@go-to-k/cdkd 0.256.0 → 0.257.1

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as BOOTSTRAP_MARKER_PREFIX, A as refStateLookupFromResource, At as AssemblyReader, B as TemplateParser, C as ProviderRegistry, Ct as warnDeprecatedNoPrefixCliFlag, D as isTerminationProtectionPropagationError, Dt as findLargeInlineResources, E as disableInstanceApiTermination, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as IntrinsicFunctionResolver, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as isRetryableTransientError, St as resolveUseCdkBootstrapAssets, T as CloudControlProvider, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as yellow, _t as resolveAutoAssetStorage, a as IMPLICIT_DELETE_DEPENDENCIES, at as buildDockerImage, b as importTagWalk, bt as resolveStateBucketWithDefault, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as runDockerForeground, d as formatResourceLine, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as bold, ft as Synthesizer, g as red, gt as resolveApp, h as green, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as WAFv2WebACLProvider, k as cfnRefValueFromPhysicalId, kt as expectedOwnerParam, l as isStatefulRecreateTargetSync, lt as runDockerStreaming, m as gray, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as computeImplicitDeleteEdges, ot as formatDockerLoginError, p as cyan, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as extractDeploymentEventError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as renderStatefulReason, ut as AssetManifestLoader, v as IAMRoleProvider, vt as resolveCaptureObservedState, w as findActionableSilentDrops, wt as CFN_TEMPLATE_BODY_LIMIT, x as withRetry, xt as resolveStateBucketWithDefaultAndSource, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-vUgwldVH.js";
+import { $ as BOOTSTRAP_MARKER_PREFIX, A as withRetry, At as AssemblyReader, B as TemplateParser, C as disableInstanceApiTermination, Ct as warnDeprecatedNoPrefixCliFlag, D as refStateLookupFromResource, Dt as findLargeInlineResources, E as cfnRefValueFromPhysicalId, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as WAFv2WebACLProvider, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as CloudControlProvider, St as resolveUseCdkBootstrapAssets, T as IntrinsicFunctionResolver, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as yellow, _t as resolveAutoAssetStorage, a as IMPLICIT_DELETE_DEPENDENCIES, at as buildDockerImage, b as ProviderRegistry, bt as resolveStateBucketWithDefault, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as runDockerForeground, d as formatResourceLine, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as bold, ft as Synthesizer, g as red, gt as resolveApp, h as green, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as isRetryableTransientError, k as importTagWalk, kt as expectedOwnerParam, l as isStatefulRecreateTargetSync, lt as runDockerStreaming, m as gray, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as computeImplicitDeleteEdges, ot as formatDockerLoginError, p as cyan, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as extractDeploymentEventError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as renderStatefulReason, ut as AssetManifestLoader, v as IAMRoleProvider, vt as resolveCaptureObservedState, w as isTerminationProtectionPropagationError, wt as CFN_TEMPLATE_BODY_LIMIT, x as findActionableSilentDrops, xt as resolveStateBucketWithDefaultAndSource, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-DOPBIRKR.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DbIC4hWG.js";
+import { t as ASGProvider } from "./asg-provider-6IZKZOKp.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1899,7 +1899,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.256.0";
+	return "0.257.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -3945,9 +3945,11 @@ var IAMInstanceProfileProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.InstanceProfileName` → verify
 	*     via `GetInstanceProfile`.
-	*  2. `ListInstanceProfiles` paginator + match `aws:cdk:path` against the
-	*     `InstanceProfile.Tags` array returned inline (no separate
-	*     `ListInstanceProfileTags` call needed).
+	*  2. `ListInstanceProfiles` paginator + a per-candidate `GetInstanceProfile`
+	*     to read the tags, matched against `aws:cdk:path`. The list API does
+	*     NOT return tags (AWS documents this on the command) even though the
+	*     `InstanceProfile` type declares `Tags?`, so reading them off the
+	*     summary typechecks and never matches.
 	*
 	* IAM is global; this walks every instance profile in the account once.
 	*/
@@ -3963,20 +3965,32 @@ var IAMInstanceProfileProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.iamClient.send(new ListInstanceProfilesCommand({ ...marker && { Marker: marker } }));
-			for (const profile of list.InstanceProfiles ?? []) {
-				if (!profile.InstanceProfileName) continue;
-				if (matchesCdkPath(profile.Tags, input.cdkPath)) return {
-					physicalId: profile.InstanceProfileName,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.iamClient.send(new ListInstanceProfilesCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.InstanceProfiles,
+					nextMarker: list.IsTruncated ? list.Marker : void 0
 				};
-			}
-			marker = list.IsTruncated ? list.Marker : void 0;
-		} while (marker);
-		return null;
+			},
+			describe: async (profile) => {
+				if (!profile.InstanceProfileName) return void 0;
+				try {
+					return (await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: profile.InstanceProfileName }))).InstanceProfile;
+				} catch (err) {
+					if (err instanceof NoSuchEntityException) return void 0;
+					throw err;
+				}
+			},
+			tagsOf: (detail) => detail?.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.InstanceProfileName,
+			attributes: {}
+		};
 	}
 };
 
@@ -10379,25 +10393,35 @@ var LambdaLayerVersionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.lambdaClient.send(new ListLayersCommand({ ...marker && { Marker: marker } }));
-			for (const layer of list.Layers ?? []) {
-				if (!layer.LayerArn || !layer.LatestMatchingVersion?.LayerVersionArn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.lambdaClient.send(new ListLayersCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.Layers,
+					nextMarker: list.NextMarker
+				};
+			},
+			describe: async (layer) => {
+				if (!layer.LayerArn || !layer.LatestMatchingVersion?.LayerVersionArn) return void 0;
 				try {
-					if ((await this.lambdaClient.send(new ListTagsCommand({ Resource: layer.LayerArn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: layer.LatestMatchingVersion.LayerVersionArn,
-						attributes: {}
-					};
+					return await this.lambdaClient.send(new ListTagsCommand({ Resource: layer.LayerArn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException) continue;
+					if (err instanceof ResourceNotFoundException) return void 0;
 					throw err;
 				}
-			}
-			marker = list.NextMarker;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.LatestMatchingVersion.LayerVersionArn,
+			attributes: {}
+		};
 	}
 };
 
@@ -12698,24 +12722,33 @@ var DynamoDBGlobalTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let exclusiveStartTableName;
-		do {
-			const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...exclusiveStartTableName && { ExclusiveStartTableName: exclusiveStartTableName } }));
-			for (const name of list.TableNames ?? []) try {
-				const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-				if (!arn) continue;
-				if (matchesCdkPath((await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }))).Tags, input.cdkPath)) return {
-					physicalId: name,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
+				return {
+					items: list.TableNames,
+					nextMarker: list.LastEvaluatedTableName
 				};
-			} catch (err) {
-				if (err instanceof ResourceNotFoundException$1) continue;
-				throw err;
-			}
-			exclusiveStartTableName = list.LastEvaluatedTableName;
-		} while (exclusiveStartTableName);
-		return null;
+			},
+			describe: async (name) => {
+				try {
+					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
+					if (!arn) return void 0;
+					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
+				} catch (err) {
+					if (err instanceof ResourceNotFoundException$1) return void 0;
+					throw err;
+				}
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 	async waitForTableActive(tableName, logicalId, maxAttempts = 120) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -13931,17 +13964,24 @@ var SecretsManagerSecretProvider = class {
 			if (err instanceof ResourceNotFoundException$3) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.smClient.send(new ListSecretsCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const s of list.SecretList ?? []) if (s.ARN && matchesCdkPath(s.Tags, input.cdkPath)) return {
-				physicalId: s.ARN,
-				attributes: {}
-			};
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.smClient.send(new ListSecretsCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.SecretList,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (secret) => secret.ARN ? secret : void 0,
+			tagsOf: (secret) => secret.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.ARN,
+			attributes: {}
+		};
 	}
 };
 
@@ -14579,23 +14619,30 @@ var EventBridgeRuleProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.eventBridgeClient.send(new ListRulesCommand({
-				...eventBusName && { EventBusName: eventBusName },
-				...nextToken && { NextToken: nextToken }
-			}));
-			for (const rule of list.Rules ?? []) {
-				if (!rule.Arn) continue;
-				if (matchesCdkPath((await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: rule.Arn }))).Tags, input.cdkPath)) return {
-					physicalId: rule.Arn,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.eventBridgeClient.send(new ListRulesCommand({
+					...eventBusName && { EventBusName: eventBusName },
+					...marker && { NextToken: marker }
+				}));
+				return {
+					items: list.Rules,
+					nextMarker: list.NextToken
 				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			describe: async (rule) => {
+				if (!rule.Arn) return void 0;
+				return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: rule.Arn }));
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Arn,
+			attributes: {}
+		};
 	}
 	/**
 	* Extract rule name from an ARN
@@ -14880,25 +14927,32 @@ var EventBridgeBusProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.eventBridgeClient.send(new ListEventBusesCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const bus of list.EventBuses ?? []) {
-				if (!bus.Name || !bus.Arn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.eventBridgeClient.send(new ListEventBusesCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.EventBuses,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (bus) => {
+				if (!bus.Name || !bus.Arn) return void 0;
 				try {
-					if (matchesCdkPath((await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: bus.Arn }))).Tags, input.cdkPath)) return {
-						physicalId: bus.Name,
-						attributes: {}
-					};
+					return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: bus.Arn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$2) continue;
+					if (err instanceof ResourceNotFoundException$2) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 };
 
@@ -20449,25 +20503,32 @@ var CloudFrontDistributionProvider = class {
 			if (err instanceof NoSuchDistribution) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.cloudFrontClient.send(new ListDistributionsCommand({ ...marker && { Marker: marker } }));
-			for (const d of list.DistributionList?.Items ?? []) {
-				if (!d.Id || !d.ARN) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.cloudFrontClient.send(new ListDistributionsCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.DistributionList?.Items,
+					nextMarker: list.DistributionList?.IsTruncated ? list.DistributionList?.NextMarker : void 0
+				};
+			},
+			describe: async (d) => {
+				if (!d.Id || !d.ARN) return void 0;
 				try {
-					if (matchesCdkPath((await this.cloudFrontClient.send(new ListTagsForResourceCommand$3({ Resource: d.ARN }))).Tags?.Items, input.cdkPath)) return {
-						physicalId: d.Id,
-						attributes: {}
-					};
+					return await this.cloudFrontClient.send(new ListTagsForResourceCommand$3({ Resource: d.ARN }));
 				} catch (err) {
-					if (err instanceof NoSuchDistribution) continue;
+					if (err instanceof NoSuchDistribution) return void 0;
 					throw err;
 				}
-			}
-			marker = list.DistributionList?.IsTruncated ? list.DistributionList?.NextMarker : void 0;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags?.Items
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Id,
+			attributes: {}
+		};
 	}
 };
 
@@ -21468,10 +21529,10 @@ var StepFunctionsProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource <id>=<arn>` override → verify with `DescribeStateMachine`.
-	*  2. Walk `ListStateMachines` paginator → `ListTagsForResource(arn)`,
-	*     match the lowercase `key`/`value` `aws:cdk:path` tag (SFN uses
-	*     lowercase tags, so `matchesCdkPath` from import-helpers does not
-	*     apply directly).
+	*  2. Walk `ListStateMachines` → `ListTagsForResource(arn)` via the shared
+	*     `importTagWalk` helper. SFN returns lowercase `key`/`value` tags, so
+	*     `tagsOf` maps them to the `Key`/`Value` shape the walk's
+	*     `aws:cdk:path` matcher expects.
 	*
 	* SFN state machines do not expose a template-supplied name field
 	* usable as a stable physicalId — the physicalId is the ARN — so the
@@ -21489,21 +21550,30 @@ var StepFunctionsProvider = class {
 			if (err instanceof StateMachineDoesNotExist) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListStateMachinesCommand({ ...nextToken && { nextToken } }));
-			for (const sm of list.stateMachines ?? []) {
-				if (!sm.stateMachineArn) continue;
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: sm.stateMachineArn }));
-				if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
-					physicalId: sm.stateMachineArn,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListStateMachinesCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.stateMachines,
+					nextMarker: list.nextToken
 				};
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
-		return null;
+			},
+			describe: async (sm) => {
+				if (!sm.stateMachineArn) return void 0;
+				return await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: sm.stateMachineArn }));
+			},
+			tagsOf: (tagsResp) => (tagsResp.tags ?? []).map((t) => ({
+				Key: t.key,
+				Value: t.value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.stateMachineArn,
+			attributes: {}
+		};
 	}
 	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via SFN's
@@ -21541,14 +21611,6 @@ var StepFunctionsProvider = class {
 		}
 	}
 	/**
-	* Match SFN's lowercase `key`/`value` tag shape against the CDK path.
-	*/
-	tagsMatchCdkPath(tags, cdkPath) {
-		if (!tags) return false;
-		for (const t of tags) if (t.key === "aws:cdk:path" && t.value === cdkPath) return true;
-		return false;
-	}
-	/**
 	* Build the state-machine definition string from CDK properties.
 	*
 	* Precedence (mirrors CloudFormation): an inline `DefinitionString` /
@@ -27959,6 +28021,16 @@ var CognitoUserPoolProvider = class {
 	*  3. `aws:cdk:path` tag match via `ListUserPools` +
 	*     `ListTagsForResource(<arn>)`. Cognito's tag map uses the same
 	*     `Tags: { [key]: value }` shape as Lambda.
+	*
+	* Steps 2 and 3 share ONE `ListUserPools` walk (per candidate: name check
+	* first, then the two tag reads, only when a `cdkPath` is present), which
+	* runs through the shared `importTagWalk` helper so the N+1 read burst
+	* (DescribeUserPool for the ARN, then ListTagsForResource) is retried with
+	* exponential backoff when AWS throttles it instead of aborting the whole
+	* import. The name match is expressed to the walk as a synthetic
+	* `aws:cdk:path` tag carrying the walk's own lookup key, so a name-only
+	* template (no CDK path metadata) still resolves without any per-candidate
+	* API call, matching the previous inline loop.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -27972,33 +28044,48 @@ var CognitoUserPoolProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListUserPoolsCommand({
-				MaxResults: 60,
-				...nextToken && { NextToken: nextToken }
-			}));
-			for (const pool of list.UserPools ?? []) {
-				if (!pool.Id) continue;
-				if (desiredName && pool.Name === desiredName) return {
-					physicalId: pool.Id,
-					attributes: {}
+		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:cognito-user-pool-name:${desiredName}` : void 0);
+		/** Sentinel detail for a candidate matched by its user pool name. */
+		const NAME_MATCH = { nameMatch: true };
+		const match = await importTagWalk({
+			cdkPath: walkCdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListUserPoolsCommand({
+					MaxResults: 60,
+					...marker && { NextToken: marker }
+				}));
+				return {
+					items: list.UserPools,
+					nextMarker: list.NextToken
 				};
-				if (input.cdkPath) try {
+			},
+			describe: async (pool) => {
+				if (!pool.Id) return void 0;
+				if (desiredName && pool.Name === desiredName) return NAME_MATCH;
+				if (!input.cdkPath) return void 0;
+				try {
 					const arn = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }))).UserPool?.Arn;
-					if (!arn) continue;
-					if ((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceArn: arn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: pool.Id,
-						attributes: {}
-					};
+					if (!arn) return void 0;
+					return await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceArn: arn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$7) continue;
+					if (err instanceof ResourceNotFoundException$7) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (detail) => "nameMatch" in detail ? [{
+				Key: CDK_PATH_TAG,
+				Value: walkCdkPath
+			}] : Object.entries(detail.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Id,
+			attributes: {}
+		};
 	}
 };
 
@@ -32496,25 +32583,35 @@ var KMSProvider = class {
 			throw err;
 		}
 		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new ListKeysCommand({ ...marker && { Marker: marker } }));
-			for (const key of list.Keys ?? []) {
-				if (!key.KeyId) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListKeysCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.Keys,
+					nextMarker: list.NextMarker
+				};
+			},
+			describe: async (key) => {
+				if (!key.KeyId) return void 0;
 				try {
-					const tagsResp = await this.getClient().send(new ListResourceTagsCommand({ KeyId: key.KeyId }));
-					for (const tag of tagsResp.Tags ?? []) if (tag.TagKey === "aws:cdk:path" && tag.TagValue === input.cdkPath) return {
-						physicalId: key.KeyId,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListResourceTagsCommand({ KeyId: key.KeyId }));
 				} catch (err) {
-					if (err.name === "AccessDeniedException" || err instanceof NotFoundException$2) continue;
+					if (err.name === "AccessDeniedException" || err instanceof NotFoundException$2) return void 0;
 					throw err;
 				}
-			}
-			marker = list.NextMarker;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => (tagsResp.Tags ?? []).map((t) => ({
+				Key: t.TagKey,
+				Value: t.TagValue
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.KeyId,
+			attributes: {}
+		};
 	}
 };
 
@@ -32984,23 +33081,31 @@ var BudgetsBudgetProvider = class {
 			if (error instanceof NotFoundException$5) return null;
 			throw error;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await client.send(new DescribeBudgetsCommand({
-				AccountId: accountId,
-				...nextToken && { NextToken: nextToken }
-			}));
-			for (const budget of list.Budgets ?? []) {
-				if (!budget.BudgetName) continue;
-				if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$17({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }))).ResourceTags, input.cdkPath)) return {
-					physicalId: budget.BudgetName,
-					attributes: { Arn: this.budgetArn(accountId, budget.BudgetName) }
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await client.send(new DescribeBudgetsCommand({
+					AccountId: accountId,
+					...marker && { NextToken: marker }
+				}));
+				return {
+					items: list.Budgets,
+					nextMarker: list.NextToken
 				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			describe: async (budget) => {
+				if (!budget.BudgetName) return void 0;
+				return await client.send(new ListTagsForResourceCommand$17({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }));
+			},
+			tagsOf: (tags) => tags.ResourceTags
+		});
+		if (!match) return null;
+		const budgetName = match.summary.BudgetName;
+		return {
+			physicalId: budgetName,
+			attributes: { Arn: this.budgetArn(accountId, budgetName) }
+		};
 	}
 };
 
@@ -38200,19 +38305,25 @@ var FirehoseProvider = class {
 			if (err instanceof ResourceNotFoundException$10) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let exclusiveStartDeliveryStreamName;
-		while (true) {
-			const list = await this.getClient().send(new ListDeliveryStreamsCommand({ ...exclusiveStartDeliveryStreamName && { ExclusiveStartDeliveryStreamName: exclusiveStartDeliveryStreamName } }));
-			const names = list.DeliveryStreamNames ?? [];
-			for (const name of names) if (matchesCdkPath((await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: name }))).Tags, input.cdkPath)) return {
-				physicalId: name,
-				attributes: {}
-			};
-			if (!list.HasMoreDeliveryStreams || names.length === 0) break;
-			exclusiveStartDeliveryStreamName = names[names.length - 1];
-		}
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListDeliveryStreamsCommand({ ...marker && { ExclusiveStartDeliveryStreamName: marker } }));
+				const names = list.DeliveryStreamNames ?? [];
+				return {
+					items: names,
+					nextMarker: list.HasMoreDeliveryStreams && names.length > 0 ? names[names.length - 1] : void 0
+				};
+			},
+			describe: async (name) => await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: name })),
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary,
+			attributes: {}
+		};
 	}
 	/**
 	* Wait for a delivery stream to become ACTIVE.
@@ -38718,26 +38829,32 @@ var CloudTrailProvider = class {
 			if (err instanceof TrailNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListTrailsCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const trail of list.Trails ?? []) {
-				if (!trail.TrailARN || !trail.Name) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListTrailsCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.Trails,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (trail) => {
+				if (!trail.TrailARN || !trail.Name) return void 0;
 				try {
-					const list2 = (await this.getClient().send(new ListTagsCommand$1({ ResourceIdList: [trail.TrailARN] }))).ResourceTagList?.[0];
-					if (matchesCdkPath(list2?.TagsList, input.cdkPath)) return {
-						physicalId: trail.Name,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListTagsCommand$1({ ResourceIdList: [trail.TrailARN] }));
 				} catch (err) {
-					if (err instanceof TrailNotFoundException) continue;
+					if (err instanceof TrailNotFoundException) return void 0;
 					throw err;
 				}
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (tagsResp) => tagsResp.ResourceTagList?.[0]?.TagsList
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 };
 
@@ -39611,28 +39728,42 @@ var CodeCommitRepositoryProvider = class {
 			if (err instanceof RepositoryDoesNotExistException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListRepositoriesCommand({ ...nextToken && { nextToken } }));
-			for (const repo of list.repositories ?? []) {
-				if (!repo.repositoryName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListRepositoriesCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.repositories,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (repo) => {
+				if (!repo.repositoryName) return void 0;
 				let metadata;
 				try {
 					metadata = await this.getRepositoryMetadata(repo.repositoryName);
 				} catch (err) {
-					if (err instanceof RepositoryDoesNotExistException) continue;
+					if (err instanceof RepositoryDoesNotExistException) return void 0;
 					throw err;
 				}
-				if (!metadata?.Arn) continue;
-				if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-					physicalId: repo.repositoryName,
-					attributes: this.toAttributes(metadata)
+				if (!metadata?.Arn) return void 0;
+				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }));
+				return {
+					metadata,
+					tags: tagsResp.tags
 				};
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (detail) => Object.entries(detail.tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.repositoryName,
+			attributes: this.toAttributes(match.detail.metadata)
+		};
 	}
 	/**
 	* Seed the repository's initial commit from the CFn `Code` property.
@@ -39962,16 +40093,23 @@ var DLMLifecyclePolicyProvider = class {
 			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const list = await this.getClient().send(new GetLifecyclePoliciesCommand({}));
-		for (const policy of list.Policies ?? []) {
-			if (!policy.PolicyId) continue;
-			if (policy.Tags?.["aws:cdk:path"] === input.cdkPath) return {
-				physicalId: policy.PolicyId,
-				attributes: {}
-			};
-		}
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async () => {
+				return { items: (await this.getClient().send(new GetLifecyclePoliciesCommand({}))).Policies };
+			},
+			describe: async (policy) => policy.PolicyId ? policy : void 0,
+			tagsOf: (policy) => Object.entries(policy.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.PolicyId,
+			attributes: {}
+		};
 	}
 };
 
@@ -40209,25 +40347,35 @@ var S3VectorsProvider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let token;
-		do {
-			const list = await this.getClient().send(new ListVectorBucketsCommand({ ...token && { nextToken: token } }));
-			for (const bucket of list.vectorBuckets ?? []) {
-				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListVectorBucketsCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.vectorBuckets,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (bucket) => {
+				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) return void 0;
 				try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: bucket.vectorBucketName,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }));
 				} catch (err) {
-					if (this.isNotFoundError(err)) continue;
+					if (this.isNotFoundError(err)) return void 0;
 					throw err;
 				}
-			}
-			token = list.nextToken;
-		} while (token);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.vectorBucketName,
+			attributes: {}
+		};
 	}
 	isNotFoundError(error) {
 		if (error instanceof Error) {
@@ -40458,26 +40606,33 @@ var S3DirectoryBucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let token;
-		do {
-			const list = await this.s3Client.send(new ListDirectoryBucketsCommand({ ...token && { ContinuationToken: token } }));
-			for (const b of list.Buckets ?? []) {
-				if (!b.Name) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (token) => {
+				const list = await this.s3Client.send(new ListDirectoryBucketsCommand({ ...token && { ContinuationToken: token } }));
+				return {
+					items: list.Buckets,
+					nextMarker: list.ContinuationToken
+				};
+			},
+			describe: async (b) => {
+				if (!b.Name) return void 0;
 				try {
-					if (matchesCdkPath((await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }))).TagSet, input.cdkPath)) return {
-						physicalId: b.Name,
-						attributes: {}
-					};
+					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
 				} catch (err) {
 					const e = err;
-					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied") continue;
+					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied") return void 0;
 					throw err;
 				}
-			}
-			token = list.ContinuationToken;
-		} while (token);
-		return null;
+			},
+			tagsOf: (tagging) => tagging.TagSet
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.Name,
+			attributes: {}
+		};
 	}
 };
 
@@ -42510,28 +42665,36 @@ var ACMCertificateProvider = class {
 				throw err;
 			}
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.acmClient.send(new ListCertificatesCommand({ ...nextToken ? { NextToken: nextToken } : {} }));
-			for (const summary of list.CertificateSummaryList ?? []) {
-				if (!summary.CertificateArn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.acmClient.send(new ListCertificatesCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.CertificateSummaryList,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (summary) => {
+				if (!summary.CertificateArn) return void 0;
 				try {
-					if (matchesCdkPath((await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: summary.CertificateArn }))).Tags, input.cdkPath)) return {
-						physicalId: summary.CertificateArn,
-						attributes: {
-							Arn: summary.CertificateArn,
-							CertificateArn: summary.CertificateArn
-						}
-					};
+					return await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: summary.CertificateArn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException$6) continue;
+					if (err instanceof ResourceNotFoundException$6) return void 0;
 					throw err;
 				}
+			},
+			tagsOf: (tagsResp) => tagsResp.Tags
+		});
+		if (!match) return null;
+		const arn = match.summary.CertificateArn;
+		return {
+			physicalId: arn,
+			attributes: {
+				Arn: arn,
+				CertificateArn: arn
 			}
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+		};
 	}
 	/**
 	* Poll `DescribeCertificate` until status === `ISSUED`. On the FIRST poll
@@ -44088,6 +44251,67 @@ async function confirmPrompt$6(prompt) {
 		rl.close();
 	}
 }
+/**
+* Flat `logicalId -> physicalId` map for ONE CloudFormation stack, or `null`
+* when no stack of that name exists.
+*
+* This is the non-recursive, non-throwing sibling of
+* {@link getCloudFormationResourceTree}, used by `cdkd import`'s auto mode as
+* a best-effort lookup (issue #1128). The distinction matters:
+*
+*   - the tree walk is for `--migrate-from-cloudformation`, where the stack is
+*     known to exist and nested children must be walked so each child's state
+*     can be written and the whole tree retired;
+*   - this one runs speculatively on every auto-mode import, so a missing
+*     stack is the NORMAL case (a cdkd-native stack has no CFn counterpart)
+*     and must return `null` rather than abort the import.
+*
+* NO failure is fatal. The lookup is an OPTIMIZATION: when it cannot answer,
+* the caller falls through to the per-provider lookups, which is exactly the
+* behavior that shipped before this function existed. Throwing would convert a
+* missed improvement into a hard failure — and it would do so precisely for the
+* users least likely to benefit. A cdkd-native stack has no CloudFormation
+* counterpart, so an operator whose IAM policy is scoped to cdkd's actual needs
+* (no `cloudformation:DescribeStackResources`) would see `AccessDenied` abort an
+* import that worked fine the day before.
+*
+* A missing stack is the expected case and logs at debug. Anything else logs a
+* WARN naming the cause, so a permissions gap or a throttle is visible rather
+* than silent — the user learns why the ids were not resolved, and still gets
+* the pre-existing behavior instead of an abort.
+*/
+async function tryGetCloudFormationResourceMap(stackName, cfnClient) {
+	const logger = getLogger();
+	let resp;
+	try {
+		resp = await cfnClient.send(new DescribeStackResourcesCommand({ StackName: stackName }));
+	} catch (err) {
+		if (isStackNotFoundError(err)) {
+			logger.debug(`No CloudFormation stack named '${stackName}'.`);
+			return null;
+		}
+		const reason = err instanceof Error ? err.message : String(err);
+		logger.warn(`Could not read CloudFormation stack '${stackName}' to resolve physical IDs (${reason}). Falling back to per-resource lookup; resources whose physical name CloudFormation generated may be reported as not found. Grant cloudformation:DescribeStackResources, or pass --resource <LogicalId>=<physicalId> for those resources.`);
+		return null;
+	}
+	const resources = /* @__PURE__ */ new Map();
+	for (const r of resp.StackResources ?? []) {
+		if (!r.LogicalResourceId || !r.PhysicalResourceId) continue;
+		resources.set(r.LogicalResourceId, r.PhysicalResourceId);
+	}
+	return resources;
+}
+/**
+* CloudFormation reports an unknown stack as a `ValidationError` whose message
+* carries "does not exist" — there is no dedicated exception type to catch.
+* Matching the message is therefore required, but it is kept narrow so an
+* unrelated ValidationError (a malformed stack name, say) still surfaces.
+*/
+function isStackNotFoundError(err) {
+	const name = err?.name;
+	const message = err?.message ?? "";
+	return name === "ValidationError" && /does not exist/i.test(message);
+}
 
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
@@ -51814,6 +52038,21 @@ async function importCommand(stackArg, options) {
 		}
 		const selectiveMode = overrides.size > 0 && !options.auto && !options.migrateFromCloudformation;
 		if (selectiveMode) logger.info(`Selective mode: only importing the ${overrides.size} resource(s) you listed (${[...overrides.keys()].join(", ")}). Pass --auto to also tag-import the rest.`);
+		if (!selectiveMode && !migrationCfnStackName) {
+			const cfnResources = await tryGetCloudFormationResourceMap(stackInfo.stackName, awsClients.cloudFormation);
+			if (cfnResources) {
+				let derived = 0;
+				for (const [logicalId, physicalId] of cfnResources) {
+					if (!templateLogicalIds.has(logicalId)) continue;
+					if (template.Resources[logicalId]?.Type === "AWS::CloudFormation::Stack") continue;
+					if (overrides.has(logicalId)) continue;
+					overrides.set(logicalId, physicalId);
+					derived++;
+				}
+				if (derived > 0) logger.info(`Resolved ${derived} physical ID(s) from CloudFormation stack '${stackInfo.stackName}'. To adopt AND retire that stack, use --migrate-from-cloudformation.`);
+				else logger.debug(`CloudFormation stack '${stackInfo.stackName}' contributed no new physical IDs.`);
+			} else logger.debug(`No CloudFormation stack named '${stackInfo.stackName}' — resolving physical IDs per provider.`);
+		}
 		const existingResult = await stateBackend.getState(stackInfo.stackName, targetRegion);
 		const existingState = existingResult?.state ?? null;
 		const existingEtag = existingResult?.etag;
@@ -62081,7 +62320,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.256.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());