@go-to-k/cdkd 0.257.3 → 0.257.4

package/dist/cli.js

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
-import { $ as AssetModeResolver, $t as StackTerminationProtectionError, A as importTagWalk, At as expectedOwnerParam, B as DagBuilder, C as slowCcOperationTimeoutMs, Ct as resolveUseCdkBootstrapAssets, D as cfnRefValueFromPhysicalId, Dt as MIGRATE_TMP_PREFIX, E as IntrinsicFunctionResolver, Et as CFN_TEMPLATE_URL_LIMIT, F as normalizeAwsTagsToCfn, Ft as getAwsClients, G as shouldRetainResource, H as LockManager, Ht as LocalInvokeBuildError$1, I as resolveExplicitPhysicalId, It as resetAwsClients, J as WorkGraph, Jt as PartialFailureError, K as AssetPublisher, Kt as MissingCdkCliError, L as assertRegionMatch, Lt as setAwsClients, M as isRetryableTransientError, N as CDK_PATH_TAG, Nt as resolveBucketRegion, O as refStateLookupFromResource, Ot as findLargeInlineResources, P as matchesCdkPath, Pt as AwsClients, Q as rewriteTemplateAssetReferences, Qt as StackHasActiveImportsError, R as applyRoleArnIfSet, S as CloudControlProvider, St as resolveStateBucketWithDefaultAndSource, T as isTerminationProtectionPropagationError, Tt as CFN_TEMPLATE_BODY_LIMIT, U as S3StateBackend, Ut as LocalMigrateError, V as TemplateParser, W as rebuildClientForBucketRegion, Wt as LocalStartServiceError, X as createAssetRedirectResolver, Xt as ResourceTimeoutError, Y as buildAssetRedirectMap, Yt as ProvisioningError, Z as loadPublishableAssetManifest, Zt as ResourceUpdateNotSupportedError, _ as yellow, _t as resolveApp, a as IMPLICIT_DELETE_DEPENDENCIES, an as withErrorHandling, at as validateContainerRepoName, b as ProviderRegistry, bt as resolveSkipPrefix, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as getDockerCmd, d as formatResourceLine, dt as AssetManifestLoader, et as BOOTSTRAP_MARKER_PREFIX, f as bold, ft as getDockerImageBySourceHash, g as red, gt as getLegacyStateBucketName, h as green, ht as getDefaultStateBucketName, i as withResourceDeadline, in as normalizeAwsError, it as validateAssetBucketName, j as withRetry, jt as AssemblyReader, k as WAFv2WebACLProvider, kt as uploadCfnTemplate, l as isStatefulRecreateTargetSync, lt as runDockerForeground, m as gray, mt as synthesisStatusMessage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as getBootstrapMarkerKey, o as computeImplicitDeleteEdges, ot as buildDockerImage, p as cyan, pt as Synthesizer, q as stringifyValue, qt as NestedStackChildDirectDestroyError, r as DeployEngine, rt as parseBootstrapMarker, s as extractDeploymentEventError, st as formatDockerLoginError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as ensureAssetStorage, u as renderStatefulReason, ut as runDockerStreaming, v as IAMRoleProvider, vt as resolveAutoAssetStorage, w as disableInstanceApiTermination, wt as warnDeprecatedNoPrefixCliFlag, x as findActionableSilentDrops, xt as resolveStateBucketWithDefault, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveCaptureObservedState, z as DiffCalculator, zt as CdkdError } from "./deploy-engine-0U3bYBq4.js";
+import { $ as getBootstrapMarkerKey, A as refStateLookupFromResource, At as resolveBucketRegion, B as S3StateBackend, Bt as LocalMigrateError, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_URL_LIMIT, D as isTerminationProtectionPropagationError, Dt as expectedOwnerParam, E as disableInstanceApiTermination, Et as uploadCfnTemplate, F as applyRoleArnIfSet, G as WorkGraph, Gt as PartialFailureError, H as shouldRetainResource, I as DiffCalculator, It as CdkdError, J as loadPublishableAssetManifest, Jt as ResourceUpdateNotSupportedError, K as buildAssetRedirectMap, Kt as ProvisioningError, L as DagBuilder, M as normalizeAwsTagsToCfn, Mt as getAwsClients, N as resolveExplicitPhysicalId, Nt as resetAwsClients, O as IntrinsicFunctionResolver, Ot as AssemblyReader, P as assertRegionMatch, Pt as setAwsClients, Q as ensureAssetStorage, R as TemplateParser, S as ProviderRegistry, St as CFN_TEMPLATE_BODY_LIMIT, T as slowCcOperationTimeoutMs, Tt as findLargeInlineResources, U as AssetPublisher, Ut as MissingCdkCliError, V as rebuildClientForBucketRegion, Vt as LocalStartServiceError, W as stringifyValue, Wt as NestedStackChildDirectDestroyError, X as AssetModeResolver, Xt as StackTerminationProtectionError, Y as rewriteTemplateAssetReferences, Yt as StackHasActiveImportsError, Z as BOOTSTRAP_MARKER_PREFIX, _ as green, _t as resolveSkipPrefix, a as withRetry, at as getDockerCmd, b as IAMRoleProvider, bt as resolveUseCdkBootstrapAssets, c as computeImplicitDeleteEdges, ct as AssetManifestLoader, d as isStatefulRecreateTargetSync, dt as synthesisStatusMessage, et as parseBootstrapMarker, f as renderStatefulReason, ft as getDefaultStateBucketName, g as gray, gt as resolveCaptureObservedState, h as cyan, ht as resolveAutoAssetStorage, i as withResourceDeadline, it as formatDockerLoginError, j as WAFv2WebACLProvider, jt as AwsClients, k as cfnRefValueFromPhysicalId, l as extractDeploymentEventError, lt as getDockerImageBySourceHash, m as bold, mt as resolveApp, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as withErrorHandling, nt as validateContainerRepoName, o as isRetryableTransientError, ot as runDockerForeground, p as formatResourceLine, pt as getLegacyStateBucketName, q as createAssetRedirectResolver, qt as ResourceTimeoutError, r as DeployEngine, rt as buildDockerImage, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerStreaming, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as normalizeAwsError, tt as validateAssetBucketName, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as Synthesizer, v as red, vt as resolveStateBucketWithDefault, w as CloudControlProvider, wt as MIGRATE_TMP_PREFIX, x as collectInlinePolicyNamesManagedBySiblings, xt as warnDeprecatedNoPrefixCliFlag, y as yellow, yt as resolveStateBucketWithDefaultAndSource, z as LockManager, zt as LocalInvokeBuildError$1 } from "./deploy-engine-DMpr3qtv.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Co34HfIH.js";
+import { t as ASGProvider } from "./asg-provider-BhmMKcnJ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
-import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
-import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, ListQueuesCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
+import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
+import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
-import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListFunctionsCommand, ListLayersCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
+import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
-import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTablesCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
+import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, DescribeTypeCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetDeploymentCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
-import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListEventBusesCommand, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
-import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, ListSecretsCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
+import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
+import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, ListDistributionsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand } from "@aws-sdk/client-cloudfront";
+import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand } from "@aws-sdk/client-cloudfront";
 import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutMetricAlarmCommand, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
-import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListCertificatesCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
+import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
 import * as fs from "node:fs";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
@@ -30,7 +30,7 @@ import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand } from "@aws-sdk/client-elastic-load-balancing-v2";
-import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
 import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
@@ -43,29 +43,29 @@ import { writeFileSync as writeFileSync$1 } from "fs";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
-import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListStateMachinesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
+import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
 import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
 import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
-import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
-import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
-import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
+import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
+import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
+import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import AdmZip from "adm-zip";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1354,7 +1354,8 @@ async function listCommand(patterns, options) {
 		output: options.output,
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile },
-		...Object.keys(context).length > 0 && { context }
+		...Object.keys(context).length > 0 && { context },
+		deferMacroExpansion: true
 	};
 	const allStacks = (await synthesizer.synthesize(synthOptions)).stacks;
 	if (allStacks.length === 0) throw new Error("No stacks found in assembly");
@@ -1899,7 +1900,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.257.3";
+	return "0.257.4";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -3485,8 +3486,6 @@ var IAMManagedPolicyProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.ManagedPolicyName` → walk
 	*     `ListPolicies(Scope: 'Local')` to find the matching ARN.
-	*  2. `ListPolicies(Scope: 'Local')` → for each candidate, `ListPolicyTags`
-	*     and match against `aws:cdk:path`.
 	*
 	* Scope is forced to `'Local'` (customer-managed policies) — adopting an
 	* AWS-managed policy would let cdkd delete it on next destroy, which would
@@ -3515,36 +3514,7 @@ var IAMManagedPolicyProvider = class {
 			};
 			return null;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.iamClient.send(new ListPoliciesCommand({
-					Scope: "Local",
-					...marker ? { Marker: marker } : {}
-				}));
-				return {
-					items: list.Policies,
-					nextMarker: list.IsTruncated ? list.Marker : void 0
-				};
-			},
-			describe: async (policy) => {
-				if (!policy.Arn) return void 0;
-				try {
-					return await this.iamClient.send(new ListPolicyTagsCommand({ PolicyArn: policy.Arn }));
-				} catch (err) {
-					if (err instanceof NoSuchEntityException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tags) => tags.Tags
-		});
-		if (!match) return null;
-		const arn = match.summary.Arn;
-		return {
-			physicalId: arn,
-			attributes: { PolicyArn: arn }
-		};
+		return null;
 	}
 	async attachToPrincipals(policyArn, groups, roles, users) {
 		if (groups && Array.isArray(groups)) for (const groupName of groups) {
@@ -3945,13 +3915,6 @@ var IAMInstanceProfileProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.InstanceProfileName` → verify
 	*     via `GetInstanceProfile`.
-	*  2. `ListInstanceProfiles` paginator + a per-candidate `GetInstanceProfile`
-	*     to read the tags, matched against `aws:cdk:path`. The list API does
-	*     NOT return tags (AWS documents this on the command) even though the
-	*     `InstanceProfile` type declares `Tags?`, so reading them off the
-	*     summary typechecks and never matches.
-	*
-	* IAM is global; this walks every instance profile in the account once.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "InstanceProfileName");
@@ -3965,32 +3928,7 @@ var IAMInstanceProfileProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.iamClient.send(new ListInstanceProfilesCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.InstanceProfiles,
-					nextMarker: list.IsTruncated ? list.Marker : void 0
-				};
-			},
-			describe: async (profile) => {
-				if (!profile.InstanceProfileName) return void 0;
-				try {
-					return (await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: profile.InstanceProfileName }))).InstanceProfile;
-				} catch (err) {
-					if (err instanceof NoSuchEntityException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (detail) => detail?.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.InstanceProfileName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -6290,8 +6228,6 @@ var S3BucketProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.BucketName` → use directly,
 	*     verify with `HeadBucket`.
-	*  2. `ListBuckets` + `GetBucketTagging`, match `aws:cdk:path` against the
-	*     CDK construct path.
 	*
 	* Returns `null` when nothing matches — caller treats this as
 	* "not deployed yet" rather than a failure.
@@ -6309,32 +6245,7 @@ var S3BucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async () => {
-				return {
-					items: (await this.s3Client.send(new ListBucketsCommand({}))).Buckets,
-					nextMarker: void 0
-				};
-			},
-			describe: async (b) => {
-				if (!b.Name) return void 0;
-				try {
-					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
-				} catch (err) {
-					const e = err;
-					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied" || e.$metadata?.httpStatusCode === 301) return;
-					throw err;
-				}
-			},
-			tagsOf: (tagging) => tagging.TagSet
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Delete a bucket, emptying it first if not empty.
@@ -7150,7 +7061,6 @@ var SQSQueueProvider = class {
 	* Lookup order:
 	*  1. `--resource` override (URL) → verify via `GetQueueAttributes`.
 	*  2. `Properties.QueueName` → `GetQueueUrl` for direct lookup.
-	*  3. `aws:cdk:path` tag match via `ListQueues` + `ListQueueTags`.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7178,34 +7088,7 @@ var SQSQueueProvider = class {
 			if (err instanceof QueueDoesNotExist) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.sqsClient.send(new ListQueuesCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.QueueUrls,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (url) => {
-				try {
-					return await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: url }));
-				} catch (err) {
-					if (err instanceof QueueDoesNotExist) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -7873,17 +7756,13 @@ var SNSTopicProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override → trust as ARN, verify via `GetTopicAttributes`.
-	*  2. `Properties.TopicName` → `ListTopics` to find matching ARN.
-	*  3. `aws:cdk:path` tag match via `ListTopics` + `ListTagsForResource`.
-	*
-	* Steps 2 and 3 share ONE `ListTopics` walk (per candidate: name check
-	* first, then the tag read — only when a `cdkPath` is present), which runs
-	* through the shared `importTagWalk` helper so the N+1 `ListTagsForResource`
-	* burst is retried with exponential backoff when AWS throttles it instead
-	* of aborting the whole import. The name match is expressed to the walk as
-	* a synthetic `aws:cdk:path` tag carrying the walk's own lookup key, so a
-	* name-only template (no CDK path metadata) still resolves without any tag
-	* API call — matching the previous inline loop.
+	*  2. `Properties.TopicName` → `ListTopics` to find the matching ARN.
+	*
+	* The `aws:cdk:path` tag match that used to ride the same `ListTopics` walk
+	* is gone (issue #1134): AWS rejects `aws:`-prefixed tag writes, so that tag
+	* never exists on a real resource and the walk could not match. Auto-mode
+	* import resolves ids from CloudFormation's `DescribeStackResources` or the
+	* template's physical name; without a `TopicName` there is nothing to match.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7897,40 +7776,19 @@ var SNSTopicProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["TopicName"] === "string" ? input.properties["TopicName"] : void 0;
-		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:sns-topic-name:${desiredName}` : void 0);
-		/** Sentinel detail for a candidate matched by its ARN-tail topic name. */
-		const NAME_MATCH = { nameMatch: true };
-		const match = await importTagWalk({
-			cdkPath: walkCdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.snsClient.send(new ListTopicsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.Topics,
-					nextMarker: list.NextToken
+		if (!desiredName) return null;
+		let marker;
+		do {
+			const list = await this.snsClient.send(new ListTopicsCommand({ ...marker && { NextToken: marker } }));
+			for (const t of list.Topics ?? []) {
+				if (!t.TopicArn) continue;
+				if (t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1) === desiredName) return {
+					physicalId: t.TopicArn,
+					attributes: {}
 				};
-			},
-			describe: async (t) => {
-				if (!t.TopicArn) return void 0;
-				const arnTail = t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1);
-				if (desiredName && arnTail === desiredName) return NAME_MATCH;
-				if (!input.cdkPath) return void 0;
-				try {
-					return await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: t.TopicArn }));
-				} catch (err) {
-					if (err instanceof NotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (detail) => "nameMatch" in detail ? [{
-				Key: CDK_PATH_TAG,
-				Value: walkCdkPath
-			}] : detail.Tags
-		});
-		if (match?.summary.TopicArn) return {
-			physicalId: match.summary.TopicArn,
-			attributes: {}
-		};
+			}
+			marker = list.NextToken;
+		} while (marker);
 		return null;
 	}
 };
@@ -9284,15 +9142,6 @@ var LambdaFunctionProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.FunctionName` → use directly,
 	*     verify via `GetFunction`.
-	*  2. `ListFunctions` + `ListTags`, match `aws:cdk:path` tag.
-	*
-	* Lambda's `ListTags` returns a `Tags` map keyed by tag name (unlike
-	* EC2/S3 which return an array of `{Key, Value}`), so the map is re-shaped
-	* to `{Key, Value}` entries for the walk's matcher.
-	*
-	* The tag walk runs through the shared `importTagWalk` helper, so the N+1
-	* `ListTags` burst is retried with exponential backoff when AWS throttles
-	* it instead of aborting the whole import.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "FunctionName");
@@ -9306,35 +9155,7 @@ var LambdaFunctionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.lambdaClient.send(new ListFunctionsCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Functions,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (fn) => {
-				if (!fn.FunctionArn || !fn.FunctionName) return void 0;
-				try {
-					return await this.lambdaClient.send(new ListTagsCommand({ Resource: fn.FunctionArn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.FunctionName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -10351,15 +10172,6 @@ var LambdaLayerVersionProvider = class {
 	*     `GetLayerVersionByArn`. (Note: there is no `LayerName` field that
 	*     uniquely names a *version*; a layer name resolves to the latest
 	*     version, so an explicit ARN is the only unambiguous override.)
-	*  2. `ListLayers` paginator + `ListTags(Resource: layerArn)` (which
-	*     returns a `Tags: Record<string,string>` map keyed by tag name).
-	*     Match `aws:cdk:path` and adopt `LatestMatchingVersion.LayerVersionArn`.
-	*
-	* **Caveat**: Lambda layer versions are immutable, so auto-lookup adopts
-	* the LATEST version of the named layer that carries the matching CDK
-	* path tag. If the user's CDK app has since published newer versions
-	* outside cdkd's tracking, the adopted physical id may be stale; pass
-	* `--resource <id>=<arn>` to pin a specific version.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -10372,35 +10184,7 @@ var LambdaLayerVersionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.lambdaClient.send(new ListLayersCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Layers,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (layer) => {
-				if (!layer.LayerArn || !layer.LatestMatchingVersion?.LayerVersionArn) return void 0;
-				try {
-					return await this.lambdaClient.send(new ListTagsCommand({ Resource: layer.LayerArn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.LatestMatchingVersion.LayerVersionArn,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -11465,11 +11249,6 @@ var DynamoDBTableProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override or `Properties.TableName` → verify via `DescribeTable`.
-	*  2. `ListTables` + `ListTagsOfResource`, match `aws:cdk:path` tag.
-	*
-	* Tags require the table ARN, which `DescribeTable` provides; the loop
-	* therefore costs one `DescribeTable` per table just to read the ARN.
-	* Acceptable for typical DynamoDB cardinalities.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "TableName");
@@ -11483,33 +11262,7 @@ var DynamoDBTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
-				return {
-					items: list.TableNames,
-					nextMarker: list.LastEvaluatedTableName
-				};
-			},
-			describe: async (name) => {
-				try {
-					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-					if (!arn) return void 0;
-					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$1) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -12683,7 +12436,6 @@ var DynamoDBGlobalTableProvider = class {
 	*
 	* Lookup order:
 	*   1. `--resource` override or `Properties.TableName` → verify via DescribeTable.
-	*   2. `ListTables` + `ListTagsOfResource`, match `aws:cdk:path` tag.
 	*
 	* Same shape as `DynamoDBTableProvider.import()`. The provider returns
 	* the physical id only; cdkd's import flow does the attribute capture
@@ -12701,33 +12453,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
-				return {
-					items: list.TableNames,
-					nextMarker: list.LastEvaluatedTableName
-				};
-			},
-			describe: async (name) => {
-				try {
-					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-					if (!arn) return void 0;
-					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$1) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 	async waitForTableActive(tableName, logicalId, maxAttempts = 120) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -13277,11 +13003,6 @@ var LogsLogGroupProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.LogGroupName` → verify via
 	*     `DescribeLogGroups` (filtered by name prefix).
-	*  2. `aws:cdk:path` tag match via `DescribeLogGroups` + `ListTagsForResource`.
-	*
-	* `ListTagsForResource` for log groups uses the log-group ARN. The
-	* `DescribeLogGroups` response includes the ARN, so no extra round-trip
-	* is needed beyond the per-group tag lookup.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "LogGroupName");
@@ -13294,36 +13015,7 @@ var LogsLogGroupProvider = class {
 			if (err instanceof ResourceNotFoundException$4) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.logsClient.send(new DescribeLogGroupsCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.logGroups,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (g) => {
-				if (!g.logGroupName || !g.arn) return void 0;
-				const arnForTags = g.arn.replace(/:\*$/, "");
-				try {
-					return await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$4) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.logGroupName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -13640,32 +13332,7 @@ var CloudWatchAlarmProvider = class {
 			if (this.isNotFound(err)) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.cloudWatchClient.send(new DescribeAlarmsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: [...list.MetricAlarms ?? [], ...list.CompositeAlarms ?? []],
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (a) => {
-				if (!a.AlarmArn || !a.AlarmName) return void 0;
-				try {
-					return await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: a.AlarmArn }));
-				} catch (err) {
-					if (this.isNotFound(err)) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.AlarmName,
-			attributes: {}
-		};
+		return null;
 	}
 	isNotFound(err) {
 		if (!(err instanceof Error)) return false;
@@ -13919,7 +13586,6 @@ var SecretsManagerSecretProvider = class {
 	* Lookup order:
 	*  1. `--resource` override (ARN) → verify via `DescribeSecret`.
 	*  2. `Properties.Name` → `DescribeSecret` (accepts name).
-	*  3. `aws:cdk:path` tag match via `ListSecrets` (which already returns Tags).
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -13943,24 +13609,7 @@ var SecretsManagerSecretProvider = class {
 			if (err instanceof ResourceNotFoundException$3) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.smClient.send(new ListSecretsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.SecretList,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (secret) => secret.ARN ? secret : void 0,
-			tagsOf: (secret) => secret.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.ARN,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -14230,12 +13879,10 @@ var SSMParameterProvider = class {
 	*
 	* SSM physical IDs ARE the parameter names (`/foo/bar`). The CDK template
 	* usually carries `Properties.Name` explicitly, so the explicit-name path
-	* covers most cases. The tag-based fallback is rarely needed.
+	* covers most cases.
 	*
 	* Lookup order:
 	*  1. `--resource` override or `Properties.Name` → verify via `GetParameter`.
-	*  2. `aws:cdk:path` tag match via `DescribeParameters` + `ListTagsForResource`
-	*     (`ResourceType: 'Parameter'`, `ResourceId: <name>`).
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
@@ -14249,35 +13896,7 @@ var SSMParameterProvider = class {
 			if (err instanceof ParameterNotFound) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.ssmClient.send(new DescribeParametersCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.Parameters,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (p) => {
-				if (!p.Name) return void 0;
-				try {
-					return await this.ssmClient.send(new ListTagsForResourceCommand$2({
-						ResourceType: "Parameter",
-						ResourceId: p.Name
-					}));
-				} catch (err) {
-					if (err instanceof ParameterNotFound) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.TagList
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -14559,12 +14178,6 @@ var EventBridgeRuleProvider = class {
 	*  2. If the template carries `Properties.Name` use that as the rule
 	*     name lookup, then verify with `DescribeRule` and return the
 	*     rule's ARN as physicalId.
-	*  3. Walk `ListRules(EventBusName?)` and match `aws:cdk:path` via
-	*     `ListTagsForResource(ResourceARN=rule.Arn)`. Returns the rule
-	*     ARN as physicalId — same shape that `create` returns.
-	*
-	* EventBridge tags use the standard `Tag[]` array shape
-	* (`Key`/`Value`).
 	*/
 	async import(input) {
 		const eventBusName = input.properties["EventBusName"];
@@ -14598,30 +14211,7 @@ var EventBridgeRuleProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.eventBridgeClient.send(new ListRulesCommand({
-					...eventBusName && { EventBusName: eventBusName },
-					...marker && { NextToken: marker }
-				}));
-				return {
-					items: list.Rules,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (rule) => {
-				if (!rule.Arn) return void 0;
-				return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: rule.Arn }));
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Arn,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Extract rule name from an ARN
@@ -14892,7 +14482,6 @@ var EventBridgeBusProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override or `Properties.Name` → verify via `DescribeEventBus`.
-	*  2. `aws:cdk:path` tag match via `ListEventBuses` + `ListTagsForResource`.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
@@ -14906,32 +14495,7 @@ var EventBridgeBusProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.eventBridgeClient.send(new ListEventBusesCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.EventBuses,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (bus) => {
-				if (!bus.Name || !bus.Arn) return void 0;
-				try {
-					return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: bus.Arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$2) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -20419,8 +19983,7 @@ var CloudFrontDistributionProvider = class {
 	*
 	* CloudFront distributions don't carry a template-supplied name
 	* (physical id is the AWS-generated `E...` distribution id), so the
-	* lookup is either explicit-override or `aws:cdk:path` tag match
-	* via `ListDistributions` + `ListTagsForResource(ARN)`.
+	* lookup is explicit-override only.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -20433,32 +19996,7 @@ var CloudFrontDistributionProvider = class {
 			if (err instanceof NoSuchDistribution) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.cloudFrontClient.send(new ListDistributionsCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DistributionList?.Items,
-					nextMarker: list.DistributionList?.IsTruncated ? list.DistributionList?.NextMarker : void 0
-				};
-			},
-			describe: async (d) => {
-				if (!d.Id || !d.ARN) return void 0;
-				try {
-					return await this.cloudFrontClient.send(new ListTagsForResourceCommand$3({ Resource: d.ARN }));
-				} catch (err) {
-					if (err instanceof NoSuchDistribution) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags?.Items
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Id,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -21459,10 +20997,6 @@ var StepFunctionsProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource <id>=<arn>` override → verify with `DescribeStateMachine`.
-	*  2. Walk `ListStateMachines` → `ListTagsForResource(arn)` via the shared
-	*     `importTagWalk` helper. SFN returns lowercase `key`/`value` tags, so
-	*     `tagsOf` maps them to the `Key`/`Value` shape the walk's
-	*     `aws:cdk:path` matcher expects.
 	*
 	* SFN state machines do not expose a template-supplied name field
 	* usable as a stable physicalId — the physicalId is the ARN — so the
@@ -21480,30 +21014,7 @@ var StepFunctionsProvider = class {
 			if (err instanceof StateMachineDoesNotExist) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListStateMachinesCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.stateMachines,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (sm) => {
-				if (!sm.stateMachineArn) return void 0;
-				return await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: sm.stateMachineArn }));
-			},
-			tagsOf: (tagsResp) => (tagsResp.tags ?? []).map((t) => ({
-				Key: t.key,
-				Value: t.value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.stateMachineArn,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via SFN's
@@ -25637,11 +25148,10 @@ var DocDBProvider = class {
 	* Supported types: `AWS::DocDB::DBInstance`, `AWS::DocDB::DBCluster`,
 	* `AWS::DocDB::DBSubnetGroup`. Identifier name properties (`DBInstance
 	* Identifier` / `DBClusterIdentifier` / `DBSubnetGroupName`) are usually
-	* present in CDK templates; fall back to `aws:cdk:path` tag lookup via
-	* the corresponding `Describe*` + `ListTagsForResource` pair otherwise.
-	* The fallback walk runs through the shared `importTagWalk` helper, so the
-	* N+1 `ListTagsForResource` burst is retried with exponential backoff when
-	* AWS throttles it instead of aborting the whole import.
+	* present in CDK templates and are resolved via the corresponding
+	* `Describe*` existence check. There is no `aws:cdk:path` tag fallback:
+	* AWS rejects `aws:`-prefixed tag writes, so that tag never exists on a
+	* real resource and the walk could not match (issue #1134).
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -25757,24 +25267,7 @@ var DocDBProvider = class {
 			if (err.name === "DBInstanceNotFoundFault") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeDBInstancesCommand$1({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DBInstances,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (inst) => inst.DBInstanceIdentifier && inst.DBInstanceArn ? await this.listTagsForResource(inst.DBInstanceArn) : void 0,
-			tagsOf: (tags) => tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.DBInstanceIdentifier,
-			attributes: {}
-		};
+		return null;
 	}
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
@@ -25788,24 +25281,7 @@ var DocDBProvider = class {
 			if (err.name === "DBClusterNotFoundFault") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeDBClustersCommand$1({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DBClusters,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (c) => c.DBClusterIdentifier && c.DBClusterArn ? await this.listTagsForResource(c.DBClusterArn) : void 0,
-			tagsOf: (tags) => tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.DBClusterIdentifier,
-			attributes: {}
-		};
+		return null;
 	}
 	async importDBSubnetGroup(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBSubnetGroupName");
@@ -25819,33 +25295,7 @@ var DocDBProvider = class {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$1({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DBSubnetGroups,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (sg) => sg.DBSubnetGroupName && sg.DBSubnetGroupArn ? await this.listTagsForResource(sg.DBSubnetGroupArn) : void 0,
-			tagsOf: (tags) => tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.DBSubnetGroupName,
-			attributes: {}
-		};
-	}
-	/**
-	* `ListTagsForResource` for the tag-walk import path. Returns the tag list
-	* (possibly empty) so `importTagWalk` can match `aws:cdk:path` against it;
-	* `undefined` is reserved for "skip this candidate", which the callers signal
-	* before calling this.
-	*/
-	async listTagsForResource(resourceArn) {
-		return (await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: resourceArn }))).TagList ?? [];
+		return null;
 	}
 };
 
@@ -27739,19 +27189,13 @@ var CognitoUserPoolProvider = class {
 	*  1. `--resource` override → `DescribeUserPool` to verify.
 	*  2. `Properties.UserPoolName` (when CDK template carries it) →
 	*     `ListUserPools` walk + name match.
-	*  3. `aws:cdk:path` tag match via `ListUserPools` +
-	*     `ListTagsForResource(<arn>)`. Cognito's tag map uses the same
-	*     `Tags: { [key]: value }` shape as Lambda.
-	*
-	* Steps 2 and 3 share ONE `ListUserPools` walk (per candidate: name check
-	* first, then the two tag reads, only when a `cdkPath` is present), which
-	* runs through the shared `importTagWalk` helper so the N+1 read burst
-	* (DescribeUserPool for the ARN, then ListTagsForResource) is retried with
-	* exponential backoff when AWS throttles it instead of aborting the whole
-	* import. The name match is expressed to the walk as a synthetic
-	* `aws:cdk:path` tag carrying the walk's own lookup key, so a name-only
-	* template (no CDK path metadata) still resolves without any per-candidate
-	* API call, matching the previous inline loop.
+	*
+	* The `aws:cdk:path` tag match that used to ride the same `ListUserPools`
+	* walk is gone (issue #1134): AWS rejects `aws:`-prefixed tag writes, so
+	* that tag never exists on a real resource and the walk could not match.
+	* Auto-mode import resolves ids from CloudFormation's
+	* `DescribeStackResources` or the template's physical name; without a
+	* `UserPoolName` there is nothing to match.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -27765,48 +27209,20 @@ var CognitoUserPoolProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
-		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:cognito-user-pool-name:${desiredName}` : void 0);
-		/** Sentinel detail for a candidate matched by its user pool name. */
-		const NAME_MATCH = { nameMatch: true };
-		const match = await importTagWalk({
-			cdkPath: walkCdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListUserPoolsCommand({
-					MaxResults: 60,
-					...marker && { NextToken: marker }
-				}));
-				return {
-					items: list.UserPools,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (pool) => {
-				if (!pool.Id) return void 0;
-				if (desiredName && pool.Name === desiredName) return NAME_MATCH;
-				if (!input.cdkPath) return void 0;
-				try {
-					const arn = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }))).UserPool?.Arn;
-					if (!arn) return void 0;
-					return await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceArn: arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$7) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (detail) => "nameMatch" in detail ? [{
-				Key: CDK_PATH_TAG,
-				Value: walkCdkPath
-			}] : Object.entries(detail.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Id,
-			attributes: {}
-		};
+		if (!desiredName) return null;
+		let marker;
+		do {
+			const list = await this.getClient().send(new ListUserPoolsCommand({
+				MaxResults: 60,
+				...marker && { NextToken: marker }
+			}));
+			for (const pool of list.UserPools ?? []) if (pool.Id && pool.Name === desiredName) return {
+				physicalId: pool.Id,
+				attributes: {}
+			};
+			marker = list.NextToken;
+		} while (marker);
+		return null;
 	}
 };
 
@@ -28999,7 +28415,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: arn }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }))).Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -32082,8 +31498,8 @@ var KMSProvider = class {
 	* KMS keys have no `Properties.KeyName` field — physical IDs are
 	* AWS-generated UUIDs. So:
 	*  - For `AWS::KMS::Key`: `--resource MyKey=<keyId>` is the only explicit
-	*    path; auto-lookup walks `ListKeys` + `ListResourceTags` matching
-	*    `aws:cdk:path`.
+	*    path; there is no auto-lookup (a key reaching here without an explicit
+	*    id or a CloudFormation-resolved physical id returns `null`).
 	*  - For `AWS::KMS::Alias`: `Properties.AliasName` is explicit and reliable.
 	*/
 	async import(input) {
@@ -32116,36 +31532,7 @@ var KMSProvider = class {
 			if (err instanceof NotFoundException$2) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListKeysCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Keys,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (key) => {
-				if (!key.KeyId) return void 0;
-				try {
-					return await this.getClient().send(new ListResourceTagsCommand({ KeyId: key.KeyId }));
-				} catch (err) {
-					if (err.name === "AccessDeniedException" || err instanceof NotFoundException$2) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => (tagsResp.Tags ?? []).map((t) => ({
-				Key: t.TagKey,
-				Value: t.TagValue
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.KeyId,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -32593,9 +31980,6 @@ var BudgetsBudgetProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.Budget.BudgetName` → verify via
 	*     `DescribeBudget`.
-	*  2. `aws:cdk:path` tag match: walk `DescribeBudgets` and check each
-	*     budget's tags via `ListTagsForResource` (budget ARNs are
-	*     region-free, so the lookup works from any deploy region).
 	*/
 	async import(input) {
 		const rawBudget = input.properties["Budget"] ?? {};
@@ -32615,31 +31999,7 @@ var BudgetsBudgetProvider = class {
 			if (error instanceof NotFoundException$5) return null;
 			throw error;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await client.send(new DescribeBudgetsCommand({
-					AccountId: accountId,
-					...marker && { NextToken: marker }
-				}));
-				return {
-					items: list.Budgets,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (budget) => {
-				if (!budget.BudgetName) return void 0;
-				return await client.send(new ListTagsForResourceCommand$16({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }));
-			},
-			tagsOf: (tags) => tags.ResourceTags
-		});
-		if (!match) return null;
-		const budgetName = match.summary.BudgetName;
-		return {
-			physicalId: budgetName,
-			attributes: { Arn: this.budgetArn(accountId, budgetName) }
-		};
+		return null;
 	}
 };
 
@@ -32893,14 +32253,6 @@ var KinesisStreamProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.Name` → verify
 	*     with `DescribeStream`.
-	*  2. Walk `ListStreams` (paged via `ExclusiveStartStreamName`) and
-	*     match the `aws:cdk:path` tag via `ListTagsForStream(StreamName)`.
-	*     The walk runs through the shared `importTagWalk` helper, so the N+1
-	*     tag-read burst is retried with exponential backoff when AWS
-	*     throttles it instead of aborting the whole import.
-	*
-	* Kinesis tags use the standard `Tag[]` array shape (`Key`/`Value`),
-	* so the walk's `matchesCdkPath` matcher applies directly.
 	*/
 	/**
 	* Read the AWS-current Kinesis stream configuration in CFn-property shape.
@@ -32964,25 +32316,7 @@ var KinesisStreamProvider = class {
 			if (err instanceof ResourceNotFoundException$8) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListStreamsCommand({ ...marker && { ExclusiveStartStreamName: marker } }));
-				const names = list.StreamNames ?? [];
-				return {
-					items: names,
-					nextMarker: list.HasMoreStreams && names.length > 0 ? names[names.length - 1] : void 0
-				};
-			},
-			describe: async (streamName) => await this.getClient().send(new ListTagsForStreamCommand({ StreamName: streamName })),
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Poll DescribeStream until the stream reaches ACTIVE status
@@ -33212,7 +32546,7 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ ResourceARN: physicalId }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$8) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -34129,19 +33463,6 @@ var EFSProvider = class {
 			if (err instanceof FileSystemNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeFileSystemsCommand({ ...marker && { Marker: marker } }));
-			for (const fs of list.FileSystems ?? []) {
-				if (!fs.FileSystemId) continue;
-				if (matchesCdkPath(fs.Tags, input.cdkPath)) return {
-					physicalId: fs.FileSystemId,
-					attributes: {}
-				};
-			}
-			marker = list.NextMarker;
-		} while (marker);
 		return null;
 	}
 	async importAccessPoint(input) {
@@ -34155,23 +33476,6 @@ var EFSProvider = class {
 			if (err instanceof AccessPointNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const fileSystemId = input.properties["FileSystemId"];
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new DescribeAccessPointsCommand({
-				...nextToken && { NextToken: nextToken },
-				...fileSystemId && { FileSystemId: fileSystemId }
-			}));
-			for (const ap of list.AccessPoints ?? []) {
-				if (!ap.AccessPointId) continue;
-				if (matchesCdkPath(ap.Tags, input.cdkPath)) return {
-					physicalId: ap.AccessPointId,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
 };
@@ -35322,18 +34626,6 @@ const CREATE_READY_STATES = /* @__PURE__ */ new Set(["WAITING", "RUNNING"]);
 */
 const TERMINAL_STATES = /* @__PURE__ */ new Set(["TERMINATED", "TERMINATED_WITH_ERRORS"]);
 /**
-* Cluster states that mean "the cluster is alive" — the `ListClusters` filter
-* used by `import()` discovery so a long-gone `TERMINATED*` cluster is never
-* adopted. Everything except the two `TERMINAL_STATES`.
-*/
-const NON_TERMINATED_STATES = [
-	"STARTING",
-	"BOOTSTRAPPING",
-	"RUNNING",
-	"WAITING",
-	"TERMINATING"
-];
-/**
 * Top-level CFn properties that map to a MUTABLE EMR API surface. Every other
 * property is either registry-createOnly (routed through DELETE+CREATE by the
 * replacement-detection layer) or lives inside the `Instances` block (handled
@@ -35842,12 +35134,6 @@ var EMRClusterProvider = class {
 	*     the physical id — a cluster's id (`j-...`) is service-generated, while
 	*     the template `Name` is only the display name — so no name fallback
 	*     applies (`resolveExplicitPhysicalId(..., null)`).
-	*  2. Tag-based lookup: `ListClusters` filtered to the non-terminated states
-	*     (a `TERMINATED*` cluster is gone and must never be adopted), then a
-	*     `DescribeCluster` per candidate to read `Tags` (the list summaries do
-	*     NOT carry tags) and match `aws:cdk:path`. The walk runs through the
-	*     shared `importTagWalk` helper, so each list page / describe is retried
-	*     with exponential backoff when AWS throttles the N+1 read burst.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, null);
@@ -35859,42 +35145,20 @@ var EMRClusterProvider = class {
 				attributes: this.buildAttributes(cluster)
 			};
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListClustersCommand({
-					ClusterStates: [...NON_TERMINATED_STATES],
-					...marker && { Marker: marker }
-				}));
-				return {
-					items: list.Clusters,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (summary) => summary.Id ? await this.describeClusterOrUndefined(summary.Id) : void 0,
-			tagsOf: (cluster) => cluster.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Id,
-			attributes: this.buildAttributes(match.detail)
-		};
+		return null;
 	}
 	/**
 	* `DescribeCluster` that maps a not-found (`InvalidRequestException` — the
 	* cluster id is unknown in this region / aged out of Describe) to
 	* `undefined` instead of throwing, so `import()` can treat it as "no match"
-	* rather than aborting the whole adoption run.
+	* rather than aborting the whole adoption run. Also consumed by
+	* `readCurrentState` for the same gone-cluster tolerance.
 	*
-	* `undefined`, NOT `null`, is load-bearing: `importTagWalk` skips a candidate
-	* on `detail === undefined`, and an actual `null` would flow into `tagsOf`
-	* and `TypeError`. Also note the mapping is BROAD — `InvalidRequestException`
-	* covers more than not-found, so a genuine failure here degrades to "no
-	* match" and a subsequent deploy would CREATE a duplicate cluster rather than
-	* adopt the existing one. The walk logs each skip at debug so the case is at
-	* least visible under `--verbose`; narrowing the mapping needs a
-	* message/code-level discriminator AWS does not currently document.
+	* Note the mapping is BROAD — `InvalidRequestException` covers more than
+	* not-found, so a genuine failure here degrades to "no match" and a
+	* subsequent deploy would CREATE a duplicate cluster rather than adopt the
+	* existing one. Narrowing the mapping needs a message/code-level
+	* discriminator AWS does not currently document.
 	*/
 	async describeClusterOrUndefined(clusterId) {
 		try {
@@ -37826,25 +37090,7 @@ var FirehoseProvider = class {
 			if (err instanceof ResourceNotFoundException$10) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListDeliveryStreamsCommand({ ...marker && { ExclusiveStartDeliveryStreamName: marker } }));
-				const names = list.DeliveryStreamNames ?? [];
-				return {
-					items: names,
-					nextMarker: list.HasMoreDeliveryStreams && names.length > 0 ? names[names.length - 1] : void 0
-				};
-			},
-			describe: async (name) => await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: name })),
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Wait for a delivery stream to become ACTIVE.
@@ -38350,32 +37596,7 @@ var CloudTrailProvider = class {
 			if (err instanceof TrailNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListTrailsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.Trails,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (trail) => {
-				if (!trail.TrailARN || !trail.Name) return void 0;
-				try {
-					return await this.getClient().send(new ListTagsCommand$1({ ResourceIdList: [trail.TrailARN] }));
-				} catch (err) {
-					if (err instanceof TrailNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.ResourceTagList?.[0]?.TagsList
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -39180,7 +38401,7 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }))).tags);
+			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ resourceArn: metadata.Arn }))).tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return void 0;
 			throw err;
@@ -39215,9 +38436,6 @@ var CodeCommitRepositoryProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.RepositoryName` → verify via
 	*     `GetRepository`.
-	*  2. `ListRepositories` paginated, then `ListTagsForResource(arn)` per
-	*     repository to match `aws:cdk:path` (CodeCommit uses the
-	*     `Record<string, string>` tag-map shape).
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "RepositoryName");
@@ -39231,42 +38449,7 @@ var CodeCommitRepositoryProvider = class {
 			if (err instanceof RepositoryDoesNotExistException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListRepositoriesCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.repositories,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (repo) => {
-				if (!repo.repositoryName) return void 0;
-				let metadata;
-				try {
-					metadata = await this.getRepositoryMetadata(repo.repositoryName);
-				} catch (err) {
-					if (err instanceof RepositoryDoesNotExistException) return void 0;
-					throw err;
-				}
-				if (!metadata?.Arn) return void 0;
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }));
-				return {
-					metadata,
-					tags: tagsResp.tags
-				};
-			},
-			tagsOf: (detail) => Object.entries(detail.tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.repositoryName,
-			attributes: this.toAttributes(match.detail.metadata)
-		};
+		return null;
 	}
 	/**
 	* Seed the repository's initial commit from the CFn `Code` property.
@@ -39581,9 +38764,6 @@ var DLMLifecyclePolicyProvider = class {
 	*  1. `--resource` override (`knownPhysicalId`) -> verify via
 	*     GetLifecyclePolicy. There is no template name property — the policy
 	*     id is service-generated — so no name fallback applies.
-	*  2. Tag-based lookup: GetLifecyclePolicies returns every policy summary
-	*     WITH its tag map in a single unpaginated call, so the `aws:cdk:path`
-	*     match needs no per-policy follow-up.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -39596,23 +38776,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async () => {
-				return { items: (await this.getClient().send(new GetLifecyclePoliciesCommand({}))).Policies };
-			},
-			describe: async (policy) => policy.PolicyId ? policy : void 0,
-			tagsOf: (policy) => Object.entries(policy.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.PolicyId,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -39821,7 +38985,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -39835,8 +38999,6 @@ var S3VectorsProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.VectorBucketName`
 	*     → verify via `GetVectorBucket`. The physical id is the bucket name.
-	*  2. `ListVectorBuckets` paginator + `ListTagsForResource(resourceArn)`
-	*     (tags map keyed by tag name) and match `aws:cdk:path`.
 	*/
 	async import(input) {
 		const explicit = input.knownPhysicalId ?? (typeof input.properties?.["VectorBucketName"] === "string" && input.properties["VectorBucketName"].length > 0 ? input.properties["VectorBucketName"] : void 0);
@@ -39850,35 +39012,7 @@ var S3VectorsProvider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListVectorBucketsCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.vectorBuckets,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (bucket) => {
-				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) return void 0;
-				try {
-					return await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }));
-				} catch (err) {
-					if (this.isNotFoundError(err)) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.vectorBucketName,
-			attributes: {}
-		};
+		return null;
 	}
 	isNotFoundError(error) {
 		if (error instanceof Error) {
@@ -40091,10 +39225,6 @@ var S3DirectoryBucketProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.BucketName` →
 	*     verify via `HeadBucket`.
-	*  2. `ListDirectoryBuckets` paginator + `GetBucketTagging` (TagSet:
-	*     Tag[]) and match `aws:cdk:path`. `GetBucketTagging` may surface
-	*     `NoSuchTagSet` / `AccessDenied` per-bucket — those are skipped
-	*     rather than fatal.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "BucketName");
@@ -40109,33 +39239,7 @@ var S3DirectoryBucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (token) => {
-				const list = await this.s3Client.send(new ListDirectoryBucketsCommand({ ...token && { ContinuationToken: token } }));
-				return {
-					items: list.Buckets,
-					nextMarker: list.ContinuationToken
-				};
-			},
-			describe: async (b) => {
-				if (!b.Name) return void 0;
-				try {
-					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
-				} catch (err) {
-					const e = err;
-					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied") return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagging) => tagging.TagSet
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -40251,7 +39355,7 @@ var S3TablesProvider = class {
 				if (!namespaceName) continue;
 				let tableContinuationToken;
 				do {
-					const tablesResult = await this.getClient().send(new ListTablesCommand$1({
+					const tablesResult = await this.getClient().send(new ListTablesCommand({
 						tableBucketARN,
 						namespace: namespaceName,
 						continuationToken: tableContinuationToken
@@ -40591,7 +39695,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -40993,8 +40097,6 @@ var ECRProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.RepositoryName` → verify via
 	*     `DescribeRepositories`.
-	*  2. `DescribeRepositories` paginated, then `ListTagsForResource(arn)`
-	*     per repository to match `aws:cdk:path` (`Tag[]` array shape).
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "RepositoryName");
@@ -41007,32 +40109,7 @@ var ECRProvider = class {
 			if (err instanceof RepositoryNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeRepositoriesCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.repositories,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (repo) => {
-				if (!repo.repositoryArn || !repo.repositoryName) return void 0;
-				try {
-					return await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: repo.repositoryArn }));
-				} catch (err) {
-					if (err instanceof RepositoryNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.repositoryName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -42090,10 +41167,6 @@ var ACMCertificateProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override (must be an ARN — ACM has no other unique id).
-	*  2. Tag-based `aws:cdk:path` match across `ListCertificates` +
-	*     `ListTagsForCertificate`. NOTE: ACM has no `Scope: Local` filter —
-	*     `ListCertificates` returns customer-managed certs only (AWS-managed
-	*     certs are not surfaced via this API), so no extra guard is needed.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) {
@@ -42113,36 +41186,7 @@ var ACMCertificateProvider = class {
 				throw err;
 			}
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.acmClient.send(new ListCertificatesCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.CertificateSummaryList,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (summary) => {
-				if (!summary.CertificateArn) return void 0;
-				try {
-					return await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: summary.CertificateArn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$6) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		const arn = match.summary.CertificateArn;
-		return {
-			physicalId: arn,
-			attributes: {
-				Arn: arn,
-				CertificateArn: arn
-			}
-		};
+		return null;
 	}
 	/**
 	* Poll `DescribeCertificate` until status === `ISSUED`. On the FIRST poll
@@ -42572,15 +41616,17 @@ async function deployCommand(stacks, options) {
 		logger.info(cyan(synthesisStatusMessage(app, "Synthesizing CDK app...")));
 		const synthesizer = new Synthesizer();
 		const context = parseContextOptions(options.context);
-		const { stacks: allStacks } = await synthesizer.synthesize({
+		const synthOptions = {
 			app: options.app,
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
 			...Object.keys(context).length > 0 && { context },
 			stateBucket,
-			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
-		});
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
+			deferMacroExpansion: true
+		};
+		const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
 		logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
@@ -42619,6 +41665,7 @@ async function deployCommand(stacks, options) {
 			};
 			for (const stack of [...targetStacks]) addDependencies(stack.stackName);
 		}
+		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({ region: options.region || process.env["AWS_REGION"] || "us-east-1" });
 		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -44279,15 +43326,17 @@ async function diffCommand(stacks, options) {
 		logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
 		const synthesizer = new Synthesizer();
 		const context = parseContextOptions(options.context);
-		const { stacks: allStacks } = await synthesizer.synthesize({
+		const synthOptions = {
 			app: options.app,
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
 			...Object.keys(context).length > 0 && { context },
 			stateBucket,
-			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
-		});
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
+			deferMacroExpansion: true
+		};
+		const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
 		logger.info(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
@@ -44296,6 +43345,7 @@ async function diffCommand(stacks, options) {
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
 		if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const stateConfig = {
 			bucket: stateBucket,
 			prefix: options.statePrefix
@@ -45524,8 +44574,7 @@ async function destroyCommand(stackArgs, options) {
 				app: appCmd,
 				output: options.output || "cdk.out",
 				...Object.keys(context).length > 0 && { context },
-				stateBucket,
-				...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
+				deferMacroExpansion: true
 			});
 			appStacks = result.stacks.map((s) => ({
 				stackName: s.stackName,
@@ -51728,12 +50777,10 @@ async function importOne(task) {
 		outcome: "skipped-no-impl",
 		reason: `provider does not implement import (yet)`
 	};
-	const cdkPath = readCdkPath(resource);
 	const properties = substituteOverrideRefs(resource.Properties ?? {}, overrides);
 	const input = {
 		logicalId,
 		resourceType: resource.Type,
-		cdkPath,
 		stackName,
 		region,
 		properties,
@@ -51745,7 +50792,7 @@ async function importOne(task) {
 			logicalId,
 			resourceType: resource.Type,
 			outcome: "skipped-not-found",
-			reason: "no matching AWS resource"
+			reason: `no matching AWS resource — pass --resource ${logicalId}=<physicalId> to adopt it explicitly`
 		};
 		return {
 			logicalId,
@@ -61823,7 +60870,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.4");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());