failure.
-* Each entry is a substring match against the error message; all of these
-* are situations where the same call typically succeeds after a short delay
-* because of eventual consistency or just-created-dependency propagation.
-*/
-const RETRYABLE_ERROR_MESSAGE_PATTERNS = [
-	"cannot be assumed",
-	"Firehose is unable to assume role",
-	"is unable to assume provided role",
-	"role defined for the function",
-	"not authorized to perform",
-	"execution role",
-	"trust policy",
-	"Role validation failed",
-	"does not have required permissions",
-	"Trusted Entity",
-	"currently in the following state: Pending",
-	"has dependencies and cannot be deleted",
-	"can't be deleted since it has",
-	"DependencyViolation",
-	"does not exist",
-	"Schema is currently being altered",
-	"Invalid principal in policy",
-	"Policy Error: PrincipalNotFound",
-	"Invalid value for the parameter Policy",
-	"required permissions for: ENHANCED_MONITORING",
-	"Caught ServiceAccessDeniedException",
-	"permissions required to assume the role",
-	"authorized to assume the provided role",
-	"conflicting conditional operation",
-	"scheduled for deletion",
-	"Cannot access stream",
-	"Please ensure the role can perform",
-	"KMS key is invalid for CreateGrant",
-	"Policy contains a statement with one or more invalid principals",
-	"Invalid IAM Instance Profile",
-	"Invalid InstanceProfile",
-	"Failed to authorize instance profile",
-	"Could not deliver test message",
-	"wait 60 seconds",
-	"concurrent update operation",
-	"because it is in use",
-	"Rate exceeded"
-];
-/**
-* HTTP status codes that always indicate a transient failure worth retrying.
-* 429 = Too Many Requests (throttle), 503 = Service Unavailable.
-*/
-const RETRYABLE_HTTP_STATUS_CODES = /* @__PURE__ */ new Set([429, 503]);
-/**
-* AWS SDK v3 canonical throttling error names. Mirrors
-* `@aws-sdk/service-error-classification`'s `THROTTLING_ERROR_CODES` — any
-* error (or wrapped cause) whose `name` is one of these is a transient rate-
-* limit rejection worth retrying with backoff. Detecting by NAME is more
-* robust than by HTTP status because most AWS throttles surface as HTTP 400
-* (not 429) with the throttling signal carried only in the error code / name
-* (e.g. SSM `ThrottlingException` for the `Rate exceeded` message).
-*/
-const THROTTLING_ERROR_NAMES = /* @__PURE__ */ new Set([
-	"BandwidthLimitExceeded",
-	"EC2ThrottledException",
-	"LimitExceededException",
-	"PriorRequestNotComplete",
-	"ProvisionedThroughputExceededException",
-	"RequestLimitExceeded",
-	"RequestThrottled",
-	"RequestThrottledException",
-	"SlowDown",
-	"ThrottledException",
-	"Throttling",
-	"ThrottlingException",
-	"TooManyRequestsException",
-	"TransactionInProgressException"
-]);
-/**
-* Walk the error + its `.cause` chain (bounded) looking for a rate-limit
-* signal — either an AWS SDK v3 throttling error `name`
-* ({@link THROTTLING_ERROR_NAMES}) or a retryable HTTP status
-* ({@link RETRYABLE_HTTP_STATUS_CODES}) on `$metadata`.
-*
-* cdkd wraps the original AWS error in a `ProvisioningError`, so the signal is
-* typically one cause-link deep; the bounded walk also tolerates SDK errors
-* that nest a `$response`/cause without exploding on a cyclic chain.
-*
-* BOTH signals are checked at EVERY depth. An earlier version checked the name
-* to depth 5 but the HTTP status only at depths 0 and 1, so a 429 nested two
-* links deep was missed. This is the single shared cause-walk: the read-only
-* import tag walk (`src/provisioning/import-tag-walk.ts`) composes its own
-* classifier on top of this function rather than re-implementing the traversal,
-* so the two cannot drift apart again.
-*/
-function isThrottlingError(error) {
-	let current = error;
-	for (let depth = 0; depth < 5 && current != null; depth++) {
-		const name = current.name;
-		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
-		const status = current.$metadata?.httpStatusCode;
-		if (status !== void 0 && RETRYABLE_HTTP_STATUS_CODES.has(status)) return true;
-		current = current.cause;
-	}
-	return false;
-}
-/**
-* Determine whether an AWS error should be retried.
-*
-* Checks (in order):
-*   1. Rate-limit signal on the error or any wrapped cause — throttling error
-*      `name` or retryable HTTP status (most AWS throttles are HTTP 400, not
-*      429, so the name check carries most of the weight). See
-*      {@link isThrottlingError}.
-*   2. Substring match against {@link RETRYABLE_ERROR_MESSAGE_PATTERNS}
-*/
-function isRetryableTransientError(error, message) {
-	if (isThrottlingError(error)) return true;
-	return RETRYABLE_ERROR_MESSAGE_PATTERNS.some((p) => message.includes(p));
-}
-
-//#endregion
-//#region src/deployment/retry.ts
-/**
-* Retry helper for resource provisioning operations that hit transient
-* AWS eventual-consistency errors (IAM propagation, Lambda Pending state,
-* dependency violations, etc.).
-*
-* Extracted from DeployEngine so the backoff schedule can be unit-tested
-* in isolation. The retryable-error classifier itself lives in
-* `./retryable-errors.ts`.
-*/
-const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-/**
-* Run `operation`, retrying transient failures with exponential backoff
-* capped at `maxDelayMs`.
-*
-* Backoff at the defaults (initialDelayMs=1_000, maxDelayMs=8_000, maxRetries=8):
-*   1s -> 2s -> 4s -> 8s -> 8s -> 8s -> 8s -> 8s   (cumulative 47s)
-*
-* Non-retryable errors are rethrown immediately. The transient-error
-* classifier is `isRetryableTransientError` from ./retryable-errors.ts.
-*/
-async function withRetry(operation, logicalId, opts = {}) {
-	const maxRetries = opts.maxRetries ?? 8;
-	const initialDelayMs = opts.initialDelayMs ?? 1e3;
-	const maxDelayMs = opts.maxDelayMs ?? 8e3;
-	const sleep = opts.sleep ?? defaultSleep;
-	let lastError;
-	for (let attempt = 0; attempt <= maxRetries; attempt++) try {
-		return await operation();
-	} catch (error) {
-		lastError = error;
-		const message = error instanceof Error ? error.message : String(error);
-		if (!(opts.isRetryable ? opts.isRetryable(message, error) : isRetryableTransientError(error, message)) || attempt >= maxRetries) throw error;
-		const delay = Math.min(initialDelayMs * Math.pow(2, attempt), maxDelayMs);
-		opts.logger?.debug(`  ⏳ Retrying ${logicalId} in ${delay / 1e3}s (attempt ${attempt + 1}/${maxRetries}) - ${message}`);
-		for (let waited = 0; waited < delay; waited += 1e3) {
-			if (opts.isInterrupted?.()) throw opts.onInterrupted ? opts.onInterrupted() : /* @__PURE__ */ new Error("Interrupted");
-			await sleep(Math.min(1e3, delay - waited));
+	validateResourceTypes(resourceTypes) {
+		const unsupportedTypes = [];
+		for (const resourceType of resourceTypes) if (!this.hasProvider(resourceType)) unsupportedTypes.push(resourceType);
+		if (unsupportedTypes.length > 0) {
+			const details = unsupportedTypes.map((type) => {
+				return `  - ${type}\n      ${isNonProvisionable(type) ? "AWS reports this type as NON_PROVISIONABLE (Cloud Control API cannot manage it) and cdkd has no SDK provider for it." : "cdkd does not currently support this type — no SDK provider is registered, and the type is either on cdkd's Cloud Control blocklist (pending a dedicated SDK provider) or is not an AWS:: namespace."}\n      Request support: ${unsupportedTypeIssueUrl(type)}`;
+			}).join("\n");
+			throw new Error(`The following resource types are not supported by cdkd:\n` + details + `\n\nTo attempt deployment anyway (Cloud Control will likely fail for NON_PROVISIONABLE types), re-run with: --allow-unsupported-types ${unsupportedTypes.join(",")}`);
 		}
+		this.logger.debug(`Validated ${resourceTypes.size} resource types: all have available providers`);
 	}
-	throw lastError;
-}
-
-//#endregion
-//#region src/provisioning/import-tag-walk.ts
-/**
-* Shared, throttle-tolerant `aws:cdk:path` tag walk for `ResourceProvider.import`.
-*
-* Providers that adopt a resource without an explicit name property fall back
-* to step 3 of the lookup order documented in `./import-helpers.ts`: enumerate
-* the service's `List*`/`Describe*` pages, then issue ONE per-candidate read
-* (`DescribeX` / `ListTagsForResource`) to obtain the tag set — the list
-* summaries usually do not carry tags. That is an inherent **N+1** read
-* pattern: an account with many resources of the type produces one API call
-* per candidate in a tight loop, which is exactly the shape AWS rate-limits.
-*
-* Every provider previously hand-rolled this loop with NO backoff, so a single
-* throttled `Describe*` aborted the whole `cdkd import` run. This helper
-* centralises the loop and wraps BOTH the list page fetch and the per-candidate
-* describe in the deploy engine's `withRetry` with exponential backoff.
-*
-* ## Why a narrower classifier than `isRetryableTransientError`
-*
-* The deploy engine's classifier is tuned for the WRITE path: it also treats
-* eventual-consistency phrasings like `does not exist` / `not authorized to
-* perform` as transient, because a just-created dependency legitimately needs a
-* moment to propagate. On a read-only import walk those messages mean the
-* opposite — the candidate really is gone, or the caller's credentials really
-* lack the permission — and retrying them burns the full backoff budget per
-* candidate before surfacing the true error.
-*
-* So the walk retries throttling ONLY, reusing the deploy engine's throttle
-* tables verbatim ({@link THROTTLING_ERROR_NAMES} /
-* {@link RETRYABLE_HTTP_STATUS_CODES}) rather than maintaining a second copy.
-*
-* ## Batching
-*
-* Batched tag reads are deliberately NOT modelled here: the services this
-* helper currently serves (EMR `DescribeCluster`, DocDB
-* `ListTagsForResource`) expose only single-resource reads. A service that
-* genuinely offers a batch API (e.g. CodeCommit `BatchGetRepositories`) can
-* satisfy several candidates from one call inside its own `describe` callback,
-* or bypass the helper entirely.
-*/
-/** Max number of retries after the first attempt, per API call in the walk. */
-const DEFAULT_MAX_RETRIES = 5;
-/** Initial backoff; each retry doubles it up to {@link DEFAULT_MAX_DELAY_MS}. */
-const DEFAULT_INITIAL_DELAY_MS = 500;
-/** Cap for the per-retry delay (0.5s -> 1s -> 2s -> 4s -> 5s, ~12.5s total). */
-const DEFAULT_MAX_DELAY_MS = 5e3;
-/**
-* Wall-clock ceiling for the WHOLE walk (all pages + all candidates), not just
-* one call. Backoff is per-call, so without this a sustained throttle against a
-* large account degrades into `(pages + candidates) x ~12.5s` of near-silent
-* retrying — ~42 minutes for 200 candidates, with no way to tell a slow walk
-* from a hung one. 10 minutes is generous for a healthy walk (a 200-candidate
-* DocDB account completes in seconds when AWS is not throttling) and bounds the
-* pathological case to something a user will wait through.
-*/
-const DEFAULT_MAX_WALK_MS = 10 * 6e4;
-/**
-* Ceiling on pages fetched. A service that returns a non-advancing pagination
-* token (a bug, or a marker cdkd echoes back wrongly) would otherwise spin
-* forever. This is now the shared path every migrated provider runs on, so the
-* guard belongs here rather than in each caller.
-*/
-const DEFAULT_MAX_PAGES = 1e3;
-/**
-* Whether an error hit during the read-only tag walk is a rate-limit rejection
-* worth backing off on.
-*
-* Delegates the error + `.cause` chain traversal to the deploy engine's
-* {@link isThrottlingError} (throttling error names + retryable HTTP statuses,
-* at every cause depth) and adds the canonical `Rate exceeded` message, which
-* several services return with an HTTP 400 and a service-specific error name.
-*
-* This is deliberately NARROWER than `isRetryableTransientError`: that
-* classifier also treats write-path eventual-consistency phrasings (`does not
-* exist`, `not authorized to perform`) as transient, because a just-created
-* dependency legitimately needs a moment to propagate. On a read-only walk
-* those mean the candidate really is gone or the credentials really lack the
-* permission, and retrying them burns the full backoff budget per candidate
-* before surfacing the true error.
-*
-* Exported for direct unit testing and for providers whose tag walk cannot use
-* {@link importTagWalk} verbatim.
-*/
-function isThrottlingLikeError(error, message) {
-	return isThrottlingError(error) || message.includes("Rate exceeded");
-}
-/** Thrown when the walk exceeds its wall-clock budget or page ceiling. */
-var ImportTagWalkLimitError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "ImportTagWalkLimitError";
+	/**
+	* Walk every resource in the template and identify top-level CFn
+	* properties cdkd's SDK provider would silently drop on write. As of
+	* issue [#614](https://github.com/go-to-k/cdkd/issues/614), silent drops
+	* auto-route the resource through Cloud Control API by default (see
+	* {@link getProviderFor}) — the method emits info-level routing decisions
+	* for each silent-drop resource, plus warn-level lines for resources
+	* where the user explicitly opted into the silent drop via
+	* `--allow-unsupported-properties`. The ONE remaining throw path is the
+	* CC-route viability guard: when the auto-route target cannot manage the
+	* type (`NON_PROVISIONABLE` or a provider-level `disableCcApiFallback`
+	* opt-out — e.g. AWS::FSx::FileSystem's Windows/ONTAP/OpenZFS blocks),
+	* this rejects pre-flight with a clear per-property error instead of
+	* letting provisioning fail opaquely.
+	*
+	* Must be called AFTER {@link validateResourceTypes} — type-level errors
+	* are still hard rejects. For a type allowed via `--allow-unsupported-types`,
+	* the property check is a no-op (`findSilentDropProperties` returns `[]`
+	* for non-Tier-1 / unknown types).
+	*
+	* @see findAutoRouteHits for the pure-functional pre-deploy plan-builder
+	*      that returns the same information without logging.
+	*/
+	validateResourceProperties(resources) {
+		this.reportSilentDropDecisions(resources);
 	}
-};
-/**
-* Paginate `listPage`, `describe` each candidate, and return the first one
-* whose tags carry the requested `aws:cdk:path`. Returns `null` when no
-* candidate matches (or when `cdkPath` is empty).
-*
-* Both callbacks are individually retried with exponential backoff on
-* throttling errors, so one rate-limited call mid-walk no longer aborts the
-* whole import.
-*/
-async function importTagWalk(options) {
-	const { cdkPath, listPage, describe, tagsOf } = options;
-	if (!cdkPath) return null;
-	const logicalId = options.logicalId ?? "import";
-	const logger = options.retry?.logger ?? getLogger();
-	const maxWalkMs = options.retry?.maxWalkMs ?? DEFAULT_MAX_WALK_MS;
-	const maxPages = options.retry?.maxPages ?? DEFAULT_MAX_PAGES;
-	const retryOpts = {
-		maxRetries: options.retry?.maxRetries ?? DEFAULT_MAX_RETRIES,
-		initialDelayMs: options.retry?.initialDelayMs ?? DEFAULT_INITIAL_DELAY_MS,
-		maxDelayMs: options.retry?.maxDelayMs ?? DEFAULT_MAX_DELAY_MS,
-		isRetryable: (message, error) => isThrottlingLikeError(error, message),
-		logger,
-		...options.retry?.isInterrupted && { isInterrupted: options.retry.isInterrupted },
-		...options.retry?.onInterrupted && { onInterrupted: options.retry.onInterrupted },
-		...options.retry?.sleep && { sleep: options.retry.sleep }
-	};
-	const startedAt = Date.now();
-	const assertWithinBudget = (stage) => {
-		const elapsed = Date.now() - startedAt;
-		if (elapsed >= maxWalkMs) throw new ImportTagWalkLimitError(`Timed out looking up ${logicalId} by its aws:cdk:path tag after ${Math.round(elapsed / 1e3)}s (limit ${Math.round(maxWalkMs / 1e3)}s, while ${stage}). AWS is likely throttling the lookup; retry, or pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-	};
-	let marker;
-	let pages = 0;
-	do {
-		assertWithinBudget("listing candidates");
-		if (++pages > maxPages) throw new ImportTagWalkLimitError(`Gave up looking up ${logicalId} by its aws:cdk:path tag after ${maxPages} pages (the service may be returning a non-advancing pagination token). Pass an explicit physical id with --resource ${logicalId}=<physicalId>.`);
-		const currentMarker = marker;
-		const page = await withRetry(() => listPage(currentMarker), logicalId, retryOpts);
-		for (const summary of page.items ?? []) {
-			assertWithinBudget("reading candidate tags");
-			const detail = await withRetry(() => describe(summary), logicalId, retryOpts);
-			if (detail === void 0) {
-				logger.debug(`  ↷ Skipped an ${logicalId} import candidate: its detail lookup returned no result`);
-				continue;
+	/**
+	* Info-log every silent-drop routing decision (auto-route via CC API) and
+	* warn-log every silent drop the user explicitly opted into via
+	* `--allow-unsupported-properties` (forced SDK path, the property will
+	* be dropped). Does not mutate state; throws ONLY for the CC-route
+	* viability guard (un-allowed silent drops on a type Cloud Control cannot
+	* manage — see {@link buildUnroutableSilentDropMessage}).
+	*
+	* Issue [#614](https://github.com/go-to-k/cdkd/issues/614). Replaces the
+	* pre-v0.16x throw path: silent drops are now a routing signal, not an
+	* error (except the viability guard above).
+	*
+	* When the optional `provisionedBy` (from existing state) is `'cc-api'`,
+	* the auto-route info line is demoted to `debug` — the resource has been
+	* on CC for at least one prior deploy, so the routing decision is
+	* **continuation of sticky state, not a fresh auto-route**. Surfacing the
+	* info line every deploy would be repetitive noise. The warn line for
+	* explicit `--allow-unsupported-properties` overrides is NOT demoted —
+	* that override is an active user choice for THIS deploy and should
+	* surface every time.
+	*/
+	reportSilentDropDecisions(resources) {
+		for (const { logicalId, resourceType, properties, provisionedBy } of resources) {
+			const drops = findSilentDropProperties(resourceType, properties);
+			if (drops.length === 0) continue;
+			const overridden = [];
+			const autoRouted = [];
+			for (const { property } of drops) {
+				const allowKey = `${resourceType}:${property}`;
+				if (this.allowedUnsupportedProperties.has(allowKey)) overridden.push(property);
+				else autoRouted.push(property);
+			}
+			if (autoRouted.length > 0) {
+				const provider = this.providers.get(resourceType);
+				if (isNonProvisionable(resourceType) || provider?.disableCcApiFallback === true) throw new Error(`${logicalId}: ${this.buildUnroutableSilentDropMessage(resourceType, drops.filter((d) => autoRouted.includes(d.property)))}`);
+				const message = `${logicalId} (${resourceType}): routing via Cloud Control API (cdkd's SDK Provider does not yet wire ${autoRouted.join(", ")} — CC API will forward the full property map. Override via --allow-unsupported-properties ${autoRouted.map((p) => `${resourceType}:${p}`).join(",")}.)`;
+				if (provisionedBy === "cc-api") this.logger.debug(message);
+				else this.logger.info(message);
+			}
+			if (overridden.length > 0) {
+				const propList = overridden.join(", ");
+				this.logger.warn(`${logicalId} (${resourceType}): ${propList} will be silently dropped (--allow-unsupported-properties override accepted). Remove the override to route this resource via Cloud Control API instead.`);
 			}
-			if (matchesCdkPath(tagsOf(detail, summary), cdkPath)) return {
-				summary,
-				detail
-			};
 		}
-		marker = page.nextMarker;
-	} while (marker);
-	return null;
+	}
+	/**
+	* Pure-functional discovery of every resource whose template uses one or
+	* more silent-drop properties that are NOT in the
+	* `--allow-unsupported-properties` allow set — i.e. every resource that
+	* {@link getProviderFor} would auto-route via Cloud Control. Returned
+	* entries carry the silent-drop property names so plan / diff renderers
+	* can show `[via CC API: RuntimeManagementConfig]`.
+	*
+	* Does NOT log or throw. Use {@link reportSilentDropDecisions} for the
+	* side-effecting info / warn surface.
+	*/
+	findAutoRouteHits(resources) {
+		const hits = [];
+		for (const { logicalId, resourceType, properties } of resources) {
+			const actionable = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
+			if (actionable.length === 0) continue;
+			hits.push({
+				logicalId,
+				resourceType,
+				properties: actionable.map((d) => d.property)
+			});
+		}
+		return hits;
+	}
+};
+function isCustomResource(resourceType) {
+	return resourceType.startsWith("Custom::") || resourceType === "AWS::CloudFormation::CustomResource";
 }
 
 //#endregion
@@ -16280,7 +16373,7 @@ var DeployEngine = class {
 		this.options = options;
 		this.stackRegion = stackRegion;
 		this.exportIndexStore = exportIndexStore;
-		this.resolver = new IntrinsicFunctionResolver(stackRegion);
+		this.resolver = new IntrinsicFunctionResolver(stackRegion, { strictGetAtt: options.strictGetAtt ?? false });
 		this.options.concurrency = options.concurrency ?? 10;
 		this.options.dryRun = options.dryRun ?? false;
 		this.options.lockTimeout = options.lockTimeout ?? 300 * 1e3;
@@ -16295,6 +16388,7 @@ var DeployEngine = class {
 	async deploy(stackName, template) {
 		this.recordedImports = [];
 		this.recordedOutputReads = [];
+		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
 	/**
@@ -16611,7 +16705,8 @@ var DeployEngine = class {
 					deleted: 0,
 					unchanged: Object.keys(currentState.resources).length,
 					durationMs: Date.now() - startTime,
-					outputs: this.buildDisplayOutputs(template, persistedOutputs)
+					outputs: this.buildDisplayOutputs(template, persistedOutputs),
+					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 				};
 			}
 			const createChanges = this.diffCalculator.filterByType(changes, "CREATE");
@@ -16626,9 +16721,11 @@ var DeployEngine = class {
 					updated: updateChanges.length,
 					deleted: deleteChanges.length,
 					unchanged: this.diffCalculator.filterByType(changes, "NO_CHANGE").length,
-					durationMs: Date.now() - startTime
+					durationMs: Date.now() - startTime,
+					attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 				};
 			}
+			this.resolver.resetPhysicalIdFallbackCount();
 			const progress = {
 				current: 0,
 				total: createChanges.length + updateChanges.length + deleteChanges.length
@@ -16647,7 +16744,8 @@ var DeployEngine = class {
 				deleted: actualCounts.deleted,
 				unchanged: unchangedCount,
 				durationMs,
-				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {})
+				outputs: this.buildDisplayOutputs(template, newState.outputs ?? {}),
+				attributeFallbackCount: this.resolver.getPhysicalIdFallbackCount()
 			};
 		} finally {
 			renderer.stop();
@@ -16861,7 +16959,13 @@ var DeployEngine = class {
 			}
 			throw error;
 		}
-		const outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+		let outputs;
+		try {
+			outputs = await this.resolveOutputs(template, newResources, stackName, parameterValues, conditions);
+		} catch (outputError) {
+			await this.persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration);
+			throw outputError;
+		}
 		return {
 			state: {
 				version: 8,
@@ -16877,6 +16981,58 @@ var DeployEngine = class {
 		};
 	}
 	/**
+	* Persist state after provisioning fully succeeded but output resolution
+	* threw (only reachable under `--strict-getatt`, whose promotion fires
+	* AFTER the rollback catch block). The persisted shape mirrors the
+	* success-path state EXCEPT for outputs:
+	*
+	* - `resources`: this run's provisioning result (`newResources`) — every
+	*   create/update/delete landed in AWS, so state must record it.
+	* - `imports` / `outputReads`: this run's `recordedImports` /
+	*   `recordedOutputReads` (the provisioning that produced them succeeded;
+	*   dropping them would desync the strong-reference records from AWS —
+	*   matters on the update-deploy path where the pre-deploy snapshot may
+	*   be stale).
+	* - `outputs`: the PREVIOUSLY persisted map — resolveOutputs threw before
+	*   producing a new one, mirroring what a resource-failure persist keeps.
+	*   The exports index is deliberately NOT updated (it stays consistent
+	*   with the old outputs that remain in state).
+	*
+	* ETag handling mirrors the post-rollback save: expected-ETag first (or
+	* unconditional when `pendingMigration` — same as the per-resource save),
+	* then a fresh-ETag retry, then warn. Best-effort: the deploy error being
+	* rethrown is the primary signal; a failed save only warns.
+	*/
+	async persistStateAfterOutputFailure(stackName, currentState, newResources, currentEtag, pendingMigration) {
+		const buildState = () => ({
+			version: 8,
+			region: this.stackRegion,
+			stackName: currentState.stackName,
+			resources: newResources,
+			outputs: currentState.outputs,
+			...this.recordedImports.length > 0 && { imports: [...this.recordedImports] },
+			...this.recordedOutputReads.length > 0 && { outputReads: [...this.recordedOutputReads] },
+			lastModified: Date.now()
+		});
+		try {
+			const expectedEtag = pendingMigration ? void 0 : currentEtag;
+			await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(buildState()), {
+				...expectedEtag !== void 0 && { expectedEtag },
+				migrateLegacy: pendingMigration
+			});
+			this.logger.debug("State saved after output resolution failure");
+		} catch (saveError) {
+			this.logger.debug(`Retrying state save after output resolution failure (ETag mismatch): ${saveError instanceof Error ? saveError.message : String(saveError)}`);
+			try {
+				const freshEtag = (await this.stateBackend.getState(stackName, this.stackRegion))?.etag;
+				await this.stateBackend.saveState(stackName, this.stackRegion, this.withParentInfo(buildState()), { ...freshEtag !== void 0 && { expectedEtag: freshEtag } });
+				this.logger.debug("State saved after output resolution failure (retry succeeded)");
+			} catch (retryError) {
+				this.logger.warn(`Failed to save state after output resolution failure: ${retryError instanceof Error ? retryError.message : String(retryError)} — resources were provisioned but not recorded; run deploy again to reconcile.`);
+			}
+		}
+	}
+	/**
 	* Perform best-effort rollback of completed operations respecting dependencies
 	*
 	* - CREATE → delete the newly created resource (in reverse dependency order)
@@ -17624,6 +17780,7 @@ var DeployEngine = class {
 					if (typeof exportName === "string") outputs[exportName] = value;
 				}
 			} catch (error) {
+				if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`);
 				this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
 				outputs[outputKey] = void 0;
 			}
@@ -17642,5 +17799,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { BOOTSTRAP_MARKER_PREFIX as $, StateError as $t, refStateLookupFromResource as A, AssemblyReader as At, TemplateParser as B, DependencyError as Bt, ProviderRegistry as C, warnDeprecatedNoPrefixCliFlag as Ct, isTerminationProtectionPropagationError as D, findLargeInlineResources as Dt, disableInstanceApiTermination as E, MIGRATE_TMP_PREFIX as Et, resolveExplicitPhysicalId as F, resetAwsClients as Ft, AssetPublisher as G, MissingCdkCliError as Gt, S3StateBackend as H, LocalMigrateError as Ht, assertRegionMatch as I, setAwsClients as It, buildAssetRedirectMap as J, ProvisioningError as Jt, stringifyValue as K, NestedStackChildDirectDestroyError as Kt, applyRoleArnIfSet as L, AssetError as Lt, CDK_PATH_TAG as M, resolveBucketRegion as Mt, matchesCdkPath as N, AwsClients as Nt, IntrinsicFunctionResolver as O, uploadCfnTemplate as Ot, normalizeAwsTagsToCfn as P, getAwsClients as Pt, AssetModeResolver as Q, StackTerminationProtectionError as Qt, DiffCalculator as R, CdkdError as Rt, isRetryableTransientError as S, resolveUseCdkBootstrapAssets as St, CloudControlProvider as T, CFN_TEMPLATE_URL_LIMIT as Tt, rebuildClientForBucketRegion as U, LocalStartServiceError as Ut, LockManager as V, LocalInvokeBuildError as Vt, shouldRetainResource as W, LockError as Wt, loadPublishableAssetManifest as X, ResourceUpdateNotSupportedError as Xt, createAssetRedirectResolver as Y, ResourceTimeoutError as Yt, rewriteTemplateAssetReferences as Z, StackHasActiveImportsError as Zt, yellow as _, resolveAutoAssetStorage as _t, IMPLICIT_DELETE_DEPENDENCIES as a, __exportAll as an, buildDockerImage as at, importTagWalk as b, resolveStateBucketWithDefault as bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as c, runDockerForeground as ct, formatResourceLine as d, getDockerImageBySourceHash as dt, SynthesisError as en, ensureAssetStorage as et, bold as f, Synthesizer as ft, red as g, resolveApp as gt, green as h, getLegacyStateBucketName as ht, withResourceDeadline as i, withErrorHandling as in, validateContainerRepoName as it, WAFv2WebACLProvider as j, clearBucketRegionCache as jt, cfnRefValueFromPhysicalId as k, expectedOwnerParam as kt, isStatefulRecreateTargetSync as l, runDockerStreaming as lt, gray as m, getDefaultStateBucketName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as nn, parseBootstrapMarker as nt, computeImplicitDeleteEdges as o, formatDockerLoginError as ot, cyan as p, synthesisStatusMessage as pt, WorkGraph as q, PartialFailureError as qt, DeployEngine as r, normalizeAwsError as rn, validateAssetBucketName as rt, extractDeploymentEventError as s, getDockerCmd as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as tn, getBootstrapMarkerKey as tt, renderStatefulReason as u, AssetManifestLoader as ut, IAMRoleProvider as v, resolveCaptureObservedState as vt, findActionableSilentDrops as w, CFN_TEMPLATE_BODY_LIMIT as wt, withRetry as x, resolveStateBucketWithDefaultAndSource as xt, collectInlinePolicyNamesManagedBySiblings as y, resolveSkipPrefix as yt, DagBuilder as z, ConfigError as zt };
-//# sourceMappingURL=deploy-engine-CFUNbwD1.js.map
+export { BOOTSTRAP_MARKER_PREFIX as $, StateError as $t, withRetry as A, AssemblyReader as At, TemplateParser as B, DependencyError as Bt, disableInstanceApiTermination as C, warnDeprecatedNoPrefixCliFlag as Ct, refStateLookupFromResource as D, findLargeInlineResources as Dt, cfnRefValueFromPhysicalId as E, MIGRATE_TMP_PREFIX as Et, resolveExplicitPhysicalId as F, resetAwsClients as Ft, AssetPublisher as G, MissingCdkCliError as Gt, S3StateBackend as H, LocalMigrateError as Ht, assertRegionMatch as I, setAwsClients as It, buildAssetRedirectMap as J, ProvisioningError as Jt, stringifyValue as K, NestedStackChildDirectDestroyError as Kt, applyRoleArnIfSet as L, AssetError as Lt, CDK_PATH_TAG as M, resolveBucketRegion as Mt, matchesCdkPath as N, AwsClients as Nt, WAFv2WebACLProvider as O, uploadCfnTemplate as Ot, normalizeAwsTagsToCfn as P, getAwsClients as Pt, AssetModeResolver as Q, StackTerminationProtectionError as Qt, DiffCalculator as R, CdkdError as Rt, CloudControlProvider as S, resolveUseCdkBootstrapAssets as St, IntrinsicFunctionResolver as T, CFN_TEMPLATE_URL_LIMIT as Tt, rebuildClientForBucketRegion as U, LocalStartServiceError as Ut, LockManager as V, LocalInvokeBuildError as Vt, shouldRetainResource as W, LockError as Wt, loadPublishableAssetManifest as X, ResourceUpdateNotSupportedError as Xt, createAssetRedirectResolver as Y, ResourceTimeoutError as Yt, rewriteTemplateAssetReferences as Z, StackHasActiveImportsError as Zt, yellow as _, resolveAutoAssetStorage as _t, IMPLICIT_DELETE_DEPENDENCIES as a, __exportAll as an, buildDockerImage as at, ProviderRegistry as b, resolveStateBucketWithDefault as bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as c, runDockerForeground as ct, formatResourceLine as d, getDockerImageBySourceHash as dt, SynthesisError as en, ensureAssetStorage as et, bold as f, Synthesizer as ft, red as g, resolveApp as gt, green as h, getLegacyStateBucketName as ht, withResourceDeadline as i, withErrorHandling as in, validateContainerRepoName as it, isRetryableTransientError as j, clearBucketRegionCache as jt, importTagWalk as k, expectedOwnerParam as kt, isStatefulRecreateTargetSync as l, runDockerStreaming as lt, gray as m, getDefaultStateBucketName as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isCdkdError as nn, parseBootstrapMarker as nt, computeImplicitDeleteEdges as o, formatDockerLoginError as ot, cyan as p, synthesisStatusMessage as pt, WorkGraph as q, PartialFailureError as qt, DeployEngine as r, normalizeAwsError as rn, validateAssetBucketName as rt, extractDeploymentEventError as s, getDockerCmd as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, formatError as tn, getBootstrapMarkerKey as tt, renderStatefulReason as u, AssetManifestLoader as ut, IAMRoleProvider as v, resolveCaptureObservedState as vt, isTerminationProtectionPropagationError as w, CFN_TEMPLATE_BODY_LIMIT as wt, findActionableSilentDrops as x, resolveStateBucketWithDefaultAndSource as xt, collectInlinePolicyNamesManagedBySiblings as y, resolveSkipPrefix as yt, DagBuilder as z, ConfigError as zt };
+//# sourceMappingURL=deploy-engine-DOPBIRKR.js.map