@go-to-k/cdkd 0.257.2 → 0.257.4

package/dist/cli.js

@@ -1,36 +1,36 @@
 #!/usr/bin/env node
-import { $ as AssetModeResolver, $t as StackTerminationProtectionError, A as importTagWalk, At as expectedOwnerParam, B as DagBuilder, C as slowCcOperationTimeoutMs, Ct as resolveUseCdkBootstrapAssets, D as cfnRefValueFromPhysicalId, Dt as MIGRATE_TMP_PREFIX, E as IntrinsicFunctionResolver, Et as CFN_TEMPLATE_URL_LIMIT, F as normalizeAwsTagsToCfn, Ft as getAwsClients, G as shouldRetainResource, H as LockManager, Ht as LocalInvokeBuildError$1, I as resolveExplicitPhysicalId, It as resetAwsClients, J as WorkGraph, Jt as PartialFailureError, K as AssetPublisher, Kt as MissingCdkCliError, L as assertRegionMatch, Lt as setAwsClients, M as isRetryableTransientError, N as CDK_PATH_TAG, Nt as resolveBucketRegion, O as refStateLookupFromResource, Ot as findLargeInlineResources, P as matchesCdkPath, Pt as AwsClients, Q as rewriteTemplateAssetReferences, Qt as StackHasActiveImportsError, R as applyRoleArnIfSet, S as CloudControlProvider, St as resolveStateBucketWithDefaultAndSource, T as isTerminationProtectionPropagationError, Tt as CFN_TEMPLATE_BODY_LIMIT, U as S3StateBackend, Ut as LocalMigrateError, V as TemplateParser, W as rebuildClientForBucketRegion, Wt as LocalStartServiceError, X as createAssetRedirectResolver, Xt as ResourceTimeoutError, Y as buildAssetRedirectMap, Yt as ProvisioningError, Z as loadPublishableAssetManifest, Zt as ResourceUpdateNotSupportedError, _ as yellow, _t as resolveApp, a as IMPLICIT_DELETE_DEPENDENCIES, an as withErrorHandling, at as validateContainerRepoName, b as ProviderRegistry, bt as resolveSkipPrefix, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as getDockerCmd, d as formatResourceLine, dt as AssetManifestLoader, et as BOOTSTRAP_MARKER_PREFIX, f as bold, ft as getDockerImageBySourceHash, g as red, gt as getLegacyStateBucketName, h as green, ht as getDefaultStateBucketName, i as withResourceDeadline, in as normalizeAwsError, it as validateAssetBucketName, j as withRetry, jt as AssemblyReader, k as WAFv2WebACLProvider, kt as uploadCfnTemplate, l as isStatefulRecreateTargetSync, lt as runDockerForeground, m as gray, mt as synthesisStatusMessage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as getBootstrapMarkerKey, o as computeImplicitDeleteEdges, ot as buildDockerImage, p as cyan, pt as Synthesizer, q as stringifyValue, qt as NestedStackChildDirectDestroyError, r as DeployEngine, rt as parseBootstrapMarker, s as extractDeploymentEventError, st as formatDockerLoginError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as ensureAssetStorage, u as renderStatefulReason, ut as runDockerStreaming, v as IAMRoleProvider, vt as resolveAutoAssetStorage, w as disableInstanceApiTermination, wt as warnDeprecatedNoPrefixCliFlag, x as findActionableSilentDrops, xt as resolveStateBucketWithDefault, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveCaptureObservedState, z as DiffCalculator, zt as CdkdError } from "./deploy-engine-wmvXbyoB.js";
+import { $ as getBootstrapMarkerKey, A as refStateLookupFromResource, At as resolveBucketRegion, B as S3StateBackend, Bt as LocalMigrateError, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_URL_LIMIT, D as isTerminationProtectionPropagationError, Dt as expectedOwnerParam, E as disableInstanceApiTermination, Et as uploadCfnTemplate, F as applyRoleArnIfSet, G as WorkGraph, Gt as PartialFailureError, H as shouldRetainResource, I as DiffCalculator, It as CdkdError, J as loadPublishableAssetManifest, Jt as ResourceUpdateNotSupportedError, K as buildAssetRedirectMap, Kt as ProvisioningError, L as DagBuilder, M as normalizeAwsTagsToCfn, Mt as getAwsClients, N as resolveExplicitPhysicalId, Nt as resetAwsClients, O as IntrinsicFunctionResolver, Ot as AssemblyReader, P as assertRegionMatch, Pt as setAwsClients, Q as ensureAssetStorage, R as TemplateParser, S as ProviderRegistry, St as CFN_TEMPLATE_BODY_LIMIT, T as slowCcOperationTimeoutMs, Tt as findLargeInlineResources, U as AssetPublisher, Ut as MissingCdkCliError, V as rebuildClientForBucketRegion, Vt as LocalStartServiceError, W as stringifyValue, Wt as NestedStackChildDirectDestroyError, X as AssetModeResolver, Xt as StackTerminationProtectionError, Y as rewriteTemplateAssetReferences, Yt as StackHasActiveImportsError, Z as BOOTSTRAP_MARKER_PREFIX, _ as green, _t as resolveSkipPrefix, a as withRetry, at as getDockerCmd, b as IAMRoleProvider, bt as resolveUseCdkBootstrapAssets, c as computeImplicitDeleteEdges, ct as AssetManifestLoader, d as isStatefulRecreateTargetSync, dt as synthesisStatusMessage, et as parseBootstrapMarker, f as renderStatefulReason, ft as getDefaultStateBucketName, g as gray, gt as resolveCaptureObservedState, h as cyan, ht as resolveAutoAssetStorage, i as withResourceDeadline, it as formatDockerLoginError, j as WAFv2WebACLProvider, jt as AwsClients, k as cfnRefValueFromPhysicalId, l as extractDeploymentEventError, lt as getDockerImageBySourceHash, m as bold, mt as resolveApp, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as withErrorHandling, nt as validateContainerRepoName, o as isRetryableTransientError, ot as runDockerForeground, p as formatResourceLine, pt as getLegacyStateBucketName, q as createAssetRedirectResolver, qt as ResourceTimeoutError, r as DeployEngine, rt as buildDockerImage, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerStreaming, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as normalizeAwsError, tt as validateAssetBucketName, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as Synthesizer, v as red, vt as resolveStateBucketWithDefault, w as CloudControlProvider, wt as MIGRATE_TMP_PREFIX, x as collectInlinePolicyNamesManagedBySiblings, xt as warnDeprecatedNoPrefixCliFlag, y as yellow, yt as resolveStateBucketWithDefaultAndSource, z as LockManager, zt as LocalInvokeBuildError$1 } from "./deploy-engine-DMpr3qtv.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-4KjJhMTY.js";
+import { t as ASGProvider } from "./asg-provider-BhmMKcnJ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
-import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, ListUserTagsCommand, ListUsersCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
-import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, ListQueuesCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
+import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
+import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
-import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListFunctionsCommand, ListLayersCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
+import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
-import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTablesCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
+import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, DescribeTypeCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetDeploymentCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
-import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListEventBusesCommand, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
-import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, ListSecretsCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
+import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
+import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, ListDistributionsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand } from "@aws-sdk/client-cloudfront";
+import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand } from "@aws-sdk/client-cloudfront";
 import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutMetricAlarmCommand, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
-import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListCertificatesCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
+import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import * as fs from "node:fs";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
-import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListHostedZonesCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
+import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand } from "@aws-sdk/client-elastic-load-balancing-v2";
-import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
 import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
@@ -42,30 +42,30 @@ import readline from "node:readline/promises";
 import { writeFileSync as writeFileSync$1 } from "fs";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
-import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetApisCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
-import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListStateMachinesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, ListClustersCommand, ListServicesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$12, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
-import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListServicesCommand as ListServicesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, ListGraphqlApisCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
+import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
+import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
-import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetDatabasesCommand, GetJobCommand, GetSecurityConfigurationCommand, GetSecurityConfigurationsCommand, GetTableCommand, GetTablesCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, ListWorkflowsCommand, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$17, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
-import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand as ListClustersCommand$1, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
-import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
-import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
+import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
+import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import AdmZip from "adm-zip";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$21, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1354,7 +1354,8 @@ async function listCommand(patterns, options) {
 		output: options.output,
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile },
-		...Object.keys(context).length > 0 && { context }
+		...Object.keys(context).length > 0 && { context },
+		deferMacroExpansion: true
 	};
 	const allStacks = (await synthesizer.synthesize(synthOptions)).stacks;
 	if (allStacks.length === 0) throw new Error("No stacks found in assembly");
@@ -1899,7 +1900,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.257.2";
+	return "0.257.4";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -3485,8 +3486,6 @@ var IAMManagedPolicyProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.ManagedPolicyName` → walk
 	*     `ListPolicies(Scope: 'Local')` to find the matching ARN.
-	*  2. `ListPolicies(Scope: 'Local')` → for each candidate, `ListPolicyTags`
-	*     and match against `aws:cdk:path`.
 	*
 	* Scope is forced to `'Local'` (customer-managed policies) — adopting an
 	* AWS-managed policy would let cdkd delete it on next destroy, which would
@@ -3515,36 +3514,7 @@ var IAMManagedPolicyProvider = class {
 			};
 			return null;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.iamClient.send(new ListPoliciesCommand({
-					Scope: "Local",
-					...marker ? { Marker: marker } : {}
-				}));
-				return {
-					items: list.Policies,
-					nextMarker: list.IsTruncated ? list.Marker : void 0
-				};
-			},
-			describe: async (policy) => {
-				if (!policy.Arn) return void 0;
-				try {
-					return await this.iamClient.send(new ListPolicyTagsCommand({ PolicyArn: policy.Arn }));
-				} catch (err) {
-					if (err instanceof NoSuchEntityException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tags) => tags.Tags
-		});
-		if (!match) return null;
-		const arn = match.summary.Arn;
-		return {
-			physicalId: arn,
-			attributes: { PolicyArn: arn }
-		};
+		return null;
 	}
 	async attachToPrincipals(policyArn, groups, roles, users) {
 		if (groups && Array.isArray(groups)) for (const groupName of groups) {
@@ -3945,13 +3915,6 @@ var IAMInstanceProfileProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.InstanceProfileName` → verify
 	*     via `GetInstanceProfile`.
-	*  2. `ListInstanceProfiles` paginator + a per-candidate `GetInstanceProfile`
-	*     to read the tags, matched against `aws:cdk:path`. The list API does
-	*     NOT return tags (AWS documents this on the command) even though the
-	*     `InstanceProfile` type declares `Tags?`, so reading them off the
-	*     summary typechecks and never matches.
-	*
-	* IAM is global; this walks every instance profile in the account once.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "InstanceProfileName");
@@ -3965,32 +3928,7 @@ var IAMInstanceProfileProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.iamClient.send(new ListInstanceProfilesCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.InstanceProfiles,
-					nextMarker: list.IsTruncated ? list.Marker : void 0
-				};
-			},
-			describe: async (profile) => {
-				if (!profile.InstanceProfileName) return void 0;
-				try {
-					return (await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: profile.InstanceProfileName }))).InstanceProfile;
-				} catch (err) {
-					if (err instanceof NoSuchEntityException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (detail) => detail?.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.InstanceProfileName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -4825,13 +4763,10 @@ var IAMUserGroupProvider = class {
 	/**
 	* Adopt an existing IAM user / group / user-to-group addition into cdkd state.
 	*
-	*  - **AWS::IAM::User**: tag-based auto-lookup via `ListUsers` +
-	*    `ListUserTags`. Falls back to `--resource` override or
-	*    `Properties.UserName`.
-	*  - **AWS::IAM::Group**: explicit-override only. IAM groups are not
-	*    taggable (no `ListGroupTags` API), so tag-based auto-lookup is not
-	*    possible. Caller can still pass `Properties.GroupName` or
-	*    `--resource` to verify and adopt by name.
+	*  - **AWS::IAM::User**: `--resource` override or `Properties.UserName`,
+	*    verified via `GetUser`.
+	*  - **AWS::IAM::Group**: `--resource` override or `Properties.GroupName`,
+	*    verified via `GetGroup`.
 	*  - **AWS::IAM::UserToGroupAddition**: explicit-override only. Has no
 	*    AWS-side identity beyond the (group, users) attachment itself.
 	*/
@@ -4855,24 +4790,6 @@ var IAMUserGroupProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.iamClient.send(new ListUsersCommand({ ...marker && { Marker: marker } }));
-			for (const user of list.Users ?? []) {
-				if (!user.UserName) continue;
-				try {
-					if (matchesCdkPath((await this.iamClient.send(new ListUserTagsCommand({ UserName: user.UserName }))).Tags, input.cdkPath)) return {
-						physicalId: user.UserName,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof NoSuchEntityException) continue;
-					throw err;
-				}
-			}
-			marker = list.IsTruncated ? list.Marker : void 0;
-		} while (marker);
 		return null;
 	}
 	async importGroup(input) {
@@ -6311,8 +6228,6 @@ var S3BucketProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.BucketName` → use directly,
 	*     verify with `HeadBucket`.
-	*  2. `ListBuckets` + `GetBucketTagging`, match `aws:cdk:path` against the
-	*     CDK construct path.
 	*
 	* Returns `null` when nothing matches — caller treats this as
 	* "not deployed yet" rather than a failure.
@@ -6330,32 +6245,7 @@ var S3BucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async () => {
-				return {
-					items: (await this.s3Client.send(new ListBucketsCommand({}))).Buckets,
-					nextMarker: void 0
-				};
-			},
-			describe: async (b) => {
-				if (!b.Name) return void 0;
-				try {
-					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
-				} catch (err) {
-					const e = err;
-					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied" || e.$metadata?.httpStatusCode === 301) return;
-					throw err;
-				}
-			},
-			tagsOf: (tagging) => tagging.TagSet
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Delete a bucket, emptying it first if not empty.
@@ -7171,7 +7061,6 @@ var SQSQueueProvider = class {
 	* Lookup order:
 	*  1. `--resource` override (URL) → verify via `GetQueueAttributes`.
 	*  2. `Properties.QueueName` → `GetQueueUrl` for direct lookup.
-	*  3. `aws:cdk:path` tag match via `ListQueues` + `ListQueueTags`.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7199,34 +7088,7 @@ var SQSQueueProvider = class {
 			if (err instanceof QueueDoesNotExist) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.sqsClient.send(new ListQueuesCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.QueueUrls,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (url) => {
-				try {
-					return await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: url }));
-				} catch (err) {
-					if (err instanceof QueueDoesNotExist) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -7894,17 +7756,13 @@ var SNSTopicProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override → trust as ARN, verify via `GetTopicAttributes`.
-	*  2. `Properties.TopicName` → `ListTopics` to find matching ARN.
-	*  3. `aws:cdk:path` tag match via `ListTopics` + `ListTagsForResource`.
-	*
-	* Steps 2 and 3 share ONE `ListTopics` walk (per candidate: name check
-	* first, then the tag read — only when a `cdkPath` is present), which runs
-	* through the shared `importTagWalk` helper so the N+1 `ListTagsForResource`
-	* burst is retried with exponential backoff when AWS throttles it instead
-	* of aborting the whole import. The name match is expressed to the walk as
-	* a synthetic `aws:cdk:path` tag carrying the walk's own lookup key, so a
-	* name-only template (no CDK path metadata) still resolves without any tag
-	* API call — matching the previous inline loop.
+	*  2. `Properties.TopicName` → `ListTopics` to find the matching ARN.
+	*
+	* The `aws:cdk:path` tag match that used to ride the same `ListTopics` walk
+	* is gone (issue #1134): AWS rejects `aws:`-prefixed tag writes, so that tag
+	* never exists on a real resource and the walk could not match. Auto-mode
+	* import resolves ids from CloudFormation's `DescribeStackResources` or the
+	* template's physical name; without a `TopicName` there is nothing to match.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7918,40 +7776,19 @@ var SNSTopicProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["TopicName"] === "string" ? input.properties["TopicName"] : void 0;
-		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:sns-topic-name:${desiredName}` : void 0);
-		/** Sentinel detail for a candidate matched by its ARN-tail topic name. */
-		const NAME_MATCH = { nameMatch: true };
-		const match = await importTagWalk({
-			cdkPath: walkCdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.snsClient.send(new ListTopicsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.Topics,
-					nextMarker: list.NextToken
+		if (!desiredName) return null;
+		let marker;
+		do {
+			const list = await this.snsClient.send(new ListTopicsCommand({ ...marker && { NextToken: marker } }));
+			for (const t of list.Topics ?? []) {
+				if (!t.TopicArn) continue;
+				if (t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1) === desiredName) return {
+					physicalId: t.TopicArn,
+					attributes: {}
 				};
-			},
-			describe: async (t) => {
-				if (!t.TopicArn) return void 0;
-				const arnTail = t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1);
-				if (desiredName && arnTail === desiredName) return NAME_MATCH;
-				if (!input.cdkPath) return void 0;
-				try {
-					return await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: t.TopicArn }));
-				} catch (err) {
-					if (err instanceof NotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (detail) => "nameMatch" in detail ? [{
-				Key: CDK_PATH_TAG,
-				Value: walkCdkPath
-			}] : detail.Tags
-		});
-		if (match?.summary.TopicArn) return {
-			physicalId: match.summary.TopicArn,
-			attributes: {}
-		};
+			}
+			marker = list.NextToken;
+		} while (marker);
 		return null;
 	}
 };
@@ -9305,15 +9142,6 @@ var LambdaFunctionProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.FunctionName` → use directly,
 	*     verify via `GetFunction`.
-	*  2. `ListFunctions` + `ListTags`, match `aws:cdk:path` tag.
-	*
-	* Lambda's `ListTags` returns a `Tags` map keyed by tag name (unlike
-	* EC2/S3 which return an array of `{Key, Value}`), so the map is re-shaped
-	* to `{Key, Value}` entries for the walk's matcher.
-	*
-	* The tag walk runs through the shared `importTagWalk` helper, so the N+1
-	* `ListTags` burst is retried with exponential backoff when AWS throttles
-	* it instead of aborting the whole import.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "FunctionName");
@@ -9327,35 +9155,7 @@ var LambdaFunctionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.lambdaClient.send(new ListFunctionsCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Functions,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (fn) => {
-				if (!fn.FunctionArn || !fn.FunctionName) return void 0;
-				try {
-					return await this.lambdaClient.send(new ListTagsCommand({ Resource: fn.FunctionArn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.FunctionName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -10372,15 +10172,6 @@ var LambdaLayerVersionProvider = class {
 	*     `GetLayerVersionByArn`. (Note: there is no `LayerName` field that
 	*     uniquely names a *version*; a layer name resolves to the latest
 	*     version, so an explicit ARN is the only unambiguous override.)
-	*  2. `ListLayers` paginator + `ListTags(Resource: layerArn)` (which
-	*     returns a `Tags: Record<string,string>` map keyed by tag name).
-	*     Match `aws:cdk:path` and adopt `LatestMatchingVersion.LayerVersionArn`.
-	*
-	* **Caveat**: Lambda layer versions are immutable, so auto-lookup adopts
-	* the LATEST version of the named layer that carries the matching CDK
-	* path tag. If the user's CDK app has since published newer versions
-	* outside cdkd's tracking, the adopted physical id may be stale; pass
-	* `--resource <id>=<arn>` to pin a specific version.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -10393,35 +10184,7 @@ var LambdaLayerVersionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.lambdaClient.send(new ListLayersCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Layers,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (layer) => {
-				if (!layer.LayerArn || !layer.LatestMatchingVersion?.LayerVersionArn) return void 0;
-				try {
-					return await this.lambdaClient.send(new ListTagsCommand({ Resource: layer.LayerArn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.LatestMatchingVersion.LayerVersionArn,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -11486,11 +11249,6 @@ var DynamoDBTableProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override or `Properties.TableName` → verify via `DescribeTable`.
-	*  2. `ListTables` + `ListTagsOfResource`, match `aws:cdk:path` tag.
-	*
-	* Tags require the table ARN, which `DescribeTable` provides; the loop
-	* therefore costs one `DescribeTable` per table just to read the ARN.
-	* Acceptable for typical DynamoDB cardinalities.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "TableName");
@@ -11504,33 +11262,7 @@ var DynamoDBTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
-				return {
-					items: list.TableNames,
-					nextMarker: list.LastEvaluatedTableName
-				};
-			},
-			describe: async (name) => {
-				try {
-					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-					if (!arn) return void 0;
-					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$1) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -12704,7 +12436,6 @@ var DynamoDBGlobalTableProvider = class {
 	*
 	* Lookup order:
 	*   1. `--resource` override or `Properties.TableName` → verify via DescribeTable.
-	*   2. `ListTables` + `ListTagsOfResource`, match `aws:cdk:path` tag.
 	*
 	* Same shape as `DynamoDBTableProvider.import()`. The provider returns
 	* the physical id only; cdkd's import flow does the attribute capture
@@ -12722,33 +12453,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
-				return {
-					items: list.TableNames,
-					nextMarker: list.LastEvaluatedTableName
-				};
-			},
-			describe: async (name) => {
-				try {
-					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-					if (!arn) return void 0;
-					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$1) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 	async waitForTableActive(tableName, logicalId, maxAttempts = 120) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -13298,11 +13003,6 @@ var LogsLogGroupProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.LogGroupName` → verify via
 	*     `DescribeLogGroups` (filtered by name prefix).
-	*  2. `aws:cdk:path` tag match via `DescribeLogGroups` + `ListTagsForResource`.
-	*
-	* `ListTagsForResource` for log groups uses the log-group ARN. The
-	* `DescribeLogGroups` response includes the ARN, so no extra round-trip
-	* is needed beyond the per-group tag lookup.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "LogGroupName");
@@ -13315,36 +13015,7 @@ var LogsLogGroupProvider = class {
 			if (err instanceof ResourceNotFoundException$4) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.logsClient.send(new DescribeLogGroupsCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.logGroups,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (g) => {
-				if (!g.logGroupName || !g.arn) return void 0;
-				const arnForTags = g.arn.replace(/:\*$/, "");
-				try {
-					return await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$4) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.logGroupName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -13661,32 +13332,7 @@ var CloudWatchAlarmProvider = class {
 			if (this.isNotFound(err)) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.cloudWatchClient.send(new DescribeAlarmsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: [...list.MetricAlarms ?? [], ...list.CompositeAlarms ?? []],
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (a) => {
-				if (!a.AlarmArn || !a.AlarmName) return void 0;
-				try {
-					return await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: a.AlarmArn }));
-				} catch (err) {
-					if (this.isNotFound(err)) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.AlarmName,
-			attributes: {}
-		};
+		return null;
 	}
 	isNotFound(err) {
 		if (!(err instanceof Error)) return false;
@@ -13940,7 +13586,6 @@ var SecretsManagerSecretProvider = class {
 	* Lookup order:
 	*  1. `--resource` override (ARN) → verify via `DescribeSecret`.
 	*  2. `Properties.Name` → `DescribeSecret` (accepts name).
-	*  3. `aws:cdk:path` tag match via `ListSecrets` (which already returns Tags).
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -13964,24 +13609,7 @@ var SecretsManagerSecretProvider = class {
 			if (err instanceof ResourceNotFoundException$3) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.smClient.send(new ListSecretsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.SecretList,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (secret) => secret.ARN ? secret : void 0,
-			tagsOf: (secret) => secret.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.ARN,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -14251,12 +13879,10 @@ var SSMParameterProvider = class {
 	*
 	* SSM physical IDs ARE the parameter names (`/foo/bar`). The CDK template
 	* usually carries `Properties.Name` explicitly, so the explicit-name path
-	* covers most cases. The tag-based fallback is rarely needed.
+	* covers most cases.
 	*
 	* Lookup order:
 	*  1. `--resource` override or `Properties.Name` → verify via `GetParameter`.
-	*  2. `aws:cdk:path` tag match via `DescribeParameters` + `ListTagsForResource`
-	*     (`ResourceType: 'Parameter'`, `ResourceId: <name>`).
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
@@ -14270,35 +13896,7 @@ var SSMParameterProvider = class {
 			if (err instanceof ParameterNotFound) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.ssmClient.send(new DescribeParametersCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.Parameters,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (p) => {
-				if (!p.Name) return void 0;
-				try {
-					return await this.ssmClient.send(new ListTagsForResourceCommand$2({
-						ResourceType: "Parameter",
-						ResourceId: p.Name
-					}));
-				} catch (err) {
-					if (err instanceof ParameterNotFound) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.TagList
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -14580,12 +14178,6 @@ var EventBridgeRuleProvider = class {
 	*  2. If the template carries `Properties.Name` use that as the rule
 	*     name lookup, then verify with `DescribeRule` and return the
 	*     rule's ARN as physicalId.
-	*  3. Walk `ListRules(EventBusName?)` and match `aws:cdk:path` via
-	*     `ListTagsForResource(ResourceARN=rule.Arn)`. Returns the rule
-	*     ARN as physicalId — same shape that `create` returns.
-	*
-	* EventBridge tags use the standard `Tag[]` array shape
-	* (`Key`/`Value`).
 	*/
 	async import(input) {
 		const eventBusName = input.properties["EventBusName"];
@@ -14619,30 +14211,7 @@ var EventBridgeRuleProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.eventBridgeClient.send(new ListRulesCommand({
-					...eventBusName && { EventBusName: eventBusName },
-					...marker && { NextToken: marker }
-				}));
-				return {
-					items: list.Rules,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (rule) => {
-				if (!rule.Arn) return void 0;
-				return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: rule.Arn }));
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Arn,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Extract rule name from an ARN
@@ -14913,7 +14482,6 @@ var EventBridgeBusProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override or `Properties.Name` → verify via `DescribeEventBus`.
-	*  2. `aws:cdk:path` tag match via `ListEventBuses` + `ListTagsForResource`.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
@@ -14927,32 +14495,7 @@ var EventBridgeBusProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.eventBridgeClient.send(new ListEventBusesCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.EventBuses,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (bus) => {
-				if (!bus.Name || !bus.Arn) return void 0;
-				try {
-					return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: bus.Arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$2) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -16721,55 +16264,16 @@ var EC2Provider = class {
 	* is rule-level), and the typical adoption story is "find the VPC,
 	* cdkd reconstructs the rest at deploy time".
 	*
-	* EC2 supports `Filters: [{Name: 'tag:aws:cdk:path', Values: [path]}]`
-	* directly on `Describe*`, so the lookup is one API call per type.
+	* There is no `aws:cdk:path` tag lookup: AWS rejects `aws:`-prefixed tag
+	* writes, so that tag never exists on a real resource and a
+	* `Filters: [{Name: 'tag:aws:cdk:path', ...}]` `Describe*` could never
+	* match (issue #1134). Auto-mode import resolves ids from
+	* CloudFormation's `DescribeStackResources` or the template's
+	* physical-name property instead.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) return this.verifyExplicit(input.resourceType, input.knownPhysicalId);
-		if (!input.cdkPath) return null;
-		const tagFilter = {
-			Name: `tag:${CDK_PATH_TAG}`,
-			Values: [input.cdkPath]
-		};
-		try {
-			switch (input.resourceType) {
-				case "AWS::EC2::VPC": {
-					const vpc = (await this.ec2Client.send(new DescribeVpcsCommand({ Filters: [tagFilter] }))).Vpcs?.[0];
-					return vpc?.VpcId ? {
-						physicalId: vpc.VpcId,
-						attributes: {}
-					} : null;
-				}
-				case "AWS::EC2::Subnet": {
-					const subnet = (await this.ec2Client.send(new DescribeSubnetsCommand({ Filters: [tagFilter] }))).Subnets?.[0];
-					return subnet?.SubnetId ? {
-						physicalId: subnet.SubnetId,
-						attributes: {}
-					} : null;
-				}
-				case "AWS::EC2::SecurityGroup": {
-					const sg = (await this.ec2Client.send(new DescribeSecurityGroupsCommand({ Filters: [tagFilter] }))).SecurityGroups?.[0];
-					return sg?.GroupId ? {
-						physicalId: sg.GroupId,
-						attributes: {}
-					} : null;
-				}
-				case "AWS::EC2::NatGateway": {
-					const gw = (await this.ec2Client.send(new DescribeNatGatewaysCommand({ Filter: [{
-						Name: `tag:${CDK_PATH_TAG}`,
-						Values: [input.cdkPath]
-					}] }))).NatGateways?.find((g) => g.State !== "deleted" && g.State !== "deleting");
-					return gw?.NatGatewayId ? {
-						physicalId: gw.NatGatewayId,
-						attributes: {}
-					} : null;
-				}
-				default: return null;
-			}
-		} catch (error) {
-			if (this.isNotFoundError(error)) return null;
-			throw error;
-		}
+		return null;
 	}
 	/**
 	* Read the AWS-current EC2 networking resource configuration in
@@ -19298,8 +18802,11 @@ var ApiGatewayV2Provider = class {
 	/**
 	* Adopt an existing API Gateway V2 resource into cdkd state.
 	*
-	* `AWS::ApiGatewayV2::Api` supports full tag-based auto-lookup via
-	* `GetApis` (`Tags` is a `Record<string,string>` map on each item).
+	* `AWS::ApiGatewayV2::Api` resolves an explicit `--resource` override
+	* (verified via `GetApi`). There is no `aws:cdk:path` tag walk — AWS
+	* rejects `aws:`-prefixed tag writes, so that tag never exists on a real
+	* resource (issue #1134); auto-mode import resolves ids from
+	* CloudFormation's `DescribeStackResources` instead.
 	*
 	* Sub-resources (`Stage`, `Integration`, `Route`, `Authorizer`) are
 	* scoped under a parent `ApiId`, and their physical ids are not
@@ -19327,19 +18834,6 @@ var ApiGatewayV2Provider = class {
 			if (err instanceof NotFoundException$3) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new GetApisCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const api of list.Items ?? []) {
-				if (!api.ApiId) continue;
-				if (api.Tags?.["aws:cdk:path"] === input.cdkPath) return {
-					physicalId: api.ApiId,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
 	/**
@@ -20489,8 +19983,7 @@ var CloudFrontDistributionProvider = class {
 	*
 	* CloudFront distributions don't carry a template-supplied name
 	* (physical id is the AWS-generated `E...` distribution id), so the
-	* lookup is either explicit-override or `aws:cdk:path` tag match
-	* via `ListDistributions` + `ListTagsForResource(ARN)`.
+	* lookup is explicit-override only.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -20503,32 +19996,7 @@ var CloudFrontDistributionProvider = class {
 			if (err instanceof NoSuchDistribution) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.cloudFrontClient.send(new ListDistributionsCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DistributionList?.Items,
-					nextMarker: list.DistributionList?.IsTruncated ? list.DistributionList?.NextMarker : void 0
-				};
-			},
-			describe: async (d) => {
-				if (!d.Id || !d.ARN) return void 0;
-				try {
-					return await this.cloudFrontClient.send(new ListTagsForResourceCommand$3({ Resource: d.ARN }));
-				} catch (err) {
-					if (err instanceof NoSuchDistribution) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags?.Items
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Id,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -21529,10 +20997,6 @@ var StepFunctionsProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource <id>=<arn>` override → verify with `DescribeStateMachine`.
-	*  2. Walk `ListStateMachines` → `ListTagsForResource(arn)` via the shared
-	*     `importTagWalk` helper. SFN returns lowercase `key`/`value` tags, so
-	*     `tagsOf` maps them to the `Key`/`Value` shape the walk's
-	*     `aws:cdk:path` matcher expects.
 	*
 	* SFN state machines do not expose a template-supplied name field
 	* usable as a stable physicalId — the physicalId is the ARN — so the
@@ -21550,30 +21014,7 @@ var StepFunctionsProvider = class {
 			if (err instanceof StateMachineDoesNotExist) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListStateMachinesCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.stateMachines,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (sm) => {
-				if (!sm.stateMachineArn) return void 0;
-				return await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: sm.stateMachineArn }));
-			},
-			tagsOf: (tagsResp) => (tagsResp.tags ?? []).map((t) => ({
-				Key: t.key,
-				Value: t.value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.stateMachineArn,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via SFN's
@@ -22759,9 +22200,8 @@ var ECSProvider = class {
 	* Adopt an existing ECS resource into cdkd state.
 	*
 	* Supported types: `AWS::ECS::Cluster`, `AWS::ECS::Service`,
-	* `AWS::ECS::TaskDefinition`. ECS uses lowercase `key`/`value` tags
-	* (vs the standard CFn `Key`/`Value`), so the standard
-	* `matchesCdkPath` helper doesn't apply — match the tag manually.
+	* `AWS::ECS::TaskDefinition` — all explicit-override only (see the
+	* per-branch notes on why the `aws:cdk:path` tag walk was removed).
 	*
 	* Service has a composite physical id of `<clusterArn>|<serviceName>`
 	* (the form ECSProvider uses internally for mutation operations),
@@ -22788,19 +22228,6 @@ var ECSProvider = class {
 			if (this.isClusterNotFoundException(err) || this.isServiceNotFoundException(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListClustersCommand({ ...nextToken && { nextToken } }));
-			for (const arn of list.clusterArns ?? []) {
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ resourceArn: arn }));
-				if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
-					physicalId: arn.substring(arn.lastIndexOf("/") + 1),
-					attributes: {}
-				};
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
 		return null;
 	}
 	async importService(input) {
@@ -22808,29 +22235,6 @@ var ECSProvider = class {
 			physicalId: input.knownPhysicalId,
 			attributes: {}
 		};
-		if (!input.cdkPath) return null;
-		let clusterToken;
-		do {
-			const clusterList = await this.getClient().send(new ListClustersCommand({ ...clusterToken && { nextToken: clusterToken } }));
-			for (const clusterArn of clusterList.clusterArns ?? []) {
-				let svcToken;
-				do {
-					const svcList = await this.getClient().send(new ListServicesCommand({
-						cluster: clusterArn,
-						...svcToken && { nextToken: svcToken }
-					}));
-					for (const svcArn of svcList.serviceArns ?? []) {
-						const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$12({ resourceArn: svcArn }));
-						if (this.tagsMatchCdkPath(tagsResp.tags, input.cdkPath)) return {
-							physicalId: `${clusterArn}|${svcArn.substring(svcArn.lastIndexOf("/") + 1)}`,
-							attributes: {}
-						};
-					}
-					svcToken = svcList.nextToken;
-				} while (svcToken);
-			}
-			clusterToken = clusterList.nextToken;
-		} while (clusterToken);
 		return null;
 	}
 	async importTaskDefinition(input) {
@@ -22846,11 +22250,6 @@ var ECSProvider = class {
 		}
 		return null;
 	}
-	tagsMatchCdkPath(tags, cdkPath) {
-		if (!tags) return false;
-		for (const t of tags) if (t.key === "aws:cdk:path" && t.value === cdkPath) return true;
-		return false;
-	}
 };
 
 //#endregion
@@ -23521,16 +22920,12 @@ var ELBv2Provider = class {
 	/**
 	* Adopt an existing ELBv2 LoadBalancer or TargetGroup into cdkd state.
 	*
-	* Lookup order:
-	*  1. `--resource <id>=<arn>` override → verify with `DescribeLoadBalancers`
-	*     or `DescribeTargetGroups`.
-	*  2. Walk `DescribeLoadBalancers` / `DescribeTargetGroups` paginators →
-	*     batch-fetch tags for each ARN with `DescribeTags(ResourceArns)`
-	*     and match `aws:cdk:path` (standard `Key`/`Value` Tag[] shape).
+	* Lookup: `--resource <id>=<arn>` override → verify with
+	* `DescribeLoadBalancers` or `DescribeTargetGroups`. Without an override
+	* the resource is reported as not-found.
 	*
-	* Listener is not auto-importable (no template-supplied stable
-	* identifier and no convenient tag-by-LB-context shortcut); use
-	* `--resource <listenerId>=<arn>` for those.
+	* Listener is likewise not auto-importable (no template-supplied stable
+	* identifier); use `--resource <listenerId>=<arn>` for those.
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -23556,21 +22951,6 @@ var ELBv2Provider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeLoadBalancersCommand({ ...marker && { Marker: marker } }));
-			const arns = (list.LoadBalancers ?? []).map((lb) => lb.LoadBalancerArn).filter((arn) => Boolean(arn));
-			for (let i = 0; i < arns.length; i += 20) {
-				const batch = arns.slice(i, i + 20);
-				const tagsResp = await this.getClient().send(new DescribeTagsCommand({ ResourceArns: batch }));
-				for (const td of tagsResp.TagDescriptions ?? []) if (td.ResourceArn && matchesCdkPath(td.Tags, input.cdkPath)) return {
-					physicalId: td.ResourceArn,
-					attributes: {}
-				};
-			}
-			marker = list.NextMarker;
-		} while (marker);
 		return null;
 	}
 	async importTargetGroup(input) {
@@ -23584,21 +22964,6 @@ var ELBv2Provider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeTargetGroupsCommand({ ...marker && { Marker: marker } }));
-			const arns = (list.TargetGroups ?? []).map((tg) => tg.TargetGroupArn).filter((arn) => Boolean(arn));
-			for (let i = 0; i < arns.length; i += 20) {
-				const batch = arns.slice(i, i + 20);
-				const tagsResp = await this.getClient().send(new DescribeTagsCommand({ ResourceArns: batch }));
-				for (const td of tagsResp.TagDescriptions ?? []) if (td.ResourceArn && matchesCdkPath(td.Tags, input.cdkPath)) return {
-					physicalId: td.ResourceArn,
-					attributes: {}
-				};
-			}
-			marker = list.NextMarker;
-		} while (marker);
 		return null;
 	}
 	/**
@@ -24185,11 +23550,11 @@ var RDSProvider = class {
 	* Adopt an existing RDS resource into cdkd state.
 	*
 	* Supported types: `AWS::RDS::DBInstance`, `AWS::RDS::DBCluster`,
-	* `AWS::RDS::DBSubnetGroup`. Identifier name properties (`DBInstance
-	* Identifier` / `DBClusterIdentifier` / `DBSubnetGroupName`) are
-	* usually present in CDK templates; fall back to `aws:cdk:path` tag
-	* lookup via the corresponding `Describe*` + `ListTagsForResource`
-	* pair otherwise.
+	* `AWS::RDS::DBSubnetGroup`. Resolution is by identifier name property
+	* (`DBInstanceIdentifier` / `DBClusterIdentifier` / `DBSubnetGroupName`),
+	* which is usually present in CDK templates, verified against the
+	* corresponding `Describe*` call. A resource without one needs an
+	* explicit `--resource` override (issue #1134).
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -24335,19 +23700,6 @@ var RDSProvider = class {
 			if (err.name === "DBInstanceNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBInstancesCommand({ ...marker && { Marker: marker } }));
-			for (const inst of list.DBInstances ?? []) {
-				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
-					physicalId: inst.DBInstanceIdentifier,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importDBCluster(input) {
@@ -24362,19 +23714,6 @@ var RDSProvider = class {
 			if (err.name === "DBClusterNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBClustersCommand({ ...marker && { Marker: marker } }));
-			for (const c of list.DBClusters ?? []) {
-				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
-					physicalId: c.DBClusterIdentifier,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importDBSubnetGroup(input) {
@@ -24389,19 +23728,6 @@ var RDSProvider = class {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand({ ...marker && { Marker: marker } }));
-			for (const sg of list.DBSubnetGroups ?? []) {
-				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$9({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
-					physicalId: sg.DBSubnetGroupName,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 };
@@ -24439,8 +23765,9 @@ const POLL_TIMEOUT_MS$1 = 1800 * 1e3;
 *   point is treated as idempotent success (region-match-gated).
 * - `getAttribute`: `DescribeDBProxies` for `Endpoint` / `DBProxyArn` /
 *   `VpcId`, cached per `(physicalId, attribute)`.
-* - `import`: explicit `--resource` override OR auto-lookup via
-*   `DescribeDBProxies` + `ListTagsForResource` matching `aws:cdk:path`.
+* - `import`: explicit `--resource` override or the template's
+*   `DBProxyName` property (issue #1134 removed the unreachable
+*   `aws:cdk:path` tag walk).
 *
 * **physicalId** = DBProxyName (matches CFn `primaryIdentifier`).
 */
@@ -24615,23 +23942,6 @@ var RDSDBProxyProvider = class {
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBProxyName");
 		if (explicit) return this.buildImportResult(explicit);
-		const client = this.getClient();
-		let marker;
-		do {
-			const describe = await client.send(new DescribeDBProxiesCommand({
-				Marker: marker,
-				MaxRecords: 100
-			}));
-			for (const proxy of describe.DBProxies ?? []) {
-				if (!proxy.DBProxyArn) continue;
-				try {
-					if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$9({ ResourceName: proxy.DBProxyArn }))).TagList ?? [], input.cdkPath)) return this.buildImportResult(proxy.DBProxyName ?? "");
-				} catch (error) {
-					this.logger.debug(`ListTagsForResource failed for ${proxy.DBProxyName}: ${error instanceof Error ? error.message : String(error)}`);
-				}
-			}
-			marker = describe.Marker;
-		} while (marker);
 		return null;
 	}
 	/**
@@ -24791,9 +24101,9 @@ const POLL_TIMEOUT_MS = 1800 * 1e3;
 *   is already gone via CASCADE, the endpoint is too.
 * - `getAttribute`: `Endpoint` / `DBProxyEndpointArn` / `IsDefault` / `VpcId`
 *   via `DescribeDBProxyEndpoints`, cached per `(physicalId, attribute)`.
-* - `import`: explicit `--resource <id>=<DBProxyEndpointName>` first; falls
-*   back to paginated auto-lookup via `DescribeDBProxyEndpoints` +
-*   `ListTagsForResource` matching `aws:cdk:path`.
+* - `import`: explicit `--resource <id>=<DBProxyEndpointName>` or the
+*   template's `DBProxyEndpointName` property (issue #1134 removed the
+*   unreachable `aws:cdk:path` tag walk).
 *
 * **physicalId** = DBProxyEndpointName (matches CFn `primaryIdentifier`).
 */
@@ -24953,23 +24263,6 @@ var RDSDBProxyEndpointProvider = class {
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBProxyEndpointName");
 		if (explicit) return this.buildImportResult(explicit);
-		const client = this.getClient();
-		let marker;
-		do {
-			const describe = await client.send(new DescribeDBProxyEndpointsCommand({
-				Marker: marker,
-				MaxRecords: 100
-			}));
-			for (const ep of describe.DBProxyEndpoints ?? []) {
-				if (!ep.DBProxyEndpointArn) continue;
-				try {
-					if (matchesCdkPath((await client.send(new ListTagsForResourceCommand$9({ ResourceName: ep.DBProxyEndpointArn }))).TagList ?? [], input.cdkPath)) return this.buildImportResult(ep.DBProxyEndpointName ?? "");
-				} catch (error) {
-					this.logger.debug(`ListTagsForResource failed for ${ep.DBProxyEndpointName}: ${error instanceof Error ? error.message : String(error)}`);
-				}
-			}
-			marker = describe.Marker;
-		} while (marker);
 		return null;
 	}
 	async readCurrentState(physicalId) {
@@ -25855,11 +25148,10 @@ var DocDBProvider = class {
 	* Supported types: `AWS::DocDB::DBInstance`, `AWS::DocDB::DBCluster`,
 	* `AWS::DocDB::DBSubnetGroup`. Identifier name properties (`DBInstance
 	* Identifier` / `DBClusterIdentifier` / `DBSubnetGroupName`) are usually
-	* present in CDK templates; fall back to `aws:cdk:path` tag lookup via
-	* the corresponding `Describe*` + `ListTagsForResource` pair otherwise.
-	* The fallback walk runs through the shared `importTagWalk` helper, so the
-	* N+1 `ListTagsForResource` burst is retried with exponential backoff when
-	* AWS throttles it instead of aborting the whole import.
+	* present in CDK templates and are resolved via the corresponding
+	* `Describe*` existence check. There is no `aws:cdk:path` tag fallback:
+	* AWS rejects `aws:`-prefixed tag writes, so that tag never exists on a
+	* real resource and the walk could not match (issue #1134).
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -25958,7 +25250,7 @@ var DocDBProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`DocDB ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -25975,24 +25267,7 @@ var DocDBProvider = class {
 			if (err.name === "DBInstanceNotFoundFault") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeDBInstancesCommand$1({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DBInstances,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (inst) => inst.DBInstanceIdentifier && inst.DBInstanceArn ? await this.listTagsForResource(inst.DBInstanceArn) : void 0,
-			tagsOf: (tags) => tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.DBInstanceIdentifier,
-			attributes: {}
-		};
+		return null;
 	}
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
@@ -26006,24 +25281,7 @@ var DocDBProvider = class {
 			if (err.name === "DBClusterNotFoundFault") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeDBClustersCommand$1({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DBClusters,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (c) => c.DBClusterIdentifier && c.DBClusterArn ? await this.listTagsForResource(c.DBClusterArn) : void 0,
-			tagsOf: (tags) => tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.DBClusterIdentifier,
-			attributes: {}
-		};
+		return null;
 	}
 	async importDBSubnetGroup(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBSubnetGroupName");
@@ -26037,33 +25295,7 @@ var DocDBProvider = class {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$1({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DBSubnetGroups,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (sg) => sg.DBSubnetGroupName && sg.DBSubnetGroupArn ? await this.listTagsForResource(sg.DBSubnetGroupArn) : void 0,
-			tagsOf: (tags) => tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.DBSubnetGroupName,
-			attributes: {}
-		};
-	}
-	/**
-	* `ListTagsForResource` for the tag-walk import path. Returns the tag list
-	* (possibly empty) so `importTagWalk` can match `aws:cdk:path` against it;
-	* `undefined` is reserved for "skip this candidate", which the callers signal
-	* before calling this.
-	*/
-	async listTagsForResource(resourceArn) {
-		return (await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: resourceArn }))).TagList ?? [];
+		return null;
 	}
 };
 
@@ -26649,7 +25881,7 @@ var NeptuneProvider = class {
 	*/
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: arn }))).TagList);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$13({ ResourceName: arn }))).TagList);
 		} catch (err) {
 			this.logger.debug(`Neptune ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -26666,19 +25898,6 @@ var NeptuneProvider = class {
 			if (err.name === "DBInstanceNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBInstancesCommand$2({ ...marker && { Marker: marker } }));
-			for (const inst of list.DBInstances ?? []) {
-				if (!inst.DBInstanceIdentifier || !inst.DBInstanceArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: inst.DBInstanceArn }))).TagList, input.cdkPath)) return {
-					physicalId: inst.DBInstanceIdentifier,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importDBCluster(input) {
@@ -26693,19 +25912,6 @@ var NeptuneProvider = class {
 			if (err.name === "DBClusterNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBClustersCommand$2({ ...marker && { Marker: marker } }));
-			for (const c of list.DBClusters ?? []) {
-				if (!c.DBClusterIdentifier || !c.DBClusterArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: c.DBClusterArn }))).TagList, input.cdkPath)) return {
-					physicalId: c.DBClusterIdentifier,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importDBSubnetGroup(input) {
@@ -26720,19 +25926,6 @@ var NeptuneProvider = class {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$2({ ...marker && { Marker: marker } }));
-			for (const sg of list.DBSubnetGroups ?? []) {
-				if (!sg.DBSubnetGroupName || !sg.DBSubnetGroupArn) continue;
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceName: sg.DBSubnetGroupArn }))).TagList, input.cdkPath)) return {
-					physicalId: sg.DBSubnetGroupName,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 };
@@ -27469,28 +26662,6 @@ var Route53Provider = class {
 			if (err instanceof Error && err.name === "NoSuchHostedZone") return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new ListHostedZonesCommand({ ...marker && { Marker: marker } }));
-			for (const zone of list.HostedZones ?? []) {
-				if (!zone.Id) continue;
-				const zoneId = zone.Id.replace("/hostedzone/", "");
-				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$7({
-						ResourceType: "hostedzone",
-						ResourceId: zoneId
-					}))).ResourceTagSet?.Tags, input.cdkPath)) return {
-						physicalId: zoneId,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof Error && err.name === "NoSuchHostedZone") continue;
-					throw err;
-				}
-			}
-			marker = list.IsTruncated ? list.NextMarker : void 0;
-		} while (marker);
 		return null;
 	}
 };
@@ -28018,19 +27189,13 @@ var CognitoUserPoolProvider = class {
 	*  1. `--resource` override → `DescribeUserPool` to verify.
 	*  2. `Properties.UserPoolName` (when CDK template carries it) →
 	*     `ListUserPools` walk + name match.
-	*  3. `aws:cdk:path` tag match via `ListUserPools` +
-	*     `ListTagsForResource(<arn>)`. Cognito's tag map uses the same
-	*     `Tags: { [key]: value }` shape as Lambda.
-	*
-	* Steps 2 and 3 share ONE `ListUserPools` walk (per candidate: name check
-	* first, then the two tag reads, only when a `cdkPath` is present), which
-	* runs through the shared `importTagWalk` helper so the N+1 read burst
-	* (DescribeUserPool for the ARN, then ListTagsForResource) is retried with
-	* exponential backoff when AWS throttles it instead of aborting the whole
-	* import. The name match is expressed to the walk as a synthetic
-	* `aws:cdk:path` tag carrying the walk's own lookup key, so a name-only
-	* template (no CDK path metadata) still resolves without any per-candidate
-	* API call, matching the previous inline loop.
+	*
+	* The `aws:cdk:path` tag match that used to ride the same `ListUserPools`
+	* walk is gone (issue #1134): AWS rejects `aws:`-prefixed tag writes, so
+	* that tag never exists on a real resource and the walk could not match.
+	* Auto-mode import resolves ids from CloudFormation's
+	* `DescribeStackResources` or the template's physical name; without a
+	* `UserPoolName` there is nothing to match.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -28044,48 +27209,20 @@ var CognitoUserPoolProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
-		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:cognito-user-pool-name:${desiredName}` : void 0);
-		/** Sentinel detail for a candidate matched by its user pool name. */
-		const NAME_MATCH = { nameMatch: true };
-		const match = await importTagWalk({
-			cdkPath: walkCdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListUserPoolsCommand({
-					MaxResults: 60,
-					...marker && { NextToken: marker }
-				}));
-				return {
-					items: list.UserPools,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (pool) => {
-				if (!pool.Id) return void 0;
-				if (desiredName && pool.Name === desiredName) return NAME_MATCH;
-				if (!input.cdkPath) return void 0;
-				try {
-					const arn = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }))).UserPool?.Arn;
-					if (!arn) return void 0;
-					return await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceArn: arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$7) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (detail) => "nameMatch" in detail ? [{
-				Key: CDK_PATH_TAG,
-				Value: walkCdkPath
-			}] : Object.entries(detail.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Id,
-			attributes: {}
-		};
+		if (!desiredName) return null;
+		let marker;
+		do {
+			const list = await this.getClient().send(new ListUserPoolsCommand({
+				MaxResults: 60,
+				...marker && { NextToken: marker }
+			}));
+			for (const pool of list.UserPools ?? []) if (pool.Id && pool.Name === desiredName) return {
+				physicalId: pool.Id,
+				attributes: {}
+			};
+			marker = list.NextToken;
+		} while (marker);
+		return null;
 	}
 };
 
@@ -28103,8 +27240,6 @@ var CognitoUserPoolProvider = class {
 */
 var ElastiCacheProvider = class {
 	client;
-	stsClient;
-	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("ElastiCacheProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::ElastiCache::SubnetGroup", /* @__PURE__ */ new Set([
@@ -28520,17 +27655,11 @@ var ElastiCacheProvider = class {
 	/**
 	* Adopt an existing ElastiCache resource into cdkd state.
 	*
-	* Supported types:
-	*  - `AWS::ElastiCache::CacheCluster` — full tag-based lookup via
-	*    `DescribeCacheClusters` + `ListTagsForResource(ResourceName=arn)`.
-	*  - `AWS::ElastiCache::SubnetGroup` — full tag-based lookup via
-	*    `DescribeCacheSubnetGroups` + `ListTagsForResource(ResourceName=arn)`.
-	*
-	* `ListTagsForResource` requires an ARN. Both `CacheCluster.ARN` and
-	* `CacheSubnetGroup.ARN` are returned by the Describe APIs, so no
-	* extra reconstruction is needed in normal flow; for the explicit
-	* override path we build the ARN from `region` + STS account id +
-	* the resource name.
+	* Supported types (both resolve from an explicit `--resource` override
+	* or the template's physical-name property, verified via the matching
+	* `Describe*` call):
+	*  - `AWS::ElastiCache::CacheCluster` — `Properties.ClusterName`.
+	*  - `AWS::ElastiCache::SubnetGroup` — `Properties.CacheSubnetGroupName`.
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -28551,20 +27680,6 @@ var ElastiCacheProvider = class {
 			if (this.isNotFoundError(err, "CacheClusterNotFoundFault")) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeCacheClustersCommand({ ...marker && { Marker: marker } }));
-			for (const c of list.CacheClusters ?? []) {
-				if (!c.CacheClusterId) continue;
-				const arn = c.ARN ?? await this.buildClusterArn(c.CacheClusterId);
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList, input.cdkPath)) return {
-					physicalId: c.CacheClusterId,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
 	async importSubnetGroup(input) {
@@ -28579,39 +27694,8 @@ var ElastiCacheProvider = class {
 			if (this.isNotFoundError(err, "CacheSubnetGroupNotFoundFault")) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeCacheSubnetGroupsCommand({ ...marker && { Marker: marker } }));
-			for (const g of list.CacheSubnetGroups ?? []) {
-				if (!g.CacheSubnetGroupName) continue;
-				const arn = g.ARN ?? await this.buildSubnetGroupArn(g.CacheSubnetGroupName);
-				if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$10({ ResourceName: arn }))).TagList, input.cdkPath)) return {
-					physicalId: g.CacheSubnetGroupName,
-					attributes: {}
-				};
-			}
-			marker = list.Marker;
-		} while (marker);
 		return null;
 	}
-	async buildClusterArn(clusterName) {
-		return `arn:aws:elasticache:${await this.getRegion()}:${await this.getAccountId()}:cluster:${clusterName}`;
-	}
-	async buildSubnetGroupArn(subnetGroupName) {
-		return `arn:aws:elasticache:${await this.getRegion()}:${await this.getAccountId()}:subnetgroup:${subnetGroupName}`;
-	}
-	async getRegion() {
-		return await this.getClient().config.region() || this.providerRegion || "us-east-1";
-	}
-	async getAccountId() {
-		if (this.cachedAccountId) return this.cachedAccountId;
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
-		const identity = await this.stsClient.send(new GetCallerIdentityCommand({}));
-		if (!identity.Account) throw new Error("Failed to resolve AWS account id from STS");
-		this.cachedAccountId = identity.Account;
-		return this.cachedAccountId;
-	}
 };
 
 //#endregion
@@ -29331,7 +28415,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: arn }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }))).Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -29373,25 +28457,17 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["Name"] === "string" ? input.properties["Name"] : void 0;
+		if (!desiredName) return null;
 		let token;
 		do {
 			const list = await this.getClient().send(new ListNamespacesCommand({ ...token && { NextToken: token } }));
 			for (const ns of list.Namespaces ?? []) {
 				if (!ns.Id || !ns.Arn) continue;
 				if (expectedKind && ns.Type && ns.Type !== expectedKind) continue;
-				if (desiredName && ns.Name === desiredName) return {
+				if (ns.Name === desiredName) return {
 					physicalId: ns.Id,
 					attributes: {}
 				};
-				if (input.cdkPath) try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: ns.Arn }))).Tags, input.cdkPath)) return {
-						physicalId: ns.Id,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof NamespaceNotFound) continue;
-					throw err;
-				}
 			}
 			token = list.NextToken;
 		} while (token);
@@ -29408,24 +28484,6 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			if (err instanceof ServiceNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let token;
-		do {
-			const list = await this.getClient().send(new ListServicesCommand$1({ ...token && { NextToken: token } }));
-			for (const svc of list.Services ?? []) {
-				if (!svc.Id || !svc.Arn) continue;
-				try {
-					if (matchesCdkPath((await this.getClient().send(new ListTagsForResourceCommand$16({ ResourceARN: svc.Arn }))).Tags, input.cdkPath)) return {
-						physicalId: svc.Id,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof ServiceNotFound) continue;
-					throw err;
-				}
-			}
-			token = list.NextToken;
-		} while (token);
 		return null;
 	}
 	/**
@@ -30318,11 +29376,13 @@ var AppSyncProvider = class {
 	/**
 	* Adopt an existing AppSync resource into cdkd state.
 	*
-	* `AWS::AppSync::GraphQLApi` supports full tag-based auto-lookup via
-	* `ListGraphqlApis` (each item carries a `tags` map). AppSync sub-resources
+	* `AWS::AppSync::GraphQLApi` resolves an explicit `--resource` override
+	* (verified via `GetGraphqlApi`). There is no `aws:cdk:path` tag walk —
+	* AWS rejects `aws:`-prefixed tag writes, so that tag never exists on a
+	* real resource (issue #1134); auto-mode import resolves ids from
+	* CloudFormation's `DescribeStackResources` instead. AppSync sub-resources
 	* (`GraphQLSchema`, `DataSource`, `Resolver`, `ApiKey`) are scoped under a
-	* parent `apiId` and cannot be discovered by tag at the account level —
-	* explicit-override only.
+	* parent `apiId` — explicit-override only.
 	*/
 	async import(input) {
 		if (input.resourceType !== "AWS::AppSync::GraphQLApi") {
@@ -30343,19 +29403,6 @@ var AppSyncProvider = class {
 			if (err instanceof NotFoundException$4) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListGraphqlApisCommand({ ...nextToken && { nextToken } }));
-			for (const api of list.graphqlApis ?? []) {
-				if (!api.apiId) continue;
-				if (api.tags?.["aws:cdk:path"] === input.cdkPath) return {
-					physicalId: api.apiId,
-					attributes: {}
-				};
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
 		return null;
 	}
 };
@@ -30374,8 +29421,6 @@ var AppSyncProvider = class {
 */
 var GlueProvider = class {
 	client;
-	stsClient;
-	cachedAccountId;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("GlueProvider");
 	handledProperties = /* @__PURE__ */ new Map([["AWS::Glue::Database", /* @__PURE__ */ new Set([
@@ -30621,16 +29666,11 @@ var GlueProvider = class {
 	/**
 	* Adopt an existing Glue Database or Table into cdkd state.
 	*
-	* Lookup order (per type):
-	*  1. Explicit override / template name → verify with `GetDatabase`
-	*     or `GetTable`.
-	*  2. Walk `GetDatabases` / `GetTables` paginators and match the
-	*     `aws:cdk:path` tag via `GetTags(ResourceArn)`. Glue tags are
-	*     a `Record<string,string>` map (not a `Tag[]` array), so the
-	*     match is `tags?.[CDK_PATH_TAG] === input.cdkPath`.
-	*
-	* Glue list APIs return only names — ARNs are constructed locally
-	* for the per-item GetTags call.
+	* Lookup (per type): explicit override / template name → verify with
+	* `GetDatabase` or `GetTable`. There is no `aws:cdk:path` tag walk — AWS
+	* rejects `aws:`-prefixed tag writes, so that tag never exists on a real
+	* resource (issue #1134); auto-mode import resolves ids from
+	* CloudFormation's `DescribeStackResources` instead.
 	*/
 	/**
 	* Read the AWS-current Glue resource configuration in CFn-property shape.
@@ -30751,23 +29791,6 @@ var GlueProvider = class {
 			if (err instanceof EntityNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new GetDatabasesCommand({
-				...nextToken && { NextToken: nextToken },
-				...catalogId && { CatalogId: catalogId }
-			}));
-			for (const db of list.DatabaseList ?? []) {
-				if (!db.Name) continue;
-				const arn = await this.buildDatabaseArn(db.Name, db.CatalogId);
-				if (await this.tagsMatchCdkPath(arn, input.cdkPath)) return {
-					physicalId: db.Name,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
 	async importTable(input) {
@@ -30806,51 +29829,8 @@ var GlueProvider = class {
 			if (err instanceof EntityNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath || !databaseName) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new GetTablesCommand({
-				DatabaseName: databaseName,
-				...nextToken && { NextToken: nextToken },
-				...catalogId && { CatalogId: catalogId }
-			}));
-			for (const t of list.TableList ?? []) {
-				if (!t.Name) continue;
-				const arn = await this.buildTableArn(databaseName, t.Name, catalogId);
-				if (await this.tagsMatchCdkPath(arn, input.cdkPath)) return {
-					physicalId: `${databaseName}|${t.Name}`,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
-	async tagsMatchCdkPath(arn, cdkPath) {
-		try {
-			return (await this.getClient().send(new GetTagsCommand({ ResourceArn: arn }))).Tags?.[CDK_PATH_TAG] === cdkPath;
-		} catch (err) {
-			if (err instanceof EntityNotFoundException) return false;
-			throw err;
-		}
-	}
-	async buildDatabaseArn(databaseName, catalogId) {
-		return `arn:aws:glue:${await this.getRegion()}:${catalogId ?? await this.getAccountId()}:database/${databaseName}`;
-	}
-	async buildTableArn(databaseName, tableName, catalogId) {
-		return `arn:aws:glue:${await this.getRegion()}:${catalogId ?? await this.getAccountId()}:table/${databaseName}/${tableName}`;
-	}
-	async getRegion() {
-		return await this.getClient().config.region() || this.providerRegion || "us-east-1";
-	}
-	async getAccountId() {
-		if (this.cachedAccountId) return this.cachedAccountId;
-		if (!this.stsClient) this.stsClient = new STSClient(this.providerRegion ? { region: this.providerRegion } : {});
-		const identity = await this.stsClient.send(new GetCallerIdentityCommand({}));
-		if (!identity.Account) throw new Error("Failed to resolve AWS account id from STS");
-		this.cachedAccountId = identity.Account;
-		return this.cachedAccountId;
-	}
 };
 /**
 * SDK Provider for `AWS::Glue::Workflow`.
@@ -30996,29 +29976,8 @@ var GlueWorkflowProvider = class {
 			if (err instanceof EntityNotFoundException) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListWorkflowsCommand({ ...nextToken && { NextToken: nextToken } }));
-			for (const name of list.Workflows ?? []) {
-				const arn = await this.buildWorkflowArn(name);
-				if (await this.tagsMatchCdkPath(arn, input.cdkPath)) return {
-					physicalId: name,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
-	async tagsMatchCdkPath(arn, cdkPath) {
-		try {
-			return (await this.getClient().send(new GetTagsCommand({ ResourceArn: arn }))).Tags?.[CDK_PATH_TAG] === cdkPath;
-		} catch (err) {
-			if (err instanceof EntityNotFoundException) return false;
-			throw err;
-		}
-	}
 	async buildWorkflowArn(workflowName) {
 		return `arn:aws:glue:${await this.getRegion()}:${await this.getAccountId()}:workflow/${workflowName}`;
 	}
@@ -31136,15 +30095,6 @@ var GlueSecurityConfigurationProvider = class {
 			if (err instanceof EntityNotFoundException) return null;
 			throw err;
 		}
-		if (!explicitName) {
-			let nextToken;
-			do {
-				const list = await this.getClient().send(new GetSecurityConfigurationsCommand({ ...nextToken && { NextToken: nextToken } }));
-				for (const _entry of list.SecurityConfigurations ?? []);
-				nextToken = list.NextToken;
-			} while (nextToken);
-			return null;
-		}
 		return null;
 	}
 };
@@ -32548,8 +31498,8 @@ var KMSProvider = class {
 	* KMS keys have no `Properties.KeyName` field — physical IDs are
 	* AWS-generated UUIDs. So:
 	*  - For `AWS::KMS::Key`: `--resource MyKey=<keyId>` is the only explicit
-	*    path; auto-lookup walks `ListKeys` + `ListResourceTags` matching
-	*    `aws:cdk:path`.
+	*    path; there is no auto-lookup (a key reaching here without an explicit
+	*    id or a CloudFormation-resolved physical id returns `null`).
 	*  - For `AWS::KMS::Alias`: `Properties.AliasName` is explicit and reliable.
 	*/
 	async import(input) {
@@ -32582,36 +31532,7 @@ var KMSProvider = class {
 			if (err instanceof NotFoundException$2) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListKeysCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Keys,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (key) => {
-				if (!key.KeyId) return void 0;
-				try {
-					return await this.getClient().send(new ListResourceTagsCommand({ KeyId: key.KeyId }));
-				} catch (err) {
-					if (err.name === "AccessDeniedException" || err instanceof NotFoundException$2) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => (tagsResp.Tags ?? []).map((t) => ({
-				Key: t.TagKey,
-				Value: t.TagValue
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.KeyId,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -33059,9 +31980,6 @@ var BudgetsBudgetProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.Budget.BudgetName` → verify via
 	*     `DescribeBudget`.
-	*  2. `aws:cdk:path` tag match: walk `DescribeBudgets` and check each
-	*     budget's tags via `ListTagsForResource` (budget ARNs are
-	*     region-free, so the lookup works from any deploy region).
 	*/
 	async import(input) {
 		const rawBudget = input.properties["Budget"] ?? {};
@@ -33081,31 +31999,7 @@ var BudgetsBudgetProvider = class {
 			if (error instanceof NotFoundException$5) return null;
 			throw error;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await client.send(new DescribeBudgetsCommand({
-					AccountId: accountId,
-					...marker && { NextToken: marker }
-				}));
-				return {
-					items: list.Budgets,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (budget) => {
-				if (!budget.BudgetName) return void 0;
-				return await client.send(new ListTagsForResourceCommand$17({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }));
-			},
-			tagsOf: (tags) => tags.ResourceTags
-		});
-		if (!match) return null;
-		const budgetName = match.summary.BudgetName;
-		return {
-			physicalId: budgetName,
-			attributes: { Arn: this.budgetArn(accountId, budgetName) }
-		};
+		return null;
 	}
 };
 
@@ -33359,14 +32253,6 @@ var KinesisStreamProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.Name` → verify
 	*     with `DescribeStream`.
-	*  2. Walk `ListStreams` (paged via `ExclusiveStartStreamName`) and
-	*     match the `aws:cdk:path` tag via `ListTagsForStream(StreamName)`.
-	*     The walk runs through the shared `importTagWalk` helper, so the N+1
-	*     tag-read burst is retried with exponential backoff when AWS
-	*     throttles it instead of aborting the whole import.
-	*
-	* Kinesis tags use the standard `Tag[]` array shape (`Key`/`Value`),
-	* so the walk's `matchesCdkPath` matcher applies directly.
 	*/
 	/**
 	* Read the AWS-current Kinesis stream configuration in CFn-property shape.
@@ -33430,25 +32316,7 @@ var KinesisStreamProvider = class {
 			if (err instanceof ResourceNotFoundException$8) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListStreamsCommand({ ...marker && { ExclusiveStartStreamName: marker } }));
-				const names = list.StreamNames ?? [];
-				return {
-					items: names,
-					nextMarker: list.HasMoreStreams && names.length > 0 ? names[names.length - 1] : void 0
-				};
-			},
-			describe: async (streamName) => await this.getClient().send(new ListTagsForStreamCommand({ StreamName: streamName })),
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Poll DescribeStream until the stream reaches ACTIVE status
@@ -33678,7 +32546,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ ResourceARN: physicalId }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$8) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -34595,19 +33463,6 @@ var EFSProvider = class {
 			if (err instanceof FileSystemNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeFileSystemsCommand({ ...marker && { Marker: marker } }));
-			for (const fs of list.FileSystems ?? []) {
-				if (!fs.FileSystemId) continue;
-				if (matchesCdkPath(fs.Tags, input.cdkPath)) return {
-					physicalId: fs.FileSystemId,
-					attributes: {}
-				};
-			}
-			marker = list.NextMarker;
-		} while (marker);
 		return null;
 	}
 	async importAccessPoint(input) {
@@ -34621,23 +33476,6 @@ var EFSProvider = class {
 			if (err instanceof AccessPointNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const fileSystemId = input.properties["FileSystemId"];
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new DescribeAccessPointsCommand({
-				...nextToken && { NextToken: nextToken },
-				...fileSystemId && { FileSystemId: fileSystemId }
-			}));
-			for (const ap of list.AccessPoints ?? []) {
-				if (!ap.AccessPointId) continue;
-				if (matchesCdkPath(ap.Tags, input.cdkPath)) return {
-					physicalId: ap.AccessPointId,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
 };
@@ -35748,8 +34586,8 @@ var FSxFileSystemProvider = class {
 	}
 	/**
 	* Adopt an existing FSx file system into cdkd state. Explicit physical
-	* id is verified via `DescribeFileSystems`; otherwise a paginated walk
-	* matches the `aws:cdk:path` tag (`Tags` ride inline on each item).
+	* id is verified via `DescribeFileSystems`; without an override the
+	* resource is reported as not-found.
 	*/
 	async import(input) {
 		if (input.resourceType !== "AWS::FSx::FileSystem") return null;
@@ -35763,19 +34601,6 @@ var FSxFileSystemProvider = class {
 			if (err instanceof FileSystemNotFound$1) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new DescribeFileSystemsCommand$1({ ...nextToken && { NextToken: nextToken } }));
-			for (const fs of list.FileSystems ?? []) {
-				if (!fs.FileSystemId) continue;
-				if (matchesCdkPath(fs.Tags, input.cdkPath)) return {
-					physicalId: fs.FileSystemId,
-					attributes: this.buildAttributes(fs)
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
 };
@@ -35801,18 +34626,6 @@ const CREATE_READY_STATES = /* @__PURE__ */ new Set(["WAITING", "RUNNING"]);
 */
 const TERMINAL_STATES = /* @__PURE__ */ new Set(["TERMINATED", "TERMINATED_WITH_ERRORS"]);
 /**
-* Cluster states that mean "the cluster is alive" — the `ListClusters` filter
-* used by `import()` discovery so a long-gone `TERMINATED*` cluster is never
-* adopted. Everything except the two `TERMINAL_STATES`.
-*/
-const NON_TERMINATED_STATES = [
-	"STARTING",
-	"BOOTSTRAPPING",
-	"RUNNING",
-	"WAITING",
-	"TERMINATING"
-];
-/**
 * Top-level CFn properties that map to a MUTABLE EMR API surface. Every other
 * property is either registry-createOnly (routed through DELETE+CREATE by the
 * replacement-detection layer) or lives inside the `Instances` block (handled
@@ -36321,12 +35134,6 @@ var EMRClusterProvider = class {
 	*     the physical id — a cluster's id (`j-...`) is service-generated, while
 	*     the template `Name` is only the display name — so no name fallback
 	*     applies (`resolveExplicitPhysicalId(..., null)`).
-	*  2. Tag-based lookup: `ListClusters` filtered to the non-terminated states
-	*     (a `TERMINATED*` cluster is gone and must never be adopted), then a
-	*     `DescribeCluster` per candidate to read `Tags` (the list summaries do
-	*     NOT carry tags) and match `aws:cdk:path`. The walk runs through the
-	*     shared `importTagWalk` helper, so each list page / describe is retried
-	*     with exponential backoff when AWS throttles the N+1 read burst.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, null);
@@ -36338,42 +35145,20 @@ var EMRClusterProvider = class {
 				attributes: this.buildAttributes(cluster)
 			};
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListClustersCommand$1({
-					ClusterStates: [...NON_TERMINATED_STATES],
-					...marker && { Marker: marker }
-				}));
-				return {
-					items: list.Clusters,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (summary) => summary.Id ? await this.describeClusterOrUndefined(summary.Id) : void 0,
-			tagsOf: (cluster) => cluster.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Id,
-			attributes: this.buildAttributes(match.detail)
-		};
+		return null;
 	}
 	/**
 	* `DescribeCluster` that maps a not-found (`InvalidRequestException` — the
 	* cluster id is unknown in this region / aged out of Describe) to
 	* `undefined` instead of throwing, so `import()` can treat it as "no match"
-	* rather than aborting the whole adoption run.
+	* rather than aborting the whole adoption run. Also consumed by
+	* `readCurrentState` for the same gone-cluster tolerance.
 	*
-	* `undefined`, NOT `null`, is load-bearing: `importTagWalk` skips a candidate
-	* on `detail === undefined`, and an actual `null` would flow into `tagsOf`
-	* and `TypeError`. Also note the mapping is BROAD — `InvalidRequestException`
-	* covers more than not-found, so a genuine failure here degrades to "no
-	* match" and a subsequent deploy would CREATE a duplicate cluster rather than
-	* adopt the existing one. The walk logs each skip at debug so the case is at
-	* least visible under `--verbose`; narrowing the mapping needs a
-	* message/code-level discriminator AWS does not currently document.
+	* Note the mapping is BROAD — `InvalidRequestException` covers more than
+	* not-found, so a genuine failure here degrades to "no match" and a
+	* subsequent deploy would CREATE a duplicate cluster rather than adopt the
+	* existing one. Narrowing the mapping needs a message/code-level
+	* discriminator AWS does not currently document.
 	*/
 	async describeClusterOrUndefined(clusterId) {
 		try {
@@ -38305,25 +37090,7 @@ var FirehoseProvider = class {
 			if (err instanceof ResourceNotFoundException$10) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListDeliveryStreamsCommand({ ...marker && { ExclusiveStartDeliveryStreamName: marker } }));
-				const names = list.DeliveryStreamNames ?? [];
-				return {
-					items: names,
-					nextMarker: list.HasMoreDeliveryStreams && names.length > 0 ? names[names.length - 1] : void 0
-				};
-			},
-			describe: async (name) => await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: name })),
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Wait for a delivery stream to become ACTIVE.
@@ -38829,32 +37596,7 @@ var CloudTrailProvider = class {
 			if (err instanceof TrailNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListTrailsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.Trails,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (trail) => {
-				if (!trail.TrailARN || !trail.Name) return void 0;
-				try {
-					return await this.getClient().send(new ListTagsCommand$1({ ResourceIdList: [trail.TrailARN] }));
-				} catch (err) {
-					if (err instanceof TrailNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.ResourceTagList?.[0]?.TagsList
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -39102,11 +37844,11 @@ var CodeBuildProvider = class {
 	/**
 	* Adopt an existing CodeBuild project into cdkd state.
 	*
-	* Lookup order:
-	*  1. `--resource` override or `Properties.Name` → verify via `BatchGetProjects`.
-	*  2. `ListProjects` + `BatchGetProjects` (CodeBuild uses lowercase
-	*     `key`/`value` tags, not the standard `Key`/`Value`), match
-	*     `aws:cdk:path` tag.
+	* Lookup: `--resource` override or `Properties.Name` → verify via
+	* `BatchGetProjects`. There is no `aws:cdk:path` tag walk — AWS rejects
+	* `aws:`-prefixed tag writes, so that tag never exists on a real resource
+	* (issue #1134); auto-mode import resolves ids from CloudFormation's
+	* `DescribeStackResources` instead.
 	*/
 	/**
 	* Read the AWS-current CodeBuild Project configuration in CFn-property shape.
@@ -39290,24 +38032,6 @@ var CodeBuildProvider = class {
 			if (err instanceof ResourceNotFoundException$11) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new ListProjectsCommand({ ...nextToken && { nextToken } }));
-			const names = (list.projects ?? []).filter((n) => typeof n === "string");
-			if (names.length > 0) {
-				const batch = await this.getClient().send(new BatchGetProjectsCommand({ names }));
-				for (const proj of batch.projects ?? []) {
-					if (!proj.name) continue;
-					const tags = proj.tags ?? [];
-					for (const t of tags) if (t.key === "aws:cdk:path" && t.value === input.cdkPath) return {
-						physicalId: proj.name,
-						attributes: {}
-					};
-				}
-			}
-			nextToken = list.nextToken;
-		} while (nextToken);
 		return null;
 	}
 };
@@ -39677,7 +38401,7 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }))).tags);
+			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ resourceArn: metadata.Arn }))).tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return void 0;
 			throw err;
@@ -39712,9 +38436,6 @@ var CodeCommitRepositoryProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.RepositoryName` → verify via
 	*     `GetRepository`.
-	*  2. `ListRepositories` paginated, then `ListTagsForResource(arn)` per
-	*     repository to match `aws:cdk:path` (CodeCommit uses the
-	*     `Record<string, string>` tag-map shape).
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "RepositoryName");
@@ -39728,42 +38449,7 @@ var CodeCommitRepositoryProvider = class {
 			if (err instanceof RepositoryDoesNotExistException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListRepositoriesCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.repositories,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (repo) => {
-				if (!repo.repositoryName) return void 0;
-				let metadata;
-				try {
-					metadata = await this.getRepositoryMetadata(repo.repositoryName);
-				} catch (err) {
-					if (err instanceof RepositoryDoesNotExistException) return void 0;
-					throw err;
-				}
-				if (!metadata?.Arn) return void 0;
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }));
-				return {
-					metadata,
-					tags: tagsResp.tags
-				};
-			},
-			tagsOf: (detail) => Object.entries(detail.tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.repositoryName,
-			attributes: this.toAttributes(match.detail.metadata)
-		};
+		return null;
 	}
 	/**
 	* Seed the repository's initial commit from the CFn `Code` property.
@@ -40078,9 +38764,6 @@ var DLMLifecyclePolicyProvider = class {
 	*  1. `--resource` override (`knownPhysicalId`) -> verify via
 	*     GetLifecyclePolicy. There is no template name property — the policy
 	*     id is service-generated — so no name fallback applies.
-	*  2. Tag-based lookup: GetLifecyclePolicies returns every policy summary
-	*     WITH its tag map in a single unpaginated call, so the `aws:cdk:path`
-	*     match needs no per-policy follow-up.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -40093,23 +38776,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async () => {
-				return { items: (await this.getClient().send(new GetLifecyclePoliciesCommand({}))).Policies };
-			},
-			describe: async (policy) => policy.PolicyId ? policy : void 0,
-			tagsOf: (policy) => Object.entries(policy.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.PolicyId,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -40318,7 +38985,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -40332,8 +38999,6 @@ var S3VectorsProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.VectorBucketName`
 	*     → verify via `GetVectorBucket`. The physical id is the bucket name.
-	*  2. `ListVectorBuckets` paginator + `ListTagsForResource(resourceArn)`
-	*     (tags map keyed by tag name) and match `aws:cdk:path`.
 	*/
 	async import(input) {
 		const explicit = input.knownPhysicalId ?? (typeof input.properties?.["VectorBucketName"] === "string" && input.properties["VectorBucketName"].length > 0 ? input.properties["VectorBucketName"] : void 0);
@@ -40347,35 +39012,7 @@ var S3VectorsProvider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListVectorBucketsCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.vectorBuckets,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (bucket) => {
-				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) return void 0;
-				try {
-					return await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn: bucket.vectorBucketArn }));
-				} catch (err) {
-					if (this.isNotFoundError(err)) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.vectorBucketName,
-			attributes: {}
-		};
+		return null;
 	}
 	isNotFoundError(error) {
 		if (error instanceof Error) {
@@ -40588,10 +39225,6 @@ var S3DirectoryBucketProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.BucketName` →
 	*     verify via `HeadBucket`.
-	*  2. `ListDirectoryBuckets` paginator + `GetBucketTagging` (TagSet:
-	*     Tag[]) and match `aws:cdk:path`. `GetBucketTagging` may surface
-	*     `NoSuchTagSet` / `AccessDenied` per-bucket — those are skipped
-	*     rather than fatal.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "BucketName");
@@ -40606,33 +39239,7 @@ var S3DirectoryBucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (token) => {
-				const list = await this.s3Client.send(new ListDirectoryBucketsCommand({ ...token && { ContinuationToken: token } }));
-				return {
-					items: list.Buckets,
-					nextMarker: list.ContinuationToken
-				};
-			},
-			describe: async (b) => {
-				if (!b.Name) return void 0;
-				try {
-					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
-				} catch (err) {
-					const e = err;
-					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied") return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagging) => tagging.TagSet
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -40748,7 +39355,7 @@ var S3TablesProvider = class {
 				if (!namespaceName) continue;
 				let tableContinuationToken;
 				do {
-					const tablesResult = await this.getClient().send(new ListTablesCommand$1({
+					const tablesResult = await this.getClient().send(new ListTablesCommand({
 						tableBucketARN,
 						namespace: namespaceName,
 						continuationToken: tableContinuationToken
@@ -40940,16 +39547,10 @@ var S3TablesProvider = class {
 	/**
 	* Adopt an existing S3 Tables resource into cdkd state.
 	*
-	*  - **AWS::S3Tables::TableBucket**: tag-based auto-lookup via
-	*    `ListTableBuckets` + `ListTagsForResource(resourceArn)` (tags map).
-	*    Falls back to `--resource <id>=<arn>` or `Properties.TableBucketName`
-	*    (resolved by ARN suffix match against `ListTableBuckets`).
-	*  - **AWS::S3Tables::Table**: tag-based auto-lookup walks every
-	*    table bucket → namespace → table and calls `ListTagsForResource`
-	*    on each table ARN; matches `aws:cdk:path`.
-	*  - **AWS::S3Tables::Namespace**: explicit-override only. Namespaces
-	*    are not taggable in S3 Tables (`ListTagsForResource` accepts only
-	*    table-bucket or table ARNs), so auto-lookup is impossible.
+	*  - **AWS::S3Tables::TableBucket**: `--resource <id>=<arn>` override, or
+	*    a `Properties.TableBucketName` match against `ListTableBuckets`.
+	*  - **AWS::S3Tables::Table**: explicit-override only.
+	*  - **AWS::S3Tables::Namespace**: explicit-override only.
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -40971,24 +39572,16 @@ var S3TablesProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["TableBucketName"] === "string" ? input.properties["TableBucketName"] : void 0;
+		if (!desiredName) return null;
 		let token;
 		do {
 			const list = await this.getClient().send(new ListTableBucketsCommand({ ...token && { continuationToken: token } }));
 			for (const bucket of list.tableBuckets ?? []) {
 				if (!bucket.arn) continue;
-				if (desiredName && bucket.name === desiredName) return {
+				if (bucket.name === desiredName) return {
 					physicalId: bucket.arn,
 					attributes: {}
 				};
-				if (input.cdkPath) try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$21({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-						physicalId: bucket.arn,
-						attributes: {}
-					};
-				} catch (err) {
-					if (err instanceof NotFoundException$6) continue;
-					throw err;
-				}
 			}
 			token = list.continuationToken;
 		} while (token);
@@ -41023,48 +39616,6 @@ var S3TablesProvider = class {
 				attributes: {}
 			};
 		}
-		if (!input.cdkPath) return null;
-		let bucketToken;
-		do {
-			const buckets = await this.getClient().send(new ListTableBucketsCommand({ ...bucketToken && { continuationToken: bucketToken } }));
-			for (const bucket of buckets.tableBuckets ?? []) {
-				if (!bucket.arn) continue;
-				let nsToken;
-				do {
-					const namespaces = await this.getClient().send(new ListNamespacesCommand$1({
-						tableBucketARN: bucket.arn,
-						...nsToken && { continuationToken: nsToken }
-					}));
-					for (const ns of namespaces.namespaces ?? []) {
-						const namespaceName = ns.namespace?.[0];
-						if (!namespaceName) continue;
-						let tableToken;
-						do {
-							const tables = await this.getClient().send(new ListTablesCommand$1({
-								tableBucketARN: bucket.arn,
-								namespace: namespaceName,
-								...tableToken && { continuationToken: tableToken }
-							}));
-							for (const table of tables.tables ?? []) {
-								if (!table.name || !table.tableARN) continue;
-								try {
-									if ((await this.getClient().send(new ListTagsForResourceCommand$21({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
-										physicalId: `${bucket.arn}|${namespaceName}|${table.name}`,
-										attributes: {}
-									};
-								} catch (err) {
-									if (err instanceof NotFoundException$6) continue;
-									throw err;
-								}
-							}
-							tableToken = tables.continuationToken;
-						} while (tableToken);
-					}
-					nsToken = namespaces.continuationToken;
-				} while (nsToken);
-			}
-			bucketToken = buckets.continuationToken;
-		} while (bucketToken);
 		return null;
 	}
 	async deleteTable(logicalId, physicalId, resourceType, context) {
@@ -41144,7 +39695,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$21({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -41546,8 +40097,6 @@ var ECRProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.RepositoryName` → verify via
 	*     `DescribeRepositories`.
-	*  2. `DescribeRepositories` paginated, then `ListTagsForResource(arn)`
-	*     per repository to match `aws:cdk:path` (`Tag[]` array shape).
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "RepositoryName");
@@ -41560,32 +40109,7 @@ var ECRProvider = class {
 			if (err instanceof RepositoryNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeRepositoriesCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.repositories,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (repo) => {
-				if (!repo.repositoryArn || !repo.repositoryName) return void 0;
-				try {
-					return await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: repo.repositoryArn }));
-				} catch (err) {
-					if (err instanceof RepositoryNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.repositoryName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -42643,10 +41167,6 @@ var ACMCertificateProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override (must be an ARN — ACM has no other unique id).
-	*  2. Tag-based `aws:cdk:path` match across `ListCertificates` +
-	*     `ListTagsForCertificate`. NOTE: ACM has no `Scope: Local` filter —
-	*     `ListCertificates` returns customer-managed certs only (AWS-managed
-	*     certs are not surfaced via this API), so no extra guard is needed.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) {
@@ -42666,36 +41186,7 @@ var ACMCertificateProvider = class {
 				throw err;
 			}
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.acmClient.send(new ListCertificatesCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.CertificateSummaryList,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (summary) => {
-				if (!summary.CertificateArn) return void 0;
-				try {
-					return await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: summary.CertificateArn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$6) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		const arn = match.summary.CertificateArn;
-		return {
-			physicalId: arn,
-			attributes: {
-				Arn: arn,
-				CertificateArn: arn
-			}
-		};
+		return null;
 	}
 	/**
 	* Poll `DescribeCertificate` until status === `ISSUED`. On the FIRST poll
@@ -43125,15 +41616,17 @@ async function deployCommand(stacks, options) {
 		logger.info(cyan(synthesisStatusMessage(app, "Synthesizing CDK app...")));
 		const synthesizer = new Synthesizer();
 		const context = parseContextOptions(options.context);
-		const { stacks: allStacks } = await synthesizer.synthesize({
+		const synthOptions = {
 			app: options.app,
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
 			...Object.keys(context).length > 0 && { context },
 			stateBucket,
-			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
-		});
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
+			deferMacroExpansion: true
+		};
+		const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
 		logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
@@ -43172,6 +41665,7 @@ async function deployCommand(stacks, options) {
 			};
 			for (const stack of [...targetStacks]) addDependencies(stack.stackName);
 		}
+		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({ region: options.region || process.env["AWS_REGION"] || "us-east-1" });
 		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -44832,15 +43326,17 @@ async function diffCommand(stacks, options) {
 		logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
 		const synthesizer = new Synthesizer();
 		const context = parseContextOptions(options.context);
-		const { stacks: allStacks } = await synthesizer.synthesize({
+		const synthOptions = {
 			app: options.app,
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
 			...Object.keys(context).length > 0 && { context },
 			stateBucket,
-			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
-		});
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
+			deferMacroExpansion: true
+		};
+		const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
 		logger.info(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
@@ -44849,6 +43345,7 @@ async function diffCommand(stacks, options) {
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
 		if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const stateConfig = {
 			bucket: stateBucket,
 			prefix: options.statePrefix
@@ -46077,8 +44574,7 @@ async function destroyCommand(stackArgs, options) {
 				app: appCmd,
 				output: options.output || "cdk.out",
 				...Object.keys(context).length > 0 && { context },
-				stateBucket,
-				...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
+				deferMacroExpansion: true
 			});
 			appStacks = result.stacks.map((s) => ({
 				stackName: s.stackName,
@@ -52281,12 +50777,10 @@ async function importOne(task) {
 		outcome: "skipped-no-impl",
 		reason: `provider does not implement import (yet)`
 	};
-	const cdkPath = readCdkPath(resource);
 	const properties = substituteOverrideRefs(resource.Properties ?? {}, overrides);
 	const input = {
 		logicalId,
 		resourceType: resource.Type,
-		cdkPath,
 		stackName,
 		region,
 		properties,
@@ -52298,7 +50792,7 @@ async function importOne(task) {
 			logicalId,
 			resourceType: resource.Type,
 			outcome: "skipped-not-found",
-			reason: "no matching AWS resource"
+			reason: `no matching AWS resource — pass --resource ${logicalId}=<physicalId> to adopt it explicitly`
 		};
 		return {
 			logicalId,
@@ -62376,7 +60870,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.2");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.4");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());