@go-to-k/cdkd 0.257.1 → 0.257.3

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-import { $ as BOOTSTRAP_MARKER_PREFIX, A as withRetry, At as AssemblyReader, B as TemplateParser, C as disableInstanceApiTermination, Ct as warnDeprecatedNoPrefixCliFlag, D as refStateLookupFromResource, Dt as findLargeInlineResources, E as cfnRefValueFromPhysicalId, Et as MIGRATE_TMP_PREFIX, F as resolveExplicitPhysicalId, Ft as resetAwsClients, G as AssetPublisher, Gt as MissingCdkCliError, H as S3StateBackend, Ht as LocalMigrateError, I as assertRegionMatch, It as setAwsClients, J as buildAssetRedirectMap, Jt as ProvisioningError, K as stringifyValue, Kt as NestedStackChildDirectDestroyError, L as applyRoleArnIfSet, M as CDK_PATH_TAG, Mt as resolveBucketRegion, N as matchesCdkPath, Nt as AwsClients, O as WAFv2WebACLProvider, Ot as uploadCfnTemplate, P as normalizeAwsTagsToCfn, Pt as getAwsClients, Q as AssetModeResolver, Qt as StackTerminationProtectionError, R as DiffCalculator, Rt as CdkdError, S as CloudControlProvider, St as resolveUseCdkBootstrapAssets, T as IntrinsicFunctionResolver, Tt as CFN_TEMPLATE_URL_LIMIT, U as rebuildClientForBucketRegion, Ut as LocalStartServiceError, V as LockManager, Vt as LocalInvokeBuildError$1, W as shouldRetainResource, X as loadPublishableAssetManifest, Xt as ResourceUpdateNotSupportedError, Y as createAssetRedirectResolver, Yt as ResourceTimeoutError, Z as rewriteTemplateAssetReferences, Zt as StackHasActiveImportsError, _ as yellow, _t as resolveAutoAssetStorage, a as IMPLICIT_DELETE_DEPENDENCIES, at as buildDockerImage, b as ProviderRegistry, bt as resolveStateBucketWithDefault, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as runDockerForeground, d as formatResourceLine, dt as getDockerImageBySourceHash, et as ensureAssetStorage, f as bold, ft as Synthesizer, g as red, gt as resolveApp, h as green, ht as getLegacyStateBucketName, i as withResourceDeadline, in as withErrorHandling, it as validateContainerRepoName, j as isRetryableTransientError, k as importTagWalk, kt as expectedOwnerParam, l as isStatefulRecreateTargetSync, lt as runDockerStreaming, m as gray, mt as getDefaultStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as parseBootstrapMarker, o as computeImplicitDeleteEdges, ot as formatDockerLoginError, p as cyan, pt as synthesisStatusMessage, q as WorkGraph, qt as PartialFailureError, r as DeployEngine, rn as normalizeAwsError, rt as validateAssetBucketName, s as extractDeploymentEventError, st as getDockerCmd, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as getBootstrapMarkerKey, u as renderStatefulReason, ut as AssetManifestLoader, v as IAMRoleProvider, vt as resolveCaptureObservedState, w as isTerminationProtectionPropagationError, wt as CFN_TEMPLATE_BODY_LIMIT, x as findActionableSilentDrops, xt as resolveStateBucketWithDefaultAndSource, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveSkipPrefix, z as DagBuilder } from "./deploy-engine-DOPBIRKR.js";
+import { $ as AssetModeResolver, $t as StackTerminationProtectionError, A as importTagWalk, At as expectedOwnerParam, B as DagBuilder, C as slowCcOperationTimeoutMs, Ct as resolveUseCdkBootstrapAssets, D as cfnRefValueFromPhysicalId, Dt as MIGRATE_TMP_PREFIX, E as IntrinsicFunctionResolver, Et as CFN_TEMPLATE_URL_LIMIT, F as normalizeAwsTagsToCfn, Ft as getAwsClients, G as shouldRetainResource, H as LockManager, Ht as LocalInvokeBuildError$1, I as resolveExplicitPhysicalId, It as resetAwsClients, J as WorkGraph, Jt as PartialFailureError, K as AssetPublisher, Kt as MissingCdkCliError, L as assertRegionMatch, Lt as setAwsClients, M as isRetryableTransientError, N as CDK_PATH_TAG, Nt as resolveBucketRegion, O as refStateLookupFromResource, Ot as findLargeInlineResources, P as matchesCdkPath, Pt as AwsClients, Q as rewriteTemplateAssetReferences, Qt as StackHasActiveImportsError, R as applyRoleArnIfSet, S as CloudControlProvider, St as resolveStateBucketWithDefaultAndSource, T as isTerminationProtectionPropagationError, Tt as CFN_TEMPLATE_BODY_LIMIT, U as S3StateBackend, Ut as LocalMigrateError, V as TemplateParser, W as rebuildClientForBucketRegion, Wt as LocalStartServiceError, X as createAssetRedirectResolver, Xt as ResourceTimeoutError, Y as buildAssetRedirectMap, Yt as ProvisioningError, Z as loadPublishableAssetManifest, Zt as ResourceUpdateNotSupportedError, _ as yellow, _t as resolveApp, a as IMPLICIT_DELETE_DEPENDENCIES, an as withErrorHandling, at as validateContainerRepoName, b as ProviderRegistry, bt as resolveSkipPrefix, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as getDockerCmd, d as formatResourceLine, dt as AssetManifestLoader, et as BOOTSTRAP_MARKER_PREFIX, f as bold, ft as getDockerImageBySourceHash, g as red, gt as getLegacyStateBucketName, h as green, ht as getDefaultStateBucketName, i as withResourceDeadline, in as normalizeAwsError, it as validateAssetBucketName, j as withRetry, jt as AssemblyReader, k as WAFv2WebACLProvider, kt as uploadCfnTemplate, l as isStatefulRecreateTargetSync, lt as runDockerForeground, m as gray, mt as synthesisStatusMessage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as getBootstrapMarkerKey, o as computeImplicitDeleteEdges, ot as buildDockerImage, p as cyan, pt as Synthesizer, q as stringifyValue, qt as NestedStackChildDirectDestroyError, r as DeployEngine, rt as parseBootstrapMarker, s as extractDeploymentEventError, st as formatDockerLoginError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as ensureAssetStorage, u as renderStatefulReason, ut as runDockerStreaming, v as IAMRoleProvider, vt as resolveAutoAssetStorage, w as disableInstanceApiTermination, wt as warnDeprecatedNoPrefixCliFlag, x as findActionableSilentDrops, xt as resolveStateBucketWithDefault, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveCaptureObservedState, z as DiffCalculator, zt as CdkdError } from "./deploy-engine-0U3bYBq4.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-6IZKZOKp.js";
+import { t as ASGProvider } from "./asg-provider-Co34HfIH.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
-import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, ListUserTagsCommand, ListUsersCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
+import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, ListQueuesCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListFunctionsCommand, ListLayersCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
@@ -28,7 +28,7 @@ import * as path from "node:path";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
-import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListHostedZonesCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
+import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand } from "@aws-sdk/client-elastic-load-balancing-v2";
 import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
@@ -42,30 +42,30 @@ import readline from "node:readline/promises";
 import { writeFileSync as writeFileSync$1 } from "fs";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
-import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
+import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
 import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListStateMachinesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListClustersCommand, ListServicesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$12, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
-import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$17, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
-import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand as ListClustersCommand$1, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
+import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import AdmZip from "adm-zip";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$21, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1899,7 +1899,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.257.1";
+	return "0.257.3";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -4825,13 +4825,10 @@ var IAMUserGroupProvider = class {
 	/**
 	* Adopt an existing IAM user / group / user-to-group addition into cdkd state.
 	*
-	*  - **AWS::IAM::User**: tag-based auto-lookup via `ListUsers` +
-	*    `ListUserTags`. Falls back to `--resource` override or
-	*    `Properties.UserName`.
-	*  - **AWS::IAM::Group**: explicit-override only. IAM groups are not
-	*    taggable (no `ListGroupTags` API), so tag-based auto-lookup is not
-	*    possible. Caller can still pass `Properties.GroupName` or
-	*    `--resource` to verify and adopt by name.
+	*  - **AWS::IAM::User**: `--resource` override or `Properties.UserName`,
+	*    verified via `GetUser`.
+	*  - **AWS::IAM::Group**: `--resource` override or `Properties.GroupName`,
+	*    verified via `GetGroup`.
 	*  - **AWS::IAM::UserToGroupAddition**: explicit-override only. Has no
 	*    AWS-side identity beyond the (group, users) attachment itself.
 	*/
@@ -4855,24 +4852,6 @@ var IAMUserGroupProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.iamClient.send(new ListUsersCommand({ ...marker && { Marker: marker } }));
-			for (const user of list.Users ?? []) {
-				if (!user.UserName) continue;
-				try {
-					if (matchesCdkPath((await this.iamClient.send(new ListUserTagsCommand({ UserName: user.UserName }))).Tags, input.cdkPath)) return {
-						physicalId: user.UserName,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof NoSuchEntityException) continue;
-					throw err;
-				}
-			}
-			marker = list.IsTruncated ? list.Marker : void 0;
-		} while (marker);
 		return null;
 	}
 	async importGroup(input) {
@@ -16721,55 +16700,16 @@ var EC2Provider = class {
 	* is rule-level), and the typical adoption story is "find the VPC,
 	* cdkd reconstructs the rest at deploy time".
 	*
-	* EC2 supports `Filters: [{Name: 'tag:aws:cdk:path', Values: [path]}]`
-	* directly on `Describe*`, so the lookup is one API call per type.
+	* There is no `aws:cdk:path` tag lookup: AWS rejects `aws:`-prefixed tag
+	* writes, so that tag never exists on a real resource and a
+	* `Filters: [{Name: 'tag:aws:cdk:path', ...}]` `Describe*` could never
+	* match (issue #1134). Auto-mode import resolves ids from
+	* CloudFormation's `DescribeStackResources` or the template's
+	* physical-name property instead.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) return this.verifyExplicit(input.resourceType, input.knownPhysicalId);
-		if (!input.cdkPath) return null;
-		const tagFilter = {
-			Name: `tag:${CDK_PATH_TAG}`,
-			Values: [input.cdkPath]
-		};
-		try {
-			switch (input.resourceType) {
-				case "AWS::EC2::VPC": {
-					const vpc = (await this.ec2Client.send(new DescribeVpcsCommand({ Filters: [tagFilter] }))).Vpcs?.[0];
-					return vpc?.VpcId ? {
-						physicalId: vpc.VpcId,
-						attributes: {}
-					} : null;
-				}
-				case "AWS::EC2::Subnet": {
-					const subnet = (await this.ec2Client.send(new DescribeSubnetsCommand({ Filters: [tagFilter] }))).Subnets?.[0];
-					return subnet?.SubnetId ? {
-						physicalId: subnet.SubnetId,
-						attributes: {}
-					} : null;
-				}
-				case "AWS::EC2::SecurityGroup": {
-					const sg = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ Filters: [tagFilter] }))).SecurityGroups?.[0];
-					return sg?.GroupId ? {
-						physicalId: sg.GroupId,
-						attributes: {}
-					} : null;
-				}
-				case "AWS::EC2::NatGateway": {
-					const gw = (await this.ec2Client.send(new DescribeNatGatewaysCommand({ Filter: [{
-						Name: `tag:${CDK_PATH_TAG}`,
-						Values: [input.cdkPath]
-					}] }))).NatGateways?.find((g) => g.State !== "deleted" && g.State !== "deleting");
-					return gw?.NatGatewayId ? {
-						physicalId: gw.NatGatewayId,
-						attributes: {}
-					} : null;
-				}
-				default: return null;
-			}
-		} catch (error) {
-			if (this.isNotFoundError(error)) return null;
-			throw error;
-		}
+		return null;
 	}
 	/**
 	* Read the AWS-current EC2 networking resource configuration in
@@ -19298,8 +19238,11 @@ var ApiGatewayV2Provider = class {
 	/**
 	* Adopt an existing API Gateway V2 resource into cdkd state.
 	*
-	* `AWS::ApiGatewayV2::Api` supports full tag-based auto-lookup via
-	* `GetApis` (`Tags` is a `Record<string,string>` map on each item).
+	* `AWS::ApiGatewayV2::Api` resolves an explicit `--resource` override
+	* (verified via `GetApi`). There is no `aws:cdk:path` tag walk — AWS
+	* rejects `aws:`-prefixed tag writes, so that tag never exists on a real
+	* resource (issue #1134); auto-mode import resolves ids from
+	* CloudFormation's `DescribeStackResources` instead.
 	*
 	* Sub-resources (`Stage`, `Integration`, `Route`, `Authorizer`) are
 	* scoped under a parent `ApiId`, and their physical ids are not
@@ -19327,19 +19270,6 @@ var ApiGatewayV2Provider = class {
 			if (err instanceof NotFoundException$3) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new GetApisCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const api of list.Items ?? []) {
-				if (!api.ApiId) continue;
-				if (api.Tags?.["aws:cdk:path"] === input.cdkPath) return {
-					physicalId: api.ApiId,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
 	/**
@@ -22759,9 +22689,8 @@ var ECSProvider = class {
 	* Adopt an existing ECS resource into cdkd state.
 	*
 	* Supported types: `AWS::ECS::Cluster`, `AWS::ECS::Service`,
-	* `AWS::ECS::TaskDefinition`. ECS uses lowercase `key`/`value` tags
-	* (vs the standard CFn `Key`/`Value`), so the standard
-	* `matchesCdkPath` helper doesn't apply — match the tag manually.
+	* `AWS::ECS::TaskDefinition` — all explicit-override only (see the
+	* per-branch notes on why the `aws:cdk:path` tag walk was removed).
 	*
 	* Service has a composite physical id of `<clusterArn>|<serviceName>`
 	* (the form ECSProvider uses internally for mutation operations),
@@ -22788,19 +22717,6 @@ var ECSProvider = class {
 			if (this.isClusterNotFoundException(err) || this.isServiceNotFoundException(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListClustersCommand({ ...nextToken && { nextToken } }));
-			for (const arn of list.clusterArns ?? []) {
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ resourceArn: arn }));
-				if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
-					physicalId: arn.substring(arn.lastIndexOf("/") + 1),
-					attributes: {}
-				};
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
 		return null;
 	}
 	async importService(input) {
@@ -22808,29 +22724,6 @@ var ECSProvider = class {
 			physicalId: input.knownPhysicalId,
 			attributes: {}
 		};
-		if (!input.cdkPath) return null;
-		let clusterToken;
-		do {
-			const clusterList = await this.getClient().send(new ListClustersCommand({ ...clusterToken && { nextToken: clusterToken } }));
-			for (const clusterArn of clusterList.clusterArns ?? []) {
-				let svcToken;
-				do {
-					const svcList = await this.getClient().send(new ListServicesCommand({
-						cluster: clusterArn,
-						...svcToken && { nextToken: svcToken }
-					}));
-					for (const svcArn of svcList.serviceArns ?? []) {
-						const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ resourceArn: svcArn }));
-						if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
-							physicalId: `${clusterArn}|${svcArn.substring(svcArn.lastIndexOf("/") + 1)}`,
-							attributes: {}
-						};
-					}
-					svcToken = svcList.nextToken;
-				} while (svcToken);
-			}
-			clusterToken = clusterList.nextToken;
-		} while (clusterToken);
 		return null;
 	}
 	async importTaskDefinition(input) {
@@ -22846,11 +22739,6 @@ var ECSProvider = class {
 		}
 		return null;
 	}
-	tagsMatchCdkPath(tags, cdkPath) {
-		if (!tags) return false;
-		for (const t of tags) if (t.key === "aws:cdk:path" && t.value === cdkPath) return true;
-		return false;
-	}
 };
 
 //#endregion
@@ -23521,16 +23409,12 @@ var ELBv2Provider = class {
 	/**
 	* Adopt an existing ELBv2 LoadBalancer or TargetGroup into cdkd state.
 	*
-	* Lookup order:
-	*  1. `--resource <id>=<arn>` override → verify with `DescribeLoadBalancers`
-	*     or `DescribeTargetGroups`.
-	*  2. Walk `DescribeLoadBalancers` / `DescribeTargetGroups` paginators →
-	*     batch-fetch tags for each ARN with `DescribeTags(ResourceArns)`
-	*     and match `aws:cdk:path` (standard `Key`/`Value` Tag[] shape).
+	* Lookup: `--resource <id>=<arn>` override → verify with
+	* `DescribeLoadBalancers` or `DescribeTargetGroups`. Without an override
+	* the resource is reported as not-found.
 	*
-	* Listener is not auto-importable (no template-supplied stable
-	* identifier and no convenient tag-by-LB-context shortcut); use
-	* `--resource <listenerId>=<arn>` for those.
+	* Listener is likewise not auto-importable (no template-supplied stable
+	* identifier); use `--resource <listenerId>=<arn>` for those.
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -23556,21 +23440,6 @@ var ELBv2Provider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeLoadBalancersCommand({ ...marker && { Marker: marker } }));
-			const arns = (list.LoadBalancers ?? []).map((lb) => lb.LoadBalancerArn).filter((arn) => Boolean(arn));
-			for (let i = 0; i < arns.length; i += 20) {
-				const batch = arns.slice(i, i + 20);
-				const tagsResp = await this.getClient().send(new DescribeTagsCommand({ ResourceArns: batch }));
-				for (const td of tagsResp.TagDescriptions ?? []) if (td.ResourceArn && matchesCdkPath(td.Tags, input.cdkPath)) return {
-					physicalId: td.ResourceArn,
-					attributes: {}
-				};
-			}
-			marker = list.NextMarker;
-		} while (marker);
 		return null;
 	}
 	async importTargetGroup(input) {
@@ -23584,21 +23453,6 @@ var ELBv2Provider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeTargetGroupsCommand({ ...marker && { Marker: marker } }));
-			const arns = (list.TargetGroups ?? []).map((tg) => tg.TargetGroupArn).filter((arn) => Boolean(arn));
-			for (let i = 0; i < arns.length; i += 20) {
-				const batch = arns.slice(i, i + 20);
-				const tagsResp = await this.getClient().send(new DescribeTagsCommand({ ResourceArns: batch }));
-				for (const td of tagsResp.TagDescriptions ?? []) if (td.ResourceArn && matchesCdkPath(td.Tags, input.cdkPath)) return {
-					physicalId: td.ResourceArn,
-					attributes: {}
-				};
-			}
-			marker = list.NextMarker;
-		} while (marker);
 		return null;
 	}
 	/**
@@ -24185,11 +24039,11 @@ var RDSProvider = class {
 	* Adopt an existing RDS resource into cdkd state.
 	*
 	* Supported types: `AWS::RDS::DBInstance`, `AWS::RDS::DBCluster`,
-	* `AWS::RDS::DBSubnetGroup`. Identifier name properties (`DBInstance
-	* Identifier` / `DBClusterIdentifier` / `DBSubnetGroupName`) are
-	* usually present in CDK templates; fall back to `aws:cdk:path` tag
-	* lookup via the corresponding `Describe*` + `ListTagsForResource`
-	* pair otherwise.
+	* `AWS::RDS::DBSubnetGroup`. Resolution is by identifier name property
+	* (`DBInstanceIdentifier` / `DBClusterIdentifier` / `DBSubnetGroupName`),
+	* which is usually present in CDK templates, verified against the
+	* corresponding `Describe*` call. A resource without one needs an
+	* explicit `--resource` override (issue #1134).
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -24335,19 +24189,6 @@ var RDSProvider = class {
 			if (err.name === "DBInstanceNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBInstancesCommand({ ...marker && { Marker: marker } }));
-			for (const inst of list.DBInstances ?? []) {
-				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
-					physicalId: inst.DBInstanceIdentifier,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importDBCluster(input) {
@@ -24362,19 +24203,6 @@ var RDSProvider = class {
 			if (err.name === "DBClusterNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBClustersCommand({ ...marker && { Marker: marker } }));
-			for (const c of list.DBClusters ?? []) {
-				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
-					physicalId: c.DBClusterIdentifier,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importDBSubnetGroup(input) {
@@ -24389,19 +24217,6 @@ var RDSProvider = class {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand({ ...marker && { Marker: marker } }));
-			for (const sg of list.DBSubnetGroups ?? []) {
-				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
-					physicalId: sg.DBSubnetGroupName,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 };
@@ -24439,8 +24254,9 @@ const POLL_TIMEOUT_MS$1 = 1800 * 1e3;
 *   point is treated as idempotent success (region-match-gated).
 * - `getAttribute`: `DescribeDBProxies` for `Endpoint` / `DBProxyArn` /
 *   `VpcId`, cached per `(physicalId, attribute)`.
-* - `import`: explicit `--resource` override OR auto-lookup via
-*   `DescribeDBProxies` + `ListTagsForResource` matching `aws:cdk:path`.
+* - `import`: explicit `--resource` override or the template's
+*   `DBProxyName` property (issue #1134 removed the unreachable
+*   `aws:cdk:path` tag walk).
 *
 * **physicalId** = DBProxyName (matches CFn `primaryIdentifier`).
 */
@@ -24615,23 +24431,6 @@ var RDSDBProxyProvider = class {
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBProxyName");
 		if (explicit) return this.buildImportResult(explicit);
-		const client = this.getClient();
-		let marker;
-		do {
-			const describe = await client.send(new DescribeDBProxiesCommand({
-				Marker: marker,
-				MaxRecords: 100
-			}));
-			for (const proxy of describe.DBProxies ?? []) {
-				if (!proxy.DBProxyArn) continue;
-				try {
-					if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$9({ ResourceName: proxy.DBProxyArn }))).TagList ?? [], input.cdkPath)) return this.buildImportResult(proxy.DBProxyName ?? "");
-				} catch (error) {
-					this.logger.debug(`ListTagsForResource failed for ${proxy.DBProxyName}: ${error instanceof Error ? error.message : String(error)}`);
-				}
-			}
-			marker = describe.Marker;
-		} while (marker);
 		return null;
 	}
 	/**
@@ -24791,9 +24590,9 @@ const POLL_TIMEOUT_MS = 1800 * 1e3;
 *   is already gone via CASCADE, the endpoint is too.
 * - `getAttribute`: `Endpoint` / `DBProxyEndpointArn` / `IsDefault` / `VpcId`
 *   via `DescribeDBProxyEndpoints`, cached per `(physicalId, attribute)`.
-* - `import`: explicit `--resource <id>=<DBProxyEndpointName>` first; falls
-*   back to paginated auto-lookup via `DescribeDBProxyEndpoints` +
-*   `ListTagsForResource` matching `aws:cdk:path`.
+* - `import`: explicit `--resource <id>=<DBProxyEndpointName>` or the
+*   template's `DBProxyEndpointName` property (issue #1134 removed the
+*   unreachable `aws:cdk:path` tag walk).
 *
 * **physicalId** = DBProxyEndpointName (matches CFn `primaryIdentifier`).
 */
@@ -24953,23 +24752,6 @@ var RDSDBProxyEndpointProvider = class {
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBProxyEndpointName");
 		if (explicit) return this.buildImportResult(explicit);
-		const client = this.getClient();
-		let marker;
-		do {
-			const describe = await client.send(new DescribeDBProxyEndpointsCommand({
-				Marker: marker,
-				MaxRecords: 100
-			}));
-			for (const ep of describe.DBProxyEndpoints ?? []) {
-				if (!ep.DBProxyEndpointArn) continue;
-				try {
-					if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$9({ ResourceName: ep.DBProxyEndpointArn }))).TagList ?? [], input.cdkPath)) return this.buildImportResult(ep.DBProxyEndpointName ?? "");
-				} catch (error) {
-					this.logger.debug(`ListTagsForResource failed for ${ep.DBProxyEndpointName}: ${error instanceof Error ? error.message : String(error)}`);
-				}
-			}
-			marker = describe.Marker;
-		} while (marker);
 		return null;
 	}
 	async readCurrentState(physicalId) {
@@ -25958,7 +25740,7 @@ var DocDBProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`DocDB ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -26063,7 +25845,7 @@ var DocDBProvider = class {
 	* before calling this.
 	*/
 	async listTagsForResource(resourceArn) {
-		return (await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: resourceArn }))).TagList ?? [];
+		return (await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: resourceArn }))).TagList ?? [];
 	}
 };
 
@@ -26649,7 +26431,7 @@ var NeptuneProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`Neptune ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -26666,19 +26448,6 @@ var NeptuneProvider = class {
 			if (err.name === "DBInstanceNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBInstancesCommand$2({ ...marker && { Marker: marker } }));
-			for (const inst of list.DBInstances ?? []) {
-				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
-					physicalId: inst.DBInstanceIdentifier,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importDBCluster(input) {
@@ -26693,19 +26462,6 @@ var NeptuneProvider = class {
 			if (err.name === "DBClusterNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBClustersCommand$2({ ...marker && { Marker: marker } }));
-			for (const c of list.DBClusters ?? []) {
-				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
-					physicalId: c.DBClusterIdentifier,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importDBSubnetGroup(input) {
@@ -26720,19 +26476,6 @@ var NeptuneProvider = class {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$2({ ...marker && { Marker: marker } }));
-			for (const sg of list.DBSubnetGroups ?? []) {
-				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
-					physicalId: sg.DBSubnetGroupName,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 };
@@ -27469,28 +27212,6 @@ var Route53Provider = class {
 			if (err instanceof Error && err.name === "NoSuchHostedZone") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new ListHostedZonesCommand({ ...marker && { Marker: marker } }));
-			for (const zone of list.HostedZones ?? []) {
-				if (!zone.Id) continue;
-				const zoneId = zone.Id.replace("/hostedzone/", "");
-				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$7({
-						ResourceType: "hostedzone",
-						ResourceId: zoneId
-					}))).ResourceTagSet?.Tags, input.cdkPath)) return {
-						physicalId: zoneId,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof Error && err.name === "NoSuchHostedZone") continue;
-					throw err;
-				}
-			}
-			marker = list.IsTruncated ? list.NextMarker : void 0;
-		} while (marker);
 		return null;
 	}
 };
@@ -28067,7 +27788,7 @@ var CognitoUserPoolProvider = class {
 				try {
 					const arn = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }))).UserPool?.Arn;
 					if (!arn) return void 0;
-					return await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceArn: arn }));
+					return await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceArn: arn }));
 				} catch (err) {
 					if (err instanceof ResourceNotFoundException$7) return void 0;
 					throw err;
@@ -28103,8 +27824,6 @@ var CognitoUserPoolProvider = class {
 */
 var ElastiCacheProvider = class {
 	client;
-	stsClient;
-	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ElastiCacheProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Set([
@@ -28520,17 +28239,11 @@ var ElastiCacheProvider = class {
 	/**
 	* Adopt an existing ElastiCache resource into cdkd state.
 	*
-	* Supported types:
-	*  - `AWS::ElastiCache::CacheCluster` — full tag-based lookup via
-	*    `DescribeCacheClusters` + `ListTagsForResource(ResourceName=arn)`.
-	*  - `AWS::ElastiCache::SubnetGroup` — full tag-based lookup via
-	*    `DescribeCacheSubnetGroups` + `ListTagsForResource(ResourceName=arn)`.
-	*
-	* `ListTagsForResource` requires an ARN. Both `CacheCluster.ARN` and
-	* `CacheSubnetGroup.ARN` are returned by the Describe APIs, so no
-	* extra reconstruction is needed in normal flow; for the explicit
-	* override path we build the ARN from `region` + STS account id +
-	* the resource name.
+	* Supported types (both resolve from an explicit `--resource` override
+	* or the template's physical-name property, verified via the matching
+	* `Describe*` call):
+	*  - `AWS::ElastiCache::CacheCluster` — `Properties.ClusterName`.
+	*  - `AWS::ElastiCache::SubnetGroup` — `Properties.CacheSubnetGroupName`.
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -28551,20 +28264,6 @@ var ElastiCacheProvider = class {
 			if (this.isNotFoundError(err, "CacheClusterNotFoundFault")) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeCacheClustersCommand({ ...marker && { Marker: marker } }));
-			for (const c of list.CacheClusters ?? []) {
-				if (!c.CacheClusterId) continue;
-				const arn = c.ARN ?? await this.buildClusterArn(c.CacheClusterId);
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList, input.cdkPath)) return {
-					physicalId: c.CacheClusterId,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importSubnetGroup(input) {
@@ -28579,39 +28278,8 @@ var ElastiCacheProvider = class {
 			if (this.isNotFoundError(err, "CacheSubnetGroupNotFoundFault")) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeCacheSubnetGroupsCommand({ ...marker && { Marker: marker } }));
-			for (const g of list.CacheSubnetGroups ?? []) {
-				if (!g.CacheSubnetGroupName) continue;
-				const arn = g.ARN ?? await this.buildSubnetGroupArn(g.CacheSubnetGroupName);
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList, input.cdkPath)) return {
-					physicalId: g.CacheSubnetGroupName,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
-	async buildClusterArn(clusterName) {
-		return `arn:aws:elasticache:${await this.getRegion()}:${await this.getAccountId()}:cluster:${clusterName}`;
-	}
-	async buildSubnetGroupArn(subnetGroupName) {
-		return `arn:aws:elasticache:${await this.getRegion()}:${await this.getAccountId()}:subnetgroup:${subnetGroupName}`;
-	}
-	async getRegion() {
-		return await this.getClient().config.region() || this.providerRegion || "us-east-1";
-	}
-	async getAccountId() {
-		if (this.cachedAccountId) return this.cachedAccountId;
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
-		const identity = await this.stsClient.send(new GetCallerIdentityCommand({}));
-		if (!identity.Account) throw new Error("Failed to resolve AWS account id from STS");
-		this.cachedAccountId = identity.Account;
-		return this.cachedAccountId;
-	}
 };
 
 //#endregion
@@ -29331,7 +28999,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: arn }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: arn }))).Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -29373,25 +29041,17 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["Name"] === "string" ? input.properties["Name"] : void 0;
+		if (!desiredName) return null;
 		let token;
 		do {
 			const list = await this.getClient().send(new ListNamespacesCommand({ ...token && { NextToken: token } }));
 			for (const ns of list.Namespaces ?? []) {
 				if (!ns.Id || !ns.Arn) continue;
 				if (expectedKind && ns.Type && ns.Type !== expectedKind) continue;
-				if (desiredName && ns.Name === desiredName) return {
+				if (ns.Name === desiredName) return {
 					physicalId: ns.Id,
 					attributes: {}
 				};
-				if (input.cdkPath) try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: ns.Arn }))).Tags, input.cdkPath)) return {
-						physicalId: ns.Id,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof NamespaceNotFound) continue;
-					throw err;
-				}
 			}
 			token = list.NextToken;
 		} while (token);
@@ -29408,24 +29068,6 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			if (err instanceof ServiceNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let token;
-		do {
-			const list = await this.getClient().send(new ListServicesCommand$1({ ...token && { NextToken: token } }));
-			for (const svc of list.Services ?? []) {
-				if (!svc.Id || !svc.Arn) continue;
-				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: svc.Arn }))).Tags, input.cdkPath)) return {
-						physicalId: svc.Id,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof ServiceNotFound) continue;
-					throw err;
-				}
-			}
-			token = list.NextToken;
-		} while (token);
 		return null;
 	}
 	/**
@@ -30318,11 +29960,13 @@ var AppSyncProvider = class {
 	/**
 	* Adopt an existing AppSync resource into cdkd state.
 	*
-	* `AWS::AppSync::GraphQLApi` supports full tag-based auto-lookup via
-	* `ListGraphqlApis` (each item carries a `tags` map). AppSync sub-resources
+	* `AWS::AppSync::GraphQLApi` resolves an explicit `--resource` override
+	* (verified via `GetGraphqlApi`). There is no `aws:cdk:path` tag walk —
+	* AWS rejects `aws:`-prefixed tag writes, so that tag never exists on a
+	* real resource (issue #1134); auto-mode import resolves ids from
+	* CloudFormation's `DescribeStackResources` instead. AppSync sub-resources
 	* (`GraphQLSchema`, `DataSource`, `Resolver`, `ApiKey`) are scoped under a
-	* parent `apiId` and cannot be discovered by tag at the account level —
-	* explicit-override only.
+	* parent `apiId` — explicit-override only.
 	*/
 	async import(input) {
 		if (input.resourceType !== "AWS::AppSync::GraphQLApi") {
@@ -30343,19 +29987,6 @@ var AppSyncProvider = class {
 			if (err instanceof NotFoundException$4) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListGraphqlApisCommand({ ...nextToken && { nextToken } }));
-			for (const api of list.graphqlApis ?? []) {
-				if (!api.apiId) continue;
-				if (api.tags?.["aws:cdk:path"] === input.cdkPath) return {
-					physicalId: api.apiId,
-					attributes: {}
-				};
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
 		return null;
 	}
 };
@@ -30374,8 +30005,6 @@ var AppSyncProvider = class {
 */
 var GlueProvider = class {
 	client;
-	stsClient;
-	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Database", /* @__PURE__ */ new Set([
@@ -30621,16 +30250,11 @@ var GlueProvider = class {
 	/**
 	* Adopt an existing Glue Database or Table into cdkd state.
 	*
-	* Lookup order (per type):
-	*  1. Explicit override / template name → verify with `GetDatabase`
-	*     or `GetTable`.
-	*  2. Walk `GetDatabases` / `GetTables` paginators and match the
-	*     `aws:cdk:path` tag via `GetTags(ResourceArn)`. Glue tags are
-	*     a `Record<string,string>` map (not a `Tag[]` array), so the
-	*     match is `tags?.[CDK_PATH_TAG] === input.cdkPath`.
-	*
-	* Glue list APIs return only names — ARNs are constructed locally
-	* for the per-item GetTags call.
+	* Lookup (per type): explicit override / template name → verify with
+	* `GetDatabase` or `GetTable`. There is no `aws:cdk:path` tag walk — AWS
+	* rejects `aws:`-prefixed tag writes, so that tag never exists on a real
+	* resource (issue #1134); auto-mode import resolves ids from
+	* CloudFormation's `DescribeStackResources` instead.
 	*/
 	/**
 	* Read the AWS-current Glue resource configuration in CFn-property shape.
@@ -30751,23 +30375,6 @@ var GlueProvider = class {
 			if (err instanceof EntityNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new GetDatabasesCommand({
-				...nextToken && { NextToken: nextToken },
-				...catalogId && { CatalogId: catalogId }
-			}));
-			for (const db of list.DatabaseList ?? []) {
-				if (!db.Name) continue;
-				const arn = await this.buildDatabaseArn(db.Name, db.CatalogId);
-				if (await this.tagsMatchCdkPath(arn, input.cdkPath)) return {
-					physicalId: db.Name,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
 	async importTable(input) {
@@ -30806,51 +30413,8 @@ var GlueProvider = class {
 			if (err instanceof EntityNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath || !databaseName) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new GetTablesCommand({
-				DatabaseName: databaseName,
-				...nextToken && { NextToken: nextToken },
-				...catalogId && { CatalogId: catalogId }
-			}));
-			for (const t of list.TableList ?? []) {
-				if (!t.Name) continue;
-				const arn = await this.buildTableArn(databaseName, t.Name, catalogId);
-				if (await this.tagsMatchCdkPath(arn, input.cdkPath)) return {
-					physicalId: `${databaseName}|${t.Name}`,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
-	async tagsMatchCdkPath(arn, cdkPath) {
-		try {
-			return (await this.getClient().send(new GetTagsCommand({ ResourceArn: arn }))).Tags?.[CDK_PATH_TAG] === cdkPath;
-		} catch (err) {
-			if (err instanceof EntityNotFoundException) return false;
-			throw err;
-		}
-	}
-	async buildDatabaseArn(databaseName, catalogId) {
-		return `arn:aws:glue:${await this.getRegion()}:${catalogId ?? await this.getAccountId()}:database/${databaseName}`;
-	}
-	async buildTableArn(databaseName, tableName, catalogId) {
-		return `arn:aws:glue:${await this.getRegion()}:${catalogId ?? await this.getAccountId()}:table/${databaseName}/${tableName}`;
-	}
-	async getRegion() {
-		return await this.getClient().config.region() || this.providerRegion || "us-east-1";
-	}
-	async getAccountId() {
-		if (this.cachedAccountId) return this.cachedAccountId;
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
-		const identity = await this.stsClient.send(new GetCallerIdentityCommand({}));
-		if (!identity.Account) throw new Error("Failed to resolve AWS account id from STS");
-		this.cachedAccountId = identity.Account;
-		return this.cachedAccountId;
-	}
 };
 /**
 * SDK Provider for `AWS::Glue::Workflow`.
@@ -30996,29 +30560,8 @@ var GlueWorkflowProvider = class {
 			if (err instanceof EntityNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListWorkflowsCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const name of list.Workflows ?? []) {
-				const arn = await this.buildWorkflowArn(name);
-				if (await this.tagsMatchCdkPath(arn, input.cdkPath)) return {
-					physicalId: name,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
-	async tagsMatchCdkPath(arn, cdkPath) {
-		try {
-			return (await this.getClient().send(new GetTagsCommand({ ResourceArn: arn }))).Tags?.[CDK_PATH_TAG] === cdkPath;
-		} catch (err) {
-			if (err instanceof EntityNotFoundException) return false;
-			throw err;
-		}
-	}
 	async buildWorkflowArn(workflowName) {
 		return `arn:aws:glue:${await this.getRegion()}:${await this.getAccountId()}:workflow/${workflowName}`;
 	}
@@ -31136,15 +30679,6 @@ var GlueSecurityConfigurationProvider = class {
 			if (err instanceof EntityNotFoundException) return null;
 			throw err;
 		}
-		if (!explicitName) {
-			let nextToken;
-			do {
-				const list = await this.getClient().send(new GetSecurityConfigurationsCommand({ ...nextToken && { NextToken: nextToken } }));
-				for (const _entry of list.SecurityConfigurations ?? []);
-				nextToken = list.NextToken;
-			} while (nextToken);
-			return null;
-		}
 		return null;
 	}
 };
@@ -33096,7 +32630,7 @@ var BudgetsBudgetProvider = class {
 			},
 			describe: async (budget) => {
 				if (!budget.BudgetName) return void 0;
-				return await client.send(new ListTagsForResourceCommand$17({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }));
+				return await client.send(new ListTagsForResourceCommand$16({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }));
 			},
 			tagsOf: (tags) => tags.ResourceTags
 		});
@@ -33678,7 +33212,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ ResourceARN: physicalId }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$8) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -35748,8 +35282,8 @@ var FSxFileSystemProvider = class {
 	}
 	/**
 	* Adopt an existing FSx file system into cdkd state. Explicit physical
-	* id is verified via `DescribeFileSystems`; otherwise a paginated walk
-	* matches the `aws:cdk:path` tag (`Tags` ride inline on each item).
+	* id is verified via `DescribeFileSystems`; without an override the
+	* resource is reported as not-found.
 	*/
 	async import(input) {
 		if (input.resourceType !== "AWS::FSx::FileSystem") return null;
@@ -35763,19 +35297,6 @@ var FSxFileSystemProvider = class {
 			if (err instanceof FileSystemNotFound$1) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new DescribeFileSystemsCommand$1({ ...nextToken && { NextToken: nextToken } }));
-			for (const fs of list.FileSystems ?? []) {
-				if (!fs.FileSystemId) continue;
-				if (matchesCdkPath(fs.Tags, input.cdkPath)) return {
-					physicalId: fs.FileSystemId,
-					attributes: this.buildAttributes(fs)
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
 };
@@ -36342,7 +35863,7 @@ var EMRClusterProvider = class {
 			cdkPath: input.cdkPath,
 			logicalId: input.logicalId,
 			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListClustersCommand$1({
+				const list = await this.getClient().send(new ListClustersCommand({
 					ClusterStates: [...NON_TERMINATED_STATES],
 					...marker && { Marker: marker }
 				}));
@@ -39102,11 +38623,11 @@ var CodeBuildProvider = class {
 	/**
 	* Adopt an existing CodeBuild project into cdkd state.
 	*
-	* Lookup order:
-	*  1. `--resource` override or `Properties.Name` → verify via `BatchGetProjects`.
-	*  2. `ListProjects` + `BatchGetProjects` (CodeBuild uses lowercase
-	*     `key`/`value` tags, not the standard `Key`/`Value`), match
-	*     `aws:cdk:path` tag.
+	* Lookup: `--resource` override or `Properties.Name` → verify via
+	* `BatchGetProjects`. There is no `aws:cdk:path` tag walk — AWS rejects
+	* `aws:`-prefixed tag writes, so that tag never exists on a real resource
+	* (issue #1134); auto-mode import resolves ids from CloudFormation's
+	* `DescribeStackResources` instead.
 	*/
 	/**
 	* Read the AWS-current CodeBuild Project configuration in CFn-property shape.
@@ -39290,24 +38811,6 @@ var CodeBuildProvider = class {
 			if (err instanceof ResourceNotFoundException$11) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListProjectsCommand({ ...nextToken && { nextToken } }));
-			const names = (list.projects ?? []).filter((n) => typeof n === "string");
-			if (names.length > 0) {
-				const batch = await this.getClient().send(new BatchGetProjectsCommand({ names }));
-				for (const proj of batch.projects ?? []) {
-					if (!proj.name) continue;
-					const tags = proj.tags ?? [];
-					for (const t of tags) if (t.key === "aws:cdk:path" && t.value === input.cdkPath) return {
-						physicalId: proj.name,
-						attributes: {}
-					};
-				}
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
 		return null;
 	}
 };
@@ -39677,7 +39180,7 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }))).tags);
+			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }))).tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return void 0;
 			throw err;
@@ -39748,7 +39251,7 @@ var CodeCommitRepositoryProvider = class {
 					throw err;
 				}
 				if (!metadata?.Arn) return void 0;
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }));
+				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }));
 				return {
 					metadata,
 					tags: tagsResp.tags
@@ -40318,7 +39821,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -40360,7 +39863,7 @@ var S3VectorsProvider = class {
 			describe: async (bucket) => {
 				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) return void 0;
 				try {
-					return await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }));
+					return await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }));
 				} catch (err) {
 					if (this.isNotFoundError(err)) return void 0;
 					throw err;
@@ -40940,16 +40443,10 @@ var S3TablesProvider = class {
 	/**
 	* Adopt an existing S3 Tables resource into cdkd state.
 	*
-	*  - **AWS::S3Tables::TableBucket**: tag-based auto-lookup via
-	*    `ListTableBuckets` + `ListTagsForResource(resourceArn)` (tags map).
-	*    Falls back to `--resource <id>=<arn>` or `Properties.TableBucketName`
-	*    (resolved by ARN suffix match against `ListTableBuckets`).
-	*  - **AWS::S3Tables::Table**: tag-based auto-lookup walks every
-	*    table bucket → namespace → table and calls `ListTagsForResource`
-	*    on each table ARN; matches `aws:cdk:path`.
-	*  - **AWS::S3Tables::Namespace**: explicit-override only. Namespaces
-	*    are not taggable in S3 Tables (`ListTagsForResource` accepts only
-	*    table-bucket or table ARNs), so auto-lookup is impossible.
+	*  - **AWS::S3Tables::TableBucket**: `--resource <id>=<arn>` override, or
+	*    a `Properties.TableBucketName` match against `ListTableBuckets`.
+	*  - **AWS::S3Tables::Table**: explicit-override only.
+	*  - **AWS::S3Tables::Namespace**: explicit-override only.
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -40971,24 +40468,16 @@ var S3TablesProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["TableBucketName"] === "string" ? input.properties["TableBucketName"] : void 0;
+		if (!desiredName) return null;
 		let token;
 		do {
 			const list = await this.getClient().send(new ListTableBucketsCommand({ ...token && { continuationToken: token } }));
 			for (const bucket of list.tableBuckets ?? []) {
 				if (!bucket.arn) continue;
-				if (desiredName && bucket.name === desiredName) return {
+				if (bucket.name === desiredName) return {
 					physicalId: bucket.arn,
 					attributes: {}
 				};
-				if (input.cdkPath) try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$21({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: bucket.arn,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof NotFoundException$6) continue;
-					throw err;
-				}
 			}
 			token = list.continuationToken;
 		} while (token);
@@ -41023,48 +40512,6 @@ var S3TablesProvider = class {
 				attributes: {}
 			};
 		}
-		if (!input.cdkPath) return null;
-		let bucketToken;
-		do {
-			const buckets = await this.getClient().send(new ListTableBucketsCommand({ ...bucketToken && { continuationToken: bucketToken } }));
-			for (const bucket of buckets.tableBuckets ?? []) {
-				if (!bucket.arn) continue;
-				let nsToken;
-				do {
-					const namespaces = await this.getClient().send(new ListNamespacesCommand$1({
-						tableBucketARN: bucket.arn,
-						...nsToken && { continuationToken: nsToken }
-					}));
-					for (const ns of namespaces.namespaces ?? []) {
-						const namespaceName = ns.namespace?.[0];
-						if (!namespaceName) continue;
-						let tableToken;
-						do {
-							const tables = await this.getClient().send(new ListTablesCommand$1({
-								tableBucketARN: bucket.arn,
-								namespace: namespaceName,
-								...tableToken && { continuationToken: tableToken }
-							}));
-							for (const table of tables.tables ?? []) {
-								if (!table.name || !table.tableARN) continue;
-								try {
-									if ((await this.getClient().send(new ListTagsForResourceCommand$21({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-										physicalId: `${bucket.arn}|${namespaceName}|${table.name}`,
-										attributes: {}
-									};
-								} catch (err) {
-									if (err instanceof NotFoundException$6) continue;
-									throw err;
-								}
-							}
-							tableToken = tables.continuationToken;
-						} while (tableToken);
-					}
-					nsToken = namespaces.continuationToken;
-				} while (nsToken);
-			}
-			bucketToken = buckets.continuationToken;
-		} while (bucketToken);
 		return null;
 	}
 	async deleteTable(logicalId, physicalId, resourceType, context) {
@@ -41144,7 +40591,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$21({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -41901,7 +41348,8 @@ async function runDestroyForStack(stackName, state, ctx) {
 					const providerMinTimeoutMs = provider.getMinResourceTimeoutMs?.() ?? 0;
 					const warnAfterMs = ctx.resourceWarnAfterByType?.[resource.resourceType] ?? ctx.resourceWarnAfterMs ?? 3e5;
 					const globalTimeoutMs = ctx.resourceTimeoutMs ?? 18e5;
-					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, globalTimeoutMs);
+					const slowTypeMinTimeoutMs = slowCcOperationTimeoutMs(resource.resourceType, "DELETE");
+					const timeoutMs = ctx.resourceTimeoutByType?.[resource.resourceType] ?? Math.max(providerMinTimeoutMs, slowTypeMinTimeoutMs, globalTimeoutMs);
 					await withResourceDeadline(async () => {
 						const maxAttempts = provider.disableOuterRetry ? 0 : 3;
 						let lastDeleteError;
@@ -52003,30 +51451,13 @@ async function importCommand(stackArg, options) {
 		if (migrationCfnStackName) {
 			logger.info(`Resolving physical IDs from CloudFormation stack '${migrationCfnStackName}' (recursive)...`);
 			migrationTree = await getCloudFormationResourceTree(migrationCfnStackName, awsClients.cloudFormation);
-			const cfnMapping = migrationTree.resources;
-			let derived = 0;
-			let skippedNonImportable = 0;
-			let skippedNestedStackRow = 0;
-			for (const [logicalId, physicalId] of cfnMapping) {
-				if (!templateLogicalIds.has(logicalId)) {
-					skippedNonImportable++;
-					continue;
-				}
-				if (template.Resources[logicalId]?.Type === "AWS::CloudFormation::Stack") {
-					skippedNestedStackRow++;
-					continue;
-				}
-				if (!overrides.has(logicalId)) {
-					overrides.set(logicalId, physicalId);
-					derived++;
-				}
-			}
-			const overriddenByUser = cfnMapping.size - derived - skippedNonImportable - skippedNestedStackRow;
-			const detail = [];
-			if (overriddenByUser > 0) detail.push(`${overriddenByUser} already overridden by --resource`);
-			if (skippedNonImportable > 0) detail.push(`${skippedNonImportable} non-importable (e.g. CDKMetadata)`);
-			if (skippedNestedStackRow > 0) detail.push(`${skippedNestedStackRow} nested-stack row(s) handled separately`);
-			logger.info(`Resolved ${derived} physical ID(s) from CloudFormation` + (detail.length > 0 ? ` (${detail.join(", ")})` : ""));
+			const mergeStats = mergeCfnDerivedOverrides({
+				cfnMapping: migrationTree.resources,
+				template,
+				templateLogicalIds,
+				overrides
+			});
+			logger.info(`Resolved ${mergeStats.derived} physical ID(s) from CloudFormation` + formatCfnOverrideMergeDetail(mergeStats));
 			validateNestedStackShape(template, migrationTree, stackInfo.stackName, stackInfo.nestedTemplates ?? {});
 		}
 		let accountIdForNestedSynth;
@@ -52041,15 +51472,13 @@ async function importCommand(stackArg, options) {
 		if (!selectiveMode && !migrationCfnStackName) {
 			const cfnResources = await tryGetCloudFormationResourceMap(stackInfo.stackName, awsClients.cloudFormation);
 			if (cfnResources) {
-				let derived = 0;
-				for (const [logicalId, physicalId] of cfnResources) {
-					if (!templateLogicalIds.has(logicalId)) continue;
-					if (template.Resources[logicalId]?.Type === "AWS::CloudFormation::Stack") continue;
-					if (overrides.has(logicalId)) continue;
-					overrides.set(logicalId, physicalId);
-					derived++;
-				}
-				if (derived > 0) logger.info(`Resolved ${derived} physical ID(s) from CloudFormation stack '${stackInfo.stackName}'. To adopt AND retire that stack, use --migrate-from-cloudformation.`);
+				const mergeStats = mergeCfnDerivedOverrides({
+					cfnMapping: cfnResources,
+					template,
+					templateLogicalIds,
+					overrides
+				});
+				if (mergeStats.derived > 0) logger.info(`Resolved ${mergeStats.derived} physical ID(s) from CloudFormation stack '${stackInfo.stackName}'. To adopt AND retire that stack, use --migrate-from-cloudformation.`);
 				else logger.debug(`CloudFormation stack '${stackInfo.stackName}' contributed no new physical IDs.`);
 			} else logger.debug(`No CloudFormation stack named '${stackInfo.stackName}' — resolving physical IDs per provider.`);
 		}
@@ -52166,6 +51595,79 @@ async function importCommand(stackArg, options) {
 	}
 }
 /**
+* Merge a CloudFormation-derived `logicalId -> physicalId` map into the run's
+* `overrides`, applying the three filters every CFn-derived seed needs, and
+* report what each filter dropped.
+*
+* The filters, in order:
+*   1. **Not an importable template resource** — CFn knows about sentinel rows
+*      like `AWS::CDK::Metadata` that cdkd silently skips on import. Merging
+*      those would make the typo-validation step reject them.
+*   2. **Nested-stack row** — the AWS-side physical ID of an
+*      `AWS::CloudFormation::Stack` row is the child stack ARN, which is NOT
+*      what we want as an import override. The parent's state entry carries
+*      the synthesized cdkd-local ARN (matching what `NestedStackProvider.create`
+*      writes at deploy time — design §6), populated by `importOne`'s
+*      short-circuit. Filtering here keeps the AWS ARN from overwriting it.
+*   3. **Already overridden** — user-supplied `--resource` /
+*      `--resource-mapping` entries are inserted before any CFn lookup and
+*      always win.
+*
+* Shared by all three CFn-derived seeding sites so a change to any filter
+* lands once: the `--migrate-from-cloudformation` root walk, the auto-mode
+* best-effort lookup (issue #1128), and the recursive nested-child walk.
+* The three differ only in their LOGGING, which stays at the call sites.
+*
+* **Second-order effect worth naming:** `overrides` is also consumed by
+* {@link substituteOverrideRefs}, so seeding it from CloudFormation means a
+* `{Ref: <X>}` in a resource's Properties pre-resolves to the CFn physical ID
+* before `provider.import()` sees it. That is intended — it is what makes
+* sub-resource providers (e.g. `SQSQueuePolicyProvider`, which reads
+* `properties.Queues[0]` as a literal queue URL) importable — but it is a
+* behavior beyond "resolve physical IDs", and it applies to every caller of
+* this helper, not just the migration path. See issue #1131.
+*
+* Mutates `overrides` in place; does not mutate `cfnMapping` or `template`.
+*/
+function mergeCfnDerivedOverrides(params) {
+	const { cfnMapping, template, templateLogicalIds, overrides } = params;
+	const stats = {
+		derived: 0,
+		skippedNonImportable: 0,
+		skippedNestedStackRow: 0,
+		overriddenByUser: 0
+	};
+	for (const [logicalId, physicalId] of cfnMapping) {
+		if (!templateLogicalIds.has(logicalId)) {
+			stats.skippedNonImportable++;
+			continue;
+		}
+		if (template.Resources[logicalId]?.Type === "AWS::CloudFormation::Stack") {
+			stats.skippedNestedStackRow++;
+			continue;
+		}
+		if (overrides.has(logicalId)) {
+			stats.overriddenByUser++;
+			continue;
+		}
+		overrides.set(logicalId, physicalId);
+		stats.derived++;
+	}
+	return stats;
+}
+/**
+* Render the human-readable breakdown of a {@link mergeCfnDerivedOverrides}
+* result — the parenthesized suffix of the `Resolved N physical ID(s)` line.
+* Returns `''` when nothing was dropped (no breakdown worth reporting).
+*/
+function formatCfnOverrideMergeDetail(stats) {
+	const detail = [];
+	if (stats.overriddenByUser > 0) detail.push(`${stats.overriddenByUser} already overridden by --resource`);
+	if (stats.skippedNonImportable > 0) detail.push(`${stats.skippedNonImportable} non-importable (e.g. CDKMetadata)`);
+	if (stats.skippedNestedStackRow > 0) detail.push(`${stats.skippedNestedStackRow} nested-stack row(s) handled separately`);
+	return detail.length > 0 ? ` (${detail.join(", ")})` : "";
+}
+/**
 * Recursively substitute `{Ref: <LogicalId>}` shapes in an arbitrary value
 * tree with the matching entry from `overrides`. Used to bridge the gap
 * between CDK synth's template (which carries raw intrinsics) and what a
@@ -52714,11 +52216,12 @@ async function importNestedStackChildrenRecursive(args) {
 			const childResources = collectImportableResources(childTemplate);
 			const childTemplateLogicalIds = new Set(childResources.map((r) => r.logicalId));
 			const childOverrides = /* @__PURE__ */ new Map();
-			for (const [logicalId, physicalId] of childTreeNode.resources) {
-				if (!childTemplateLogicalIds.has(logicalId)) continue;
-				if (childTemplate.Resources[logicalId]?.Type === "AWS::CloudFormation::Stack") continue;
-				childOverrides.set(logicalId, physicalId);
-			}
+			mergeCfnDerivedOverrides({
+				cfnMapping: childTreeNode.resources,
+				template: childTemplate,
+				templateLogicalIds: childTemplateLogicalIds,
+				overrides: childOverrides
+			});
 			const rows = [];
 			for (const { logicalId, resource } of childResources) {
 				if (resource.Type === "AWS::CloudFormation::Stack" && childTreeNode.nested.has(logicalId)) {
@@ -62320,7 +61823,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.1");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.3");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());