@go-to-k/cdkd 0.257.0 → 0.257.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as BOOTSTRAP_MARKER_PREFIX, A as withRetry, At as AssemblyReader, B as TemplateParser, C as disableInstanceApiTermination, Ct as warnDeprecatedNoPrefixCliFlag, D as refStateLookupFromResource, Dt as findLargeInlineResources, E as cfnRefValueFromPhysicalId, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as WAFv2WebACLProvider, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as CloudControlProvider, St as resolveUseCdkBootstrapAssets, T as IntrinsicFunctionResolver, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as yellow, _t as resolveAutoAssetStorage, a as IMPLICIT_DELETE_DEPENDENCIES, at as buildDockerImage, b as ProviderRegistry, bt as resolveStateBucketWithDefault, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as runDockerForeground, d as formatResourceLine, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as bold, ft as Synthesizer, g as red, gt as resolveApp, h as green, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as isRetryableTransientError, k as importTagWalk, kt as expectedOwnerParam, l as isStatefulRecreateTargetSync, lt as runDockerStreaming, m as gray, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as computeImplicitDeleteEdges, ot as formatDockerLoginError, p as cyan, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as extractDeploymentEventError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as renderStatefulReason, ut as AssetManifestLoader, v as IAMRoleProvider, vt as resolveCaptureObservedState, w as isTerminationProtectionPropagationError, wt as CFN_TEMPLATE_BODY_LIMIT, x as findActionableSilentDrops, xt as resolveStateBucketWithDefaultAndSource, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-DOPBIRKR.js";
+import { $ as AssetModeResolver, $t as StackTerminationProtectionError, A as importTagWalk, At as expectedOwnerParam, B as DagBuilder, C as slowCcOperationTimeoutMs, Ct as resolveUseCdkBootstrapAssets, D as cfnRefValueFromPhysicalId, Dt as MIGRATE_TMP_PREFIX, E as IntrinsicFunctionResolver, Et as CFN_TEMPLATE_URL_LIMIT, F as normalizeAwsTagsToCfn, Ft as getAwsClients, G as shouldRetainResource, H as LockManager, Ht as LocalInvokeBuildError$1, I as resolveExplicitPhysicalId, It as resetAwsClients, J as WorkGraph, Jt as PartialFailureError, K as AssetPublisher, Kt as MissingCdkCliError, L as assertRegionMatch, Lt as setAwsClients, M as isRetryableTransientError, N as CDK_PATH_TAG, Nt as resolveBucketRegion, O as refStateLookupFromResource, Ot as findLargeInlineResources, P as matchesCdkPath, Pt as AwsClients, Q as rewriteTemplateAssetReferences, Qt as StackHasActiveImportsError, R as applyRoleArnIfSet, S as CloudControlProvider, St as resolveStateBucketWithDefaultAndSource, T as isTerminationProtectionPropagationError, Tt as CFN_TEMPLATE_BODY_LIMIT, U as S3StateBackend, Ut as LocalMigrateError, V as TemplateParser, W as rebuildClientForBucketRegion, Wt as LocalStartServiceError, X as createAssetRedirectResolver, Xt as ResourceTimeoutError, Y as buildAssetRedirectMap, Yt as ProvisioningError, Z as loadPublishableAssetManifest, Zt as ResourceUpdateNotSupportedError, _ as yellow, _t as resolveApp, a as IMPLICIT_DELETE_DEPENDENCIES, an as withErrorHandling, at as validateContainerRepoName, b as ProviderRegistry, bt as resolveSkipPrefix, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as getDockerCmd, d as formatResourceLine, dt as AssetManifestLoader, et as BOOTSTRAP_MARKER_PREFIX, f as bold, ft as getDockerImageBySourceHash, g as red, gt as getLegacyStateBucketName, h as green, ht as getDefaultStateBucketName, i as withResourceDeadline, in as normalizeAwsError, it as validateAssetBucketName, j as withRetry, jt as AssemblyReader, k as WAFv2WebACLProvider, kt as uploadCfnTemplate, l as isStatefulRecreateTargetSync, lt as runDockerForeground, m as gray, mt as synthesisStatusMessage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as getBootstrapMarkerKey, o as computeImplicitDeleteEdges, ot as buildDockerImage, p as cyan, pt as Synthesizer, q as stringifyValue, qt as NestedStackChildDirectDestroyError, r as DeployEngine, rt as parseBootstrapMarker, s as extractDeploymentEventError, st as formatDockerLoginError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as ensureAssetStorage, u as renderStatefulReason, ut as runDockerStreaming, v as IAMRoleProvider, vt as resolveAutoAssetStorage, w as disableInstanceApiTermination, wt as warnDeprecatedNoPrefixCliFlag, x as findActionableSilentDrops, xt as resolveStateBucketWithDefault, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveCaptureObservedState, z as DiffCalculator, zt as CdkdError } from "./deploy-engine-wmvXbyoB.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-6IZKZOKp.js";
+import { t as ASGProvider } from "./asg-provider-4KjJhMTY.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1899,7 +1899,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.257.0";
+	return "0.257.2";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -3945,9 +3945,11 @@ var IAMInstanceProfileProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.InstanceProfileName` → verify
 	*     via `GetInstanceProfile`.
-	*  2. `ListInstanceProfiles` paginator + match `aws:cdk:path` against the
-	*     `InstanceProfile.Tags` array returned inline (no separate
-	*     `ListInstanceProfileTags` call needed).
+	*  2. `ListInstanceProfiles` paginator + a per-candidate `GetInstanceProfile`
+	*     to read the tags, matched against `aws:cdk:path`. The list API does
+	*     NOT return tags (AWS documents this on the command) even though the
+	*     `InstanceProfile` type declares `Tags?`, so reading them off the
+	*     summary typechecks and never matches.
 	*
 	* IAM is global; this walks every instance profile in the account once.
 	*/
@@ -3963,20 +3965,32 @@ var IAMInstanceProfileProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.iamClient.send(new ListInstanceProfilesCommand({ ...marker && { Marker: marker } }));
-			for (const profile of list.InstanceProfiles ?? []) {
-				if (!profile.InstanceProfileName) continue;
-				if (matchesCdkPath(profile.Tags, input.cdkPath)) return {
-					physicalId: profile.InstanceProfileName,
-					attributes: {}
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.iamClient.send(new ListInstanceProfilesCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.InstanceProfiles,
+					nextMarker: list.IsTruncated ? list.Marker : void 0
 				};
-			}
-			marker = list.IsTruncated ? list.Marker : void 0;
-		} while (marker);
-		return null;
+			},
+			describe: async (profile) => {
+				if (!profile.InstanceProfileName) return void 0;
+				try {
+					return (await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: profile.InstanceProfileName }))).InstanceProfile;
+				} catch (err) {
+					if (err instanceof NoSuchEntityException) return void 0;
+					throw err;
+				}
+			},
+			tagsOf: (detail) => detail?.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.InstanceProfileName,
+			attributes: {}
+		};
 	}
 };
 
@@ -10379,25 +10393,35 @@ var LambdaLayerVersionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.lambdaClient.send(new ListLayersCommand({ ...marker && { Marker: marker } }));
-			for (const layer of list.Layers ?? []) {
-				if (!layer.LayerArn || !layer.LatestMatchingVersion?.LayerVersionArn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.lambdaClient.send(new ListLayersCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.Layers,
+					nextMarker: list.NextMarker
+				};
+			},
+			describe: async (layer) => {
+				if (!layer.LayerArn || !layer.LatestMatchingVersion?.LayerVersionArn) return void 0;
 				try {
-					if ((await this.lambdaClient.send(new ListTagsCommand({ Resource: layer.LayerArn }))).Tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: layer.LatestMatchingVersion.LayerVersionArn,
-						attributes: {}
-					};
+					return await this.lambdaClient.send(new ListTagsCommand({ Resource: layer.LayerArn }));
 				} catch (err) {
-					if (err instanceof ResourceNotFoundException) continue;
+					if (err instanceof ResourceNotFoundException) return void 0;
 					throw err;
 				}
-			}
-			marker = list.NextMarker;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.LatestMatchingVersion.LayerVersionArn,
+			attributes: {}
+		};
 	}
 };
 
@@ -13940,17 +13964,24 @@ var SecretsManagerSecretProvider = class {
 			if (err instanceof ResourceNotFoundException$3) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.smClient.send(new ListSecretsCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const s of list.SecretList ?? []) if (s.ARN && matchesCdkPath(s.Tags, input.cdkPath)) return {
-				physicalId: s.ARN,
-				attributes: {}
-			};
-			nextToken = list.NextToken;
-		} while (nextToken);
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.smClient.send(new ListSecretsCommand({ ...marker && { NextToken: marker } }));
+				return {
+					items: list.SecretList,
+					nextMarker: list.NextToken
+				};
+			},
+			describe: async (secret) => secret.ARN ? secret : void 0,
+			tagsOf: (secret) => secret.Tags
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.ARN,
+			attributes: {}
+		};
 	}
 };
 
@@ -32552,25 +32583,35 @@ var KMSProvider = class {
 			throw err;
 		}
 		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new ListKeysCommand({ ...marker && { Marker: marker } }));
-			for (const key of list.Keys ?? []) {
-				if (!key.KeyId) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListKeysCommand({ ...marker && { Marker: marker } }));
+				return {
+					items: list.Keys,
+					nextMarker: list.NextMarker
+				};
+			},
+			describe: async (key) => {
+				if (!key.KeyId) return void 0;
 				try {
-					const tagsResp = await this.getClient().send(new ListResourceTagsCommand({ KeyId: key.KeyId }));
-					for (const tag of tagsResp.Tags ?? []) if (tag.TagKey === "aws:cdk:path" && tag.TagValue === input.cdkPath) return {
-						physicalId: key.KeyId,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListResourceTagsCommand({ KeyId: key.KeyId }));
 				} catch (err) {
-					if (err.name === "AccessDeniedException" || err instanceof NotFoundException$2) continue;
+					if (err.name === "AccessDeniedException" || err instanceof NotFoundException$2) return void 0;
 					throw err;
 				}
-			}
-			marker = list.NextMarker;
-		} while (marker);
-		return null;
+			},
+			tagsOf: (tagsResp) => (tagsResp.Tags ?? []).map((t) => ({
+				Key: t.TagKey,
+				Value: t.TagValue
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.KeyId,
+			attributes: {}
+		};
 	}
 };
 
@@ -39687,28 +39728,42 @@ var CodeCommitRepositoryProvider = class {
 			if (err instanceof RepositoryDoesNotExistException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListRepositoriesCommand({ ...nextToken && { nextToken } }));
-			for (const repo of list.repositories ?? []) {
-				if (!repo.repositoryName) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListRepositoriesCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.repositories,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (repo) => {
+				if (!repo.repositoryName) return void 0;
 				let metadata;
 				try {
 					metadata = await this.getRepositoryMetadata(repo.repositoryName);
 				} catch (err) {
-					if (err instanceof RepositoryDoesNotExistException) continue;
+					if (err instanceof RepositoryDoesNotExistException) return void 0;
 					throw err;
 				}
-				if (!metadata?.Arn) continue;
-				if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-					physicalId: repo.repositoryName,
-					attributes: this.toAttributes(metadata)
+				if (!metadata?.Arn) return void 0;
+				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }));
+				return {
+					metadata,
+					tags: tagsResp.tags
 				};
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
-		return null;
+			},
+			tagsOf: (detail) => Object.entries(detail.tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.repositoryName,
+			attributes: this.toAttributes(match.detail.metadata)
+		};
 	}
 	/**
 	* Seed the repository's initial commit from the CFn `Code` property.
@@ -40038,16 +40093,23 @@ var DLMLifecyclePolicyProvider = class {
 			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const list = await this.getClient().send(new GetLifecyclePoliciesCommand({}));
-		for (const policy of list.Policies ?? []) {
-			if (!policy.PolicyId) continue;
-			if (policy.Tags?.["aws:cdk:path"] === input.cdkPath) return {
-				physicalId: policy.PolicyId,
-				attributes: {}
-			};
-		}
-		return null;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async () => {
+				return { items: (await this.getClient().send(new GetLifecyclePoliciesCommand({}))).Policies };
+			},
+			describe: async (policy) => policy.PolicyId ? policy : void 0,
+			tagsOf: (policy) => Object.entries(policy.Tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.PolicyId,
+			attributes: {}
+		};
 	}
 };
 
@@ -40285,25 +40347,35 @@ var S3VectorsProvider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let token;
-		do {
-			const list = await this.getClient().send(new ListVectorBucketsCommand({ ...token && { nextToken: token } }));
-			for (const bucket of list.vectorBuckets ?? []) {
-				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) continue;
+		const match = await importTagWalk({
+			cdkPath: input.cdkPath,
+			logicalId: input.logicalId,
+			listPage: async (marker) => {
+				const list = await this.getClient().send(new ListVectorBucketsCommand({ ...marker && { nextToken: marker } }));
+				return {
+					items: list.vectorBuckets,
+					nextMarker: list.nextToken
+				};
+			},
+			describe: async (bucket) => {
+				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) return void 0;
 				try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: bucket.vectorBucketName,
-						attributes: {}
-					};
+					return await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }));
 				} catch (err) {
-					if (this.isNotFoundError(err)) continue;
+					if (this.isNotFoundError(err)) return void 0;
 					throw err;
 				}
-			}
-			token = list.nextToken;
-		} while (token);
-		return null;
+			},
+			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
+				Key,
+				Value
+			}))
+		});
+		if (!match) return null;
+		return {
+			physicalId: match.summary.vectorBucketName,
+			attributes: {}
+		};
 	}
 	isNotFoundError(error) {
 		if (error instanceof Error) {
@@ -41829,7 +41901,8 @@ async function runDestroyForStack(stackName, state, ctx) {
 					const providerMinTimeoutMs = provider.getMinResourceTimeoutMs?.() ?? 0;
 					const warnAfterMs = ctx.resourceWarnAfterByType?.[resource.resourceType] ?? ctx.resourceWarnAfterMs ?? 3e5;
 					const globalTimeoutMs = ctx.resourceTimeoutMs ?? 18e5;
-					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, globalTimeoutMs);
+					const slowTypeMinTimeoutMs = slowCcOperationTimeoutMs(resource.resourceType, "DELETE");
+					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, slowTypeMinTimeoutMs, globalTimeoutMs);
 					await withResourceDeadline(async () => {
 						const maxAttempts = provider.disableOuterRetry ? 0 : 3;
 						let lastDeleteError;
@@ -44179,6 +44252,67 @@ async function confirmPrompt$6(prompt) {
 		rl.close();
 	}
 }
+/**
+* Flat `logicalId -> physicalId` map for ONE CloudFormation stack, or `null`
+* when no stack of that name exists.
+*
+* This is the non-recursive, non-throwing sibling of
+* {@link getCloudFormationResourceTree}, used by `cdkd import`'s auto mode as
+* a best-effort lookup (issue #1128). The distinction matters:
+*
+*   - the tree walk is for `--migrate-from-cloudformation`, where the stack is
+*     known to exist and nested children must be walked so each child's state
+*     can be written and the whole tree retired;
+*   - this one runs speculatively on every auto-mode import, so a missing
+*     stack is the NORMAL case (a cdkd-native stack has no CFn counterpart)
+*     and must return `null` rather than abort the import.
+*
+* NO failure is fatal. The lookup is an OPTIMIZATION: when it cannot answer,
+* the caller falls through to the per-provider lookups, which is exactly the
+* behavior that shipped before this function existed. Throwing would convert a
+* missed improvement into a hard failure — and it would do so precisely for the
+* users least likely to benefit. A cdkd-native stack has no CloudFormation
+* counterpart, so an operator whose IAM policy is scoped to cdkd's actual needs
+* (no `cloudformation:DescribeStackResources`) would see `AccessDenied` abort an
+* import that worked fine the day before.
+*
+* A missing stack is the expected case and logs at debug. Anything else logs a
+* WARN naming the cause, so a permissions gap or a throttle is visible rather
+* than silent — the user learns why the ids were not resolved, and still gets
+* the pre-existing behavior instead of an abort.
+*/
+async function tryGetCloudFormationResourceMap(stackName, cfnClient) {
+	const logger = getLogger();
+	let resp;
+	try {
+		resp = await cfnClient.send(new DescribeStackResourcesCommand({ StackName: stackName }));
+	} catch (err) {
+		if (isStackNotFoundError(err)) {
+			logger.debug(`No CloudFormation stack named '${stackName}'.`);
+			return null;
+		}
+		const reason = err instanceof Error ? err.message : String(err);
+		logger.warn(`Could not read CloudFormation stack '${stackName}' to resolve physical IDs (${reason}). Falling back to per-resource lookup; resources whose physical name CloudFormation generated may be reported as not found. Grant cloudformation:DescribeStackResources, or pass --resource <LogicalId>=<physicalId> for those resources.`);
+		return null;
+	}
+	const resources = /* @__PURE__ */ new Map();
+	for (const r of resp.StackResources ?? []) {
+		if (!r.LogicalResourceId || !r.PhysicalResourceId) continue;
+		resources.set(r.LogicalResourceId, r.PhysicalResourceId);
+	}
+	return resources;
+}
+/**
+* CloudFormation reports an unknown stack as a `ValidationError` whose message
+* carries "does not exist" — there is no dedicated exception type to catch.
+* Matching the message is therefore required, but it is kept narrow so an
+* unrelated ValidationError (a malformed stack name, say) still surfaces.
+*/
+function isStackNotFoundError(err) {
+	const name = err?.name;
+	const message = err?.message ?? "";
+	return name === "ValidationError" && /does not exist/i.test(message);
+}
 
 //#endregion
 //#region src/cli/commands/diff-recursive.ts
@@ -51870,30 +52004,13 @@ async function importCommand(stackArg, options) {
 		if (migrationCfnStackName) {
 			logger.info(`Resolving physical IDs from CloudFormation stack '${migrationCfnStackName}' (recursive)...`);
 			migrationTree = await getCloudFormationResourceTree(migrationCfnStackName, awsClients.cloudFormation);
-			const cfnMapping = migrationTree.resources;
-			let derived = 0;
-			let skippedNonImportable = 0;
-			let skippedNestedStackRow = 0;
-			for (const [logicalId, physicalId] of cfnMapping) {
-				if (!templateLogicalIds.has(logicalId)) {
-					skippedNonImportable++;
-					continue;
-				}
-				if (template.Resources[logicalId]?.Type === "AWS::CloudFormation::Stack") {
-					skippedNestedStackRow++;
-					continue;
-				}
-				if (!overrides.has(logicalId)) {
-					overrides.set(logicalId, physicalId);
-					derived++;
-				}
-			}
-			const overriddenByUser = cfnMapping.size - derived - skippedNonImportable - skippedNestedStackRow;
-			const detail = [];
-			if (overriddenByUser > 0) detail.push(`${overriddenByUser} already overridden by --resource`);
-			if (skippedNonImportable > 0) detail.push(`${skippedNonImportable} non-importable (e.g. CDKMetadata)`);
-			if (skippedNestedStackRow > 0) detail.push(`${skippedNestedStackRow} nested-stack row(s) handled separately`);
-			logger.info(`Resolved ${derived} physical ID(s) from CloudFormation` + (detail.length > 0 ? ` (${detail.join(", ")})` : ""));
+			const mergeStats = mergeCfnDerivedOverrides({
+				cfnMapping: migrationTree.resources,
+				template,
+				templateLogicalIds,
+				overrides
+			});
+			logger.info(`Resolved ${mergeStats.derived} physical ID(s) from CloudFormation` + formatCfnOverrideMergeDetail(mergeStats));
 			validateNestedStackShape(template, migrationTree, stackInfo.stackName, stackInfo.nestedTemplates ?? {});
 		}
 		let accountIdForNestedSynth;
@@ -51905,6 +52022,19 @@ async function importCommand(stackArg, options) {
 		}
 		const selectiveMode = overrides.size > 0 && !options.auto && !options.migrateFromCloudformation;
 		if (selectiveMode) logger.info(`Selective mode: only importing the ${overrides.size} resource(s) you listed (${[...overrides.keys()].join(", ")}). Pass --auto to also tag-import the rest.`);
+		if (!selectiveMode && !migrationCfnStackName) {
+			const cfnResources = await tryGetCloudFormationResourceMap(stackInfo.stackName, awsClients.cloudFormation);
+			if (cfnResources) {
+				const mergeStats = mergeCfnDerivedOverrides({
+					cfnMapping: cfnResources,
+					template,
+					templateLogicalIds,
+					overrides
+				});
+				if (mergeStats.derived > 0) logger.info(`Resolved ${mergeStats.derived} physical ID(s) from CloudFormation stack '${stackInfo.stackName}'. To adopt AND retire that stack, use --migrate-from-cloudformation.`);
+				else logger.debug(`CloudFormation stack '${stackInfo.stackName}' contributed no new physical IDs.`);
+			} else logger.debug(`No CloudFormation stack named '${stackInfo.stackName}' — resolving physical IDs per provider.`);
+		}
 		const existingResult = await stateBackend.getState(stackInfo.stackName, targetRegion);
 		const existingState = existingResult?.state ?? null;
 		const existingEtag = existingResult?.etag;
@@ -52018,6 +52148,79 @@ async function importCommand(stackArg, options) {
 	}
 }
 /**
+* Merge a CloudFormation-derived `logicalId -> physicalId` map into the run's
+* `overrides`, applying the three filters every CFn-derived seed needs, and
+* report what each filter dropped.
+*
+* The filters, in order:
+*   1. **Not an importable template resource** — CFn knows about sentinel rows
+*      like `AWS::CDK::Metadata` that cdkd silently skips on import. Merging
+*      those would make the typo-validation step reject them.
+*   2. **Nested-stack row** — the AWS-side physical ID of an
+*      `AWS::CloudFormation::Stack` row is the child stack ARN, which is NOT
+*      what we want as an import override. The parent's state entry carries
+*      the synthesized cdkd-local ARN (matching what `NestedStackProvider.create`
+*      writes at deploy time — design §6), populated by `importOne`'s
+*      short-circuit. Filtering here keeps the AWS ARN from overwriting it.
+*   3. **Already overridden** — user-supplied `--resource` /
+*      `--resource-mapping` entries are inserted before any CFn lookup and
+*      always win.
+*
+* Shared by all three CFn-derived seeding sites so a change to any filter
+* lands once: the `--migrate-from-cloudformation` root walk, the auto-mode
+* best-effort lookup (issue #1128), and the recursive nested-child walk.
+* The three differ only in their LOGGING, which stays at the call sites.
+*
+* **Second-order effect worth naming:** `overrides` is also consumed by
+* {@link substituteOverrideRefs}, so seeding it from CloudFormation means a
+* `{Ref: <X>}` in a resource's Properties pre-resolves to the CFn physical ID
+* before `provider.import()` sees it. That is intended — it is what makes
+* sub-resource providers (e.g. `SQSQueuePolicyProvider`, which reads
+* `properties.Queues[0]` as a literal queue URL) importable — but it is a
+* behavior beyond "resolve physical IDs", and it applies to every caller of
+* this helper, not just the migration path. See issue #1131.
+*
+* Mutates `overrides` in place; does not mutate `cfnMapping` or `template`.
+*/
+function mergeCfnDerivedOverrides(params) {
+	const { cfnMapping, template, templateLogicalIds, overrides } = params;
+	const stats = {
+		derived: 0,
+		skippedNonImportable: 0,
+		skippedNestedStackRow: 0,
+		overriddenByUser: 0
+	};
+	for (const [logicalId, physicalId] of cfnMapping) {
+		if (!templateLogicalIds.has(logicalId)) {
+			stats.skippedNonImportable++;
+			continue;
+		}
+		if (template.Resources[logicalId]?.Type === "AWS::CloudFormation::Stack") {
+			stats.skippedNestedStackRow++;
+			continue;
+		}
+		if (overrides.has(logicalId)) {
+			stats.overriddenByUser++;
+			continue;
+		}
+		overrides.set(logicalId, physicalId);
+		stats.derived++;
+	}
+	return stats;
+}
+/**
+* Render the human-readable breakdown of a {@link mergeCfnDerivedOverrides}
+* result — the parenthesized suffix of the `Resolved N physical ID(s)` line.
+* Returns `''` when nothing was dropped (no breakdown worth reporting).
+*/
+function formatCfnOverrideMergeDetail(stats) {
+	const detail = [];
+	if (stats.overriddenByUser > 0) detail.push(`${stats.overriddenByUser} already overridden by --resource`);
+	if (stats.skippedNonImportable > 0) detail.push(`${stats.skippedNonImportable} non-importable (e.g. CDKMetadata)`);
+	if (stats.skippedNestedStackRow > 0) detail.push(`${stats.skippedNestedStackRow} nested-stack row(s) handled separately`);
+	return detail.length > 0 ? ` (${detail.join(", ")})` : "";
+}
+/**
 * Recursively substitute `{Ref: <LogicalId>}` shapes in an arbitrary value
 * tree with the matching entry from `overrides`. Used to bridge the gap
 * between CDK synth's template (which carries raw intrinsics) and what a
@@ -52566,11 +52769,12 @@ async function importNestedStackChildrenRecursive(args) {
 			const childResources = collectImportableResources(childTemplate);
 			const childTemplateLogicalIds = new Set(childResources.map((r) => r.logicalId));
 			const childOverrides = /* @__PURE__ */ new Map();
-			for (const [logicalId, physicalId] of childTreeNode.resources) {
-				if (!childTemplateLogicalIds.has(logicalId)) continue;
-				if (childTemplate.Resources[logicalId]?.Type === "AWS::CloudFormation::Stack") continue;
-				childOverrides.set(logicalId, physicalId);
-			}
+			mergeCfnDerivedOverrides({
+				cfnMapping: childTreeNode.resources,
+				template: childTemplate,
+				templateLogicalIds: childTemplateLogicalIds,
+				overrides: childOverrides
+			});
 			const rows = [];
 			for (const { logicalId, resource } of childResources) {
 				if (resource.Type === "AWS::CloudFormation::Stack" && childTreeNode.nested.has(logicalId)) {
@@ -62172,7 +62376,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.2");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());