@go-to-k/cdkd 0.257.3 → 0.258.0

package/dist/cli.js

@@ -1,27 +1,28 @@
 #!/usr/bin/env node
-import { $ as AssetModeResolver, $t as StackTerminationProtectionError, A as importTagWalk, At as expectedOwnerParam, B as DagBuilder, C as slowCcOperationTimeoutMs, Ct as resolveUseCdkBootstrapAssets, D as cfnRefValueFromPhysicalId, Dt as MIGRATE_TMP_PREFIX, E as IntrinsicFunctionResolver, Et as CFN_TEMPLATE_URL_LIMIT, F as normalizeAwsTagsToCfn, Ft as getAwsClients, G as shouldRetainResource, H as LockManager, Ht as LocalInvokeBuildError$1, I as resolveExplicitPhysicalId, It as resetAwsClients, J as WorkGraph, Jt as PartialFailureError, K as AssetPublisher, Kt as MissingCdkCliError, L as assertRegionMatch, Lt as setAwsClients, M as isRetryableTransientError, N as CDK_PATH_TAG, Nt as resolveBucketRegion, O as refStateLookupFromResource, Ot as findLargeInlineResources, P as matchesCdkPath, Pt as AwsClients, Q as rewriteTemplateAssetReferences, Qt as StackHasActiveImportsError, R as applyRoleArnIfSet, S as CloudControlProvider, St as resolveStateBucketWithDefaultAndSource, T as isTerminationProtectionPropagationError, Tt as CFN_TEMPLATE_BODY_LIMIT, U as S3StateBackend, Ut as LocalMigrateError, V as TemplateParser, W as rebuildClientForBucketRegion, Wt as LocalStartServiceError, X as createAssetRedirectResolver, Xt as ResourceTimeoutError, Y as buildAssetRedirectMap, Yt as ProvisioningError, Z as loadPublishableAssetManifest, Zt as ResourceUpdateNotSupportedError, _ as yellow, _t as resolveApp, a as IMPLICIT_DELETE_DEPENDENCIES, an as withErrorHandling, at as validateContainerRepoName, b as ProviderRegistry, bt as resolveSkipPrefix, c as MULTI_REGION_RECREATE_BLOCKED_TYPES, ct as getDockerCmd, d as formatResourceLine, dt as AssetManifestLoader, et as BOOTSTRAP_MARKER_PREFIX, f as bold, ft as getDockerImageBySourceHash, g as red, gt as getLegacyStateBucketName, h as green, ht as getDefaultStateBucketName, i as withResourceDeadline, in as normalizeAwsError, it as validateAssetBucketName, j as withRetry, jt as AssemblyReader, k as WAFv2WebACLProvider, kt as uploadCfnTemplate, l as isStatefulRecreateTargetSync, lt as runDockerForeground, m as gray, mt as synthesisStatusMessage, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as getBootstrapMarkerKey, o as computeImplicitDeleteEdges, ot as buildDockerImage, p as cyan, pt as Synthesizer, q as stringifyValue, qt as NestedStackChildDirectDestroyError, r as DeployEngine, rt as parseBootstrapMarker, s as extractDeploymentEventError, st as formatDockerLoginError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as ensureAssetStorage, u as renderStatefulReason, ut as runDockerStreaming, v as IAMRoleProvider, vt as resolveAutoAssetStorage, w as disableInstanceApiTermination, wt as warnDeprecatedNoPrefixCliFlag, x as findActionableSilentDrops, xt as resolveStateBucketWithDefault, y as collectInlinePolicyNamesManagedBySiblings, yt as resolveCaptureObservedState, z as DiffCalculator, zt as CdkdError } from "./deploy-engine-0U3bYBq4.js";
+import { $ as getBootstrapMarkerKey, A as refStateLookupFromResource, At as resolveBucketRegion, B as S3StateBackend, Bt as LocalMigrateError, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_URL_LIMIT, D as isTerminationProtectionPropagationError, Dt as expectedOwnerParam, E as disableInstanceApiTermination, Et as uploadCfnTemplate, F as applyRoleArnIfSet, G as WorkGraph, Gt as PartialFailureError, H as shouldRetainResource, I as DiffCalculator, It as CdkdError, J as loadPublishableAssetManifest, Jt as ResourceUpdateNotSupportedError, K as buildAssetRedirectMap, Kt as ProvisioningError, L as DagBuilder, M as normalizeAwsTagsToCfn, Mt as getAwsClients, N as resolveExplicitPhysicalId, Nt as resetAwsClients, O as IntrinsicFunctionResolver, Ot as AssemblyReader, P as assertRegionMatch, Pt as setAwsClients, Q as ensureAssetStorage, R as TemplateParser, S as ProviderRegistry, St as CFN_TEMPLATE_BODY_LIMIT, T as slowCcOperationTimeoutMs, Tt as findLargeInlineResources, U as AssetPublisher, Ut as MissingCdkCliError, V as rebuildClientForBucketRegion, Vt as LocalStartServiceError, W as stringifyValue, Wt as NestedStackChildDirectDestroyError, X as AssetModeResolver, Xt as StackTerminationProtectionError, Y as rewriteTemplateAssetReferences, Yt as StackHasActiveImportsError, Z as BOOTSTRAP_MARKER_PREFIX, _ as green, _t as resolveSkipPrefix, a as withRetry, at as getDockerCmd, b as IAMRoleProvider, bt as resolveUseCdkBootstrapAssets, c as computeImplicitDeleteEdges, ct as AssetManifestLoader, d as isStatefulRecreateTargetSync, dt as synthesisStatusMessage, et as parseBootstrapMarker, f as renderStatefulReason, ft as getDefaultStateBucketName, g as gray, gt as resolveCaptureObservedState, h as cyan, ht as resolveAutoAssetStorage, i as withResourceDeadline, it as formatDockerLoginError, j as WAFv2WebACLProvider, jt as AwsClients, k as cfnRefValueFromPhysicalId, l as extractDeploymentEventError, lt as getDockerImageBySourceHash, m as bold, mt as resolveApp, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as withErrorHandling, nt as validateContainerRepoName, o as isRetryableTransientError, ot as runDockerForeground, p as formatResourceLine, pt as getLegacyStateBucketName, q as createAssetRedirectResolver, qt as ResourceTimeoutError, r as DeployEngine, rt as buildDockerImage, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerStreaming, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as normalizeAwsError, tt as validateAssetBucketName, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as Synthesizer, v as red, vt as resolveStateBucketWithDefault, w as CloudControlProvider, wt as MIGRATE_TMP_PREFIX, x as collectInlinePolicyNamesManagedBySiblings, xt as warnDeprecatedNoPrefixCliFlag, y as yellow, yt as resolveStateBucketWithDefaultAndSource, z as LockManager, zt as LocalInvokeBuildError$1 } from "./deploy-engine-Dg51mHCV.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-Co34HfIH.js";
+import { t as ASGProvider } from "./asg-provider-rcNqhfPS.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
-import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
-import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
-import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, ListQueuesCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
+import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
+import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
+import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
-import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListFunctionsCommand, ListLayersCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
+import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
-import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTablesCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
+import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
 import { CloudFormationClient, CreateChangeSetCommand, DeleteChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeStackEventsCommand, DescribeStackResourcesCommand, DescribeStacksCommand, DescribeTypeCommand, ExecuteChangeSetCommand, GetTemplateCommand, UpdateStackCommand, waitUntilChangeSetCreateComplete, waitUntilStackDeleteComplete, waitUntilStackImportComplete, waitUntilStackUpdateComplete } from "@aws-sdk/client-cloudformation";
 import { APIGatewayClient, CreateAuthorizerCommand, CreateDeploymentCommand, CreateResourceCommand, CreateStageCommand, DeleteAuthorizerCommand, DeleteDeploymentCommand, DeleteMethodCommand, DeleteResourceCommand, DeleteStageCommand, GetAccountCommand, GetAuthorizerCommand, GetDeploymentCommand, GetMethodCommand, GetResourceCommand, GetStageCommand, NotFoundException as NotFoundException$1, PutIntegrationCommand, PutIntegrationResponseCommand, PutMethodCommand, PutMethodResponseCommand, TagResourceCommand as TagResourceCommand$3, UntagResourceCommand as UntagResourceCommand$3, UpdateAccountCommand, UpdateAuthorizerCommand, UpdateMethodCommand, UpdateStageCommand } from "@aws-sdk/client-api-gateway";
-import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListEventBusesCommand, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
-import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, ListSecretsCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
+import { CreateEventBusCommand, DeleteEventBusCommand, DeleteRuleCommand, DescribeEventBusCommand, DescribeRuleCommand, EventBridgeClient, ListRulesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$1, ListTargetsByRuleCommand, PutRuleCommand, PutTargetsCommand, RemoveTargetsCommand, ResourceNotFoundException as ResourceNotFoundException$2, TagResourceCommand as TagResourceCommand$4, UntagResourceCommand as UntagResourceCommand$4, UpdateEventBusCommand } from "@aws-sdk/client-eventbridge";
+import { CreateSecretCommand, DeleteSecretCommand, DescribeSecretCommand, GetSecretValueCommand, RemoveRegionsFromReplicationCommand, ReplicateSecretToRegionsCommand, ResourceNotFoundException as ResourceNotFoundException$3, SecretsManagerClient, TagResourceCommand as TagResourceCommand$5, UntagResourceCommand as UntagResourceCommand$5, UpdateSecretCommand } from "@aws-sdk/client-secrets-manager";
 import { AddTagsToResourceCommand, DeleteParameterCommand, DescribeParametersCommand, GetParameterCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$2, ParameterNotFound, PutParameterCommand, RemoveTagsFromResourceCommand, SSMClient } from "@aws-sdk/client-ssm";
-import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, ListDistributionsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand } from "@aws-sdk/client-cloudfront";
+import { CloudFrontClient, CreateCloudFrontOriginAccessIdentityCommand, CreateDistributionCommand, CreateDistributionWithTagsCommand, DeleteCloudFrontOriginAccessIdentityCommand, DeleteDistributionCommand, GetCloudFrontOriginAccessIdentityCommand, GetDistributionCommand, GetDistributionConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$3, NoSuchCloudFrontOriginAccessIdentity, NoSuchDistribution, TagResourceCommand as TagResourceCommand$6, UntagResourceCommand as UntagResourceCommand$6, UpdateCloudFrontOriginAccessIdentityCommand, UpdateDistributionCommand } from "@aws-sdk/client-cloudfront";
 import { CloudWatchClient, DeleteAlarmsCommand, DescribeAlarmsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$4, PutMetricAlarmCommand, TagResourceCommand as TagResourceCommand$7, UntagResourceCommand as UntagResourceCommand$7 } from "@aws-sdk/client-cloudwatch";
 import { AssociateKmsKeyCommand, CloudWatchLogsClient, CreateLogGroupCommand, DeleteDataProtectionPolicyCommand, DeleteIndexPolicyCommand, DeleteLogGroupCommand, DeleteRetentionPolicyCommand, DescribeIndexPoliciesCommand, DescribeLogGroupsCommand, DisassociateKmsKeyCommand, GetDataProtectionPolicyCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$5, PutBearerTokenAuthenticationCommand, PutDataProtectionPolicyCommand, PutIndexPolicyCommand, PutLogGroupDeletionProtectionCommand, PutRetentionPolicyCommand, ResourceAlreadyExistsException, ResourceNotFoundException as ResourceNotFoundException$4, TagResourceCommand as TagResourceCommand$8, UntagResourceCommand as UntagResourceCommand$8 } from "@aws-sdk/client-cloudwatch-logs";
 import { BedrockAgentCoreControlClient, CreateAgentRuntimeCommand, CreateEvaluatorCommand, DeleteAgentRuntimeCommand, DeleteEvaluatorCommand, GetAgentRuntimeCommand, GetBrowserCommand, GetCodeInterpreterCommand, GetEvaluatorCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$6, ResourceNotFoundException as ResourceNotFoundException$5, TagResourceCommand as TagResourceCommand$9, UntagResourceCommand as UntagResourceCommand$9, UpdateAgentRuntimeCommand, UpdateEvaluatorCommand } from "@aws-sdk/client-bedrock-agentcore-control";
-import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListCertificatesCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
+import { ACMClient, AddTagsToCertificateCommand, DeleteCertificateCommand, DescribeCertificateCommand, ListTagsForCertificateCommand, RemoveTagsFromCertificateCommand, RequestCertificateCommand, ResourceNotFoundException as ResourceNotFoundException$6, UpdateCertificateOptionsCommand } from "@aws-sdk/client-acm";
+import { CreateMicrovmImageCommand, DeleteMicrovmImageCommand, GetMicrovmImageCommand, LambdaMicrovmsClient, ResourceNotFoundException as ResourceNotFoundException$7, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateMicrovmImageCommand } from "@aws-sdk/client-lambda-microvms";
 import * as fs from "node:fs";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as path from "node:path";
@@ -30,9 +31,9 @@ import { execFile, spawn } from "node:child_process";
 import { tmpdir } from "node:os";
 import { AssociateVPCWithHostedZoneCommand, ChangeResourceRecordSetsCommand, ChangeTagsForResourceCommand, CreateHostedZoneCommand, CreateQueryLoggingConfigCommand, DeleteHostedZoneCommand, DeleteQueryLoggingConfigCommand, DisassociateVPCFromHostedZoneCommand, GetHostedZoneCommand, ListHostedZonesByNameCommand, ListQueryLoggingConfigsCommand, ListResourceRecordSetsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$7, Route53Client, UpdateHostedZoneCommentCommand, UpdateHostedZoneFeaturesCommand } from "@aws-sdk/client-route-53";
 import { AddTagsCommand, CreateListenerCommand, CreateLoadBalancerCommand, CreateTargetGroupCommand, DeleteListenerCommand, DeleteLoadBalancerCommand, DeleteTargetGroupCommand, DescribeListenerAttributesCommand, DescribeListenersCommand, DescribeLoadBalancerAttributesCommand, DescribeLoadBalancersCommand, DescribeTagsCommand, DescribeTargetGroupsCommand, ElasticLoadBalancingV2Client, ModifyListenerAttributesCommand, ModifyListenerCommand, ModifyLoadBalancerAttributesCommand, ModifyTargetGroupCommand, RemoveTagsCommand, SetIpAddressTypeCommand, SetSecurityGroupsCommand, SetSubnetsCommand } from "@aws-sdk/client-elastic-load-balancing-v2";
-import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListKeysCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$10, UntagResourceCommand as UntagResourceCommand$10, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
+import { CreateAliasCommand, CreateKeyCommand, DeleteAliasCommand, DescribeKeyCommand, DisableKeyCommand, DisableKeyRotationCommand, EnableKeyCommand, EnableKeyRotationCommand, GetKeyPolicyCommand, GetKeyRotationStatusCommand, KMSClient, ListAliasesCommand, ListResourceTagsCommand, NotFoundException as NotFoundException$2, PutKeyPolicyCommand, ScheduleKeyDeletionCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11, UpdateAliasCommand, UpdateKeyDescriptionCommand } from "@aws-sdk/client-kms";
 import { join as join$1 } from "path";
-import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$11, UntagResourceCommand as UntagResourceCommand$11 } from "@aws-sdk/client-ecr";
+import { BatchDeleteImageCommand, CreateRepositoryCommand, DeleteLifecyclePolicyCommand, DeleteRepositoryCommand, DeleteRepositoryPolicyCommand, DescribeImagesCommand as DescribeImagesCommand$1, DescribeRepositoriesCommand, ECRClient, GetAuthorizationTokenCommand, GetLifecyclePolicyCommand, LifecyclePolicyNotFoundException, ListTagsForResourceCommand as ListTagsForResourceCommand$8, PutImageScanningConfigurationCommand, PutImageTagMutabilityCommand, PutLifecyclePolicyCommand, RepositoryNotFoundException, SetRepositoryPolicyCommand, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12 } from "@aws-sdk/client-ecr";
 import graphlib from "graphlib";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$1, CreateDBClusterCommand, CreateDBInstanceCommand, CreateDBProxyCommand, CreateDBProxyEndpointCommand, CreateDBSubnetGroupCommand, DBProxyEndpointNotFoundFault, DBProxyNotFoundFault, DBProxyTargetGroupNotFoundFault, DBProxyTargetNotFoundFault, DeleteDBClusterCommand, DeleteDBInstanceCommand, DeleteDBProxyCommand, DeleteDBProxyEndpointCommand, DeleteDBSubnetGroupCommand, DeregisterDBProxyTargetsCommand, DescribeDBClustersCommand, DescribeDBInstancesCommand, DescribeDBProxiesCommand, DescribeDBProxyEndpointsCommand, DescribeDBProxyTargetGroupsCommand, DescribeDBProxyTargetsCommand, DescribeDBSubnetGroupsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$9, ModifyDBClusterCommand, ModifyDBInstanceCommand, ModifyDBProxyCommand, ModifyDBProxyEndpointCommand, ModifyDBProxyTargetGroupCommand, ModifyDBSubnetGroupCommand, RDSClient, RegisterDBProxyTargetsCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$1 } from "@aws-sdk/client-rds";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$2, CreateCacheClusterCommand, CreateCacheSubnetGroupCommand, DeleteCacheClusterCommand, DeleteCacheSubnetGroupCommand, DescribeCacheClustersCommand, DescribeCacheSubnetGroupsCommand, ElastiCacheClient, ListTagsForResourceCommand as ListTagsForResourceCommand$10, ModifyCacheClusterCommand, ModifyCacheSubnetGroupCommand, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$2 } from "@aws-sdk/client-elasticache";
@@ -43,29 +44,29 @@ import { writeFileSync as writeFileSync$1 } from "fs";
 import * as zlib from "node:zlib";
 import { ApplicationAutoScalingClient, DeleteScalingPolicyCommand, DeregisterScalableTargetCommand, DescribeScalableTargetsCommand, DescribeScalingPoliciesCommand, PutScalingPolicyCommand, RegisterScalableTargetCommand } from "@aws-sdk/client-application-auto-scaling";
 import { ApiGatewayV2Client, CreateApiCommand, CreateAuthorizerCommand as CreateAuthorizerCommand$1, CreateIntegrationCommand, CreateRouteCommand as CreateRouteCommand$1, CreateStageCommand as CreateStageCommand$1, DeleteApiCommand, DeleteAuthorizerCommand as DeleteAuthorizerCommand$1, DeleteIntegrationCommand, DeleteRouteCommand as DeleteRouteCommand$1, DeleteStageCommand as DeleteStageCommand$1, GetApiCommand, GetAuthorizerCommand as GetAuthorizerCommand$1, GetIntegrationCommand, GetRouteCommand, GetStageCommand as GetStageCommand$1, NotFoundException as NotFoundException$3, UpdateApiCommand, UpdateAuthorizerCommand as UpdateAuthorizerCommand$1, UpdateIntegrationCommand, UpdateRouteCommand, UpdateStageCommand as UpdateStageCommand$1 } from "@aws-sdk/client-apigatewayv2";
-import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListStateMachinesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$12, UntagResourceCommand as UntagResourceCommand$12, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
-import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
+import { CreateStateMachineCommand, DeleteStateMachineCommand, DescribeStateMachineCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$11, SFNClient, StateMachineDoesNotExist, TagResourceCommand as TagResourceCommand$13, UntagResourceCommand as UntagResourceCommand$13, UpdateStateMachineCommand } from "@aws-sdk/client-sfn";
+import { CreateClusterCommand, CreateServiceCommand, DeleteClusterCommand, DeleteServiceCommand, DeregisterTaskDefinitionCommand, DescribeClustersCommand, DescribeServicesCommand, DescribeTaskDefinitionCommand, ECSClient, PutClusterCapacityProvidersCommand, RegisterTaskDefinitionCommand, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateClusterCommand, UpdateServiceCommand } from "@aws-sdk/client-ecs";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$3, CreateDBClusterCommand as CreateDBClusterCommand$1, CreateDBInstanceCommand as CreateDBInstanceCommand$1, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$1, DeleteDBClusterCommand as DeleteDBClusterCommand$1, DeleteDBInstanceCommand as DeleteDBInstanceCommand$1, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$1, DescribeDBClustersCommand as DescribeDBClustersCommand$1, DescribeDBInstancesCommand as DescribeDBInstancesCommand$1, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$1, DocDBClient, ListTagsForResourceCommand as ListTagsForResourceCommand$12, ModifyDBClusterCommand as ModifyDBClusterCommand$1, ModifyDBInstanceCommand as ModifyDBInstanceCommand$1, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$1, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$3 } from "@aws-sdk/client-docdb";
 import { AddTagsToResourceCommand as AddTagsToResourceCommand$4, CreateDBClusterCommand as CreateDBClusterCommand$2, CreateDBInstanceCommand as CreateDBInstanceCommand$2, CreateDBSubnetGroupCommand as CreateDBSubnetGroupCommand$2, DeleteDBClusterCommand as DeleteDBClusterCommand$2, DeleteDBInstanceCommand as DeleteDBInstanceCommand$2, DeleteDBSubnetGroupCommand as DeleteDBSubnetGroupCommand$2, DescribeDBClustersCommand as DescribeDBClustersCommand$2, DescribeDBInstancesCommand as DescribeDBInstancesCommand$2, DescribeDBSubnetGroupsCommand as DescribeDBSubnetGroupsCommand$2, ListTagsForResourceCommand as ListTagsForResourceCommand$13, ModifyDBClusterCommand as ModifyDBClusterCommand$2, ModifyDBInstanceCommand as ModifyDBInstanceCommand$2, ModifyDBSubnetGroupCommand as ModifyDBSubnetGroupCommand$2, NeptuneClient, RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand$4 } from "@aws-sdk/client-neptune";
-import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$7, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
-import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$15, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$14, UntagResourceCommand as UntagResourceCommand$14, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
-import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
+import { AddCustomAttributesCommand, CognitoIdentityProviderClient, CreateUserPoolCommand, DeleteUserPoolCommand, DescribeUserPoolCommand, GetUserPoolMfaConfigCommand, ListUserPoolsCommand, ResourceNotFoundException as ResourceNotFoundException$8, SetUserPoolMfaConfigCommand, UpdateUserPoolCommand } from "@aws-sdk/client-cognito-identity-provider";
+import { CreateHttpNamespaceCommand, CreatePrivateDnsNamespaceCommand, CreatePublicDnsNamespaceCommand, CreateServiceCommand as CreateServiceCommand$1, DeleteNamespaceCommand, DeleteServiceAttributesCommand, DeleteServiceCommand as DeleteServiceCommand$1, GetNamespaceCommand, GetOperationCommand, GetServiceAttributesCommand, GetServiceCommand, ListNamespacesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$14, NamespaceNotFound, ServiceDiscoveryClient, ServiceNotFound, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateHttpNamespaceCommand, UpdatePrivateDnsNamespaceCommand, UpdatePublicDnsNamespaceCommand, UpdateServiceAttributesCommand, UpdateServiceCommand as UpdateServiceCommand$1 } from "@aws-sdk/client-servicediscovery";
+import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGraphqlApiCommand, CreateResolverCommand, DeleteApiKeyCommand, DeleteDataSourceCommand, DeleteGraphqlApiCommand, DeleteResolverCommand, GetDataSourceCommand, GetGraphqlApiCommand, GetIntrospectionSchemaCommand, GetResolverCommand, ListApiKeysCommand, NotFoundException as NotFoundException$4, StartSchemaCreationCommand, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateApiKeyCommand, UpdateDataSourceCommand, UpdateGraphqlApiCommand, UpdateResolverCommand } from "@aws-sdk/client-appsync";
 import { parse, print } from "graphql";
 import { CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
-import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DescribeBudgetsCommand, DuplicateRecordException, ListTagsForResourceCommand as ListTagsForResourceCommand$16, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
-import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListStreamsCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$8, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
-import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
+import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
+import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$9, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
+import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$10, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
-import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
-import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
-import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
-import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
-import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
+import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
+import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$11, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
+import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
+import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ResourceNotFoundException as ResourceNotFoundException$12, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$16, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import AdmZip from "adm-zip";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$20, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$13, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, S3VectorsClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$23, UntagResourceCommand as UntagResourceCommand$23 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1354,7 +1355,8 @@ async function listCommand(patterns, options) {
 		output: options.output,
 		...options.region && { region: options.region },
 		...options.profile && { profile: options.profile },
-		...Object.keys(context).length > 0 && { context }
+		...Object.keys(context).length > 0 && { context },
+		deferMacroExpansion: true
 	};
 	const allStacks = (await synthesizer.synthesize(synthOptions)).stacks;
 	if (allStacks.length === 0) throw new Error("No stacks found in assembly");
@@ -1899,7 +1901,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.257.3";
+	return "0.258.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -3485,8 +3487,6 @@ var IAMManagedPolicyProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.ManagedPolicyName` → walk
 	*     `ListPolicies(Scope: 'Local')` to find the matching ARN.
-	*  2. `ListPolicies(Scope: 'Local')` → for each candidate, `ListPolicyTags`
-	*     and match against `aws:cdk:path`.
 	*
 	* Scope is forced to `'Local'` (customer-managed policies) — adopting an
 	* AWS-managed policy would let cdkd delete it on next destroy, which would
@@ -3515,36 +3515,7 @@ var IAMManagedPolicyProvider = class {
 			};
 			return null;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.iamClient.send(new ListPoliciesCommand({
-					Scope: "Local",
-					...marker ? { Marker: marker } : {}
-				}));
-				return {
-					items: list.Policies,
-					nextMarker: list.IsTruncated ? list.Marker : void 0
-				};
-			},
-			describe: async (policy) => {
-				if (!policy.Arn) return void 0;
-				try {
-					return await this.iamClient.send(new ListPolicyTagsCommand({ PolicyArn: policy.Arn }));
-				} catch (err) {
-					if (err instanceof NoSuchEntityException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tags) => tags.Tags
-		});
-		if (!match) return null;
-		const arn = match.summary.Arn;
-		return {
-			physicalId: arn,
-			attributes: { PolicyArn: arn }
-		};
+		return null;
 	}
 	async attachToPrincipals(policyArn, groups, roles, users) {
 		if (groups && Array.isArray(groups)) for (const groupName of groups) {
@@ -3945,13 +3916,6 @@ var IAMInstanceProfileProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.InstanceProfileName` → verify
 	*     via `GetInstanceProfile`.
-	*  2. `ListInstanceProfiles` paginator + a per-candidate `GetInstanceProfile`
-	*     to read the tags, matched against `aws:cdk:path`. The list API does
-	*     NOT return tags (AWS documents this on the command) even though the
-	*     `InstanceProfile` type declares `Tags?`, so reading them off the
-	*     summary typechecks and never matches.
-	*
-	* IAM is global; this walks every instance profile in the account once.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "InstanceProfileName");
@@ -3965,32 +3929,7 @@ var IAMInstanceProfileProvider = class {
 			if (err instanceof NoSuchEntityException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.iamClient.send(new ListInstanceProfilesCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.InstanceProfiles,
-					nextMarker: list.IsTruncated ? list.Marker : void 0
-				};
-			},
-			describe: async (profile) => {
-				if (!profile.InstanceProfileName) return void 0;
-				try {
-					return (await this.iamClient.send(new GetInstanceProfileCommand({ InstanceProfileName: profile.InstanceProfileName }))).InstanceProfile;
-				} catch (err) {
-					if (err instanceof NoSuchEntityException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (detail) => detail?.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.InstanceProfileName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -6290,8 +6229,6 @@ var S3BucketProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.BucketName` → use directly,
 	*     verify with `HeadBucket`.
-	*  2. `ListBuckets` + `GetBucketTagging`, match `aws:cdk:path` against the
-	*     CDK construct path.
 	*
 	* Returns `null` when nothing matches — caller treats this as
 	* "not deployed yet" rather than a failure.
@@ -6309,32 +6246,7 @@ var S3BucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async () => {
-				return {
-					items: (await this.s3Client.send(new ListBucketsCommand({}))).Buckets,
-					nextMarker: void 0
-				};
-			},
-			describe: async (b) => {
-				if (!b.Name) return void 0;
-				try {
-					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
-				} catch (err) {
-					const e = err;
-					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied" || e.$metadata?.httpStatusCode === 301) return;
-					throw err;
-				}
-			},
-			tagsOf: (tagging) => tagging.TagSet
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Delete a bucket, emptying it first if not empty.
@@ -7150,7 +7062,6 @@ var SQSQueueProvider = class {
 	* Lookup order:
 	*  1. `--resource` override (URL) → verify via `GetQueueAttributes`.
 	*  2. `Properties.QueueName` → `GetQueueUrl` for direct lookup.
-	*  3. `aws:cdk:path` tag match via `ListQueues` + `ListQueueTags`.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7178,34 +7089,7 @@ var SQSQueueProvider = class {
 			if (err instanceof QueueDoesNotExist) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.sqsClient.send(new ListQueuesCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.QueueUrls,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (url) => {
-				try {
-					return await this.sqsClient.send(new ListQueueTagsCommand({ QueueUrl: url }));
-				} catch (err) {
-					if (err instanceof QueueDoesNotExist) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -7873,17 +7757,13 @@ var SNSTopicProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override → trust as ARN, verify via `GetTopicAttributes`.
-	*  2. `Properties.TopicName` → `ListTopics` to find matching ARN.
-	*  3. `aws:cdk:path` tag match via `ListTopics` + `ListTagsForResource`.
-	*
-	* Steps 2 and 3 share ONE `ListTopics` walk (per candidate: name check
-	* first, then the tag read — only when a `cdkPath` is present), which runs
-	* through the shared `importTagWalk` helper so the N+1 `ListTagsForResource`
-	* burst is retried with exponential backoff when AWS throttles it instead
-	* of aborting the whole import. The name match is expressed to the walk as
-	* a synthetic `aws:cdk:path` tag carrying the walk's own lookup key, so a
-	* name-only template (no CDK path metadata) still resolves without any tag
-	* API call — matching the previous inline loop.
+	*  2. `Properties.TopicName` → `ListTopics` to find the matching ARN.
+	*
+	* The `aws:cdk:path` tag match that used to ride the same `ListTopics` walk
+	* is gone (issue #1134): AWS rejects `aws:`-prefixed tag writes, so that tag
+	* never exists on a real resource and the walk could not match. Auto-mode
+	* import resolves ids from CloudFormation's `DescribeStackResources` or the
+	* template's physical name; without a `TopicName` there is nothing to match.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -7897,40 +7777,19 @@ var SNSTopicProvider = class {
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["TopicName"] === "string" ? input.properties["TopicName"] : void 0;
-		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:sns-topic-name:${desiredName}` : void 0);
-		/** Sentinel detail for a candidate matched by its ARN-tail topic name. */
-		const NAME_MATCH = { nameMatch: true };
-		const match = await importTagWalk({
-			cdkPath: walkCdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.snsClient.send(new ListTopicsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.Topics,
-					nextMarker: list.NextToken
+		if (!desiredName) return null;
+		let marker;
+		do {
+			const list = await this.snsClient.send(new ListTopicsCommand({ ...marker && { NextToken: marker } }));
+			for (const t of list.Topics ?? []) {
+				if (!t.TopicArn) continue;
+				if (t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1) === desiredName) return {
+					physicalId: t.TopicArn,
+					attributes: {}
 				};
-			},
-			describe: async (t) => {
-				if (!t.TopicArn) return void 0;
-				const arnTail = t.TopicArn.substring(t.TopicArn.lastIndexOf(":") + 1);
-				if (desiredName && arnTail === desiredName) return NAME_MATCH;
-				if (!input.cdkPath) return void 0;
-				try {
-					return await this.snsClient.send(new ListTagsForResourceCommand({ ResourceArn: t.TopicArn }));
-				} catch (err) {
-					if (err instanceof NotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (detail) => "nameMatch" in detail ? [{
-				Key: CDK_PATH_TAG,
-				Value: walkCdkPath
-			}] : detail.Tags
-		});
-		if (match?.summary.TopicArn) return {
-			physicalId: match.summary.TopicArn,
-			attributes: {}
-		};
+			}
+			marker = list.NextToken;
+		} while (marker);
 		return null;
 	}
 };
@@ -9284,15 +9143,6 @@ var LambdaFunctionProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.FunctionName` → use directly,
 	*     verify via `GetFunction`.
-	*  2. `ListFunctions` + `ListTags`, match `aws:cdk:path` tag.
-	*
-	* Lambda's `ListTags` returns a `Tags` map keyed by tag name (unlike
-	* EC2/S3 which return an array of `{Key, Value}`), so the map is re-shaped
-	* to `{Key, Value}` entries for the walk's matcher.
-	*
-	* The tag walk runs through the shared `importTagWalk` helper, so the N+1
-	* `ListTags` burst is retried with exponential backoff when AWS throttles
-	* it instead of aborting the whole import.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "FunctionName");
@@ -9306,35 +9156,7 @@ var LambdaFunctionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.lambdaClient.send(new ListFunctionsCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Functions,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (fn) => {
-				if (!fn.FunctionArn || !fn.FunctionName) return void 0;
-				try {
-					return await this.lambdaClient.send(new ListTagsCommand({ Resource: fn.FunctionArn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.FunctionName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -10351,15 +10173,6 @@ var LambdaLayerVersionProvider = class {
 	*     `GetLayerVersionByArn`. (Note: there is no `LayerName` field that
 	*     uniquely names a *version*; a layer name resolves to the latest
 	*     version, so an explicit ARN is the only unambiguous override.)
-	*  2. `ListLayers` paginator + `ListTags(Resource: layerArn)` (which
-	*     returns a `Tags: Record<string,string>` map keyed by tag name).
-	*     Match `aws:cdk:path` and adopt `LatestMatchingVersion.LayerVersionArn`.
-	*
-	* **Caveat**: Lambda layer versions are immutable, so auto-lookup adopts
-	* the LATEST version of the named layer that carries the matching CDK
-	* path tag. If the user's CDK app has since published newer versions
-	* outside cdkd's tracking, the adopted physical id may be stale; pass
-	* `--resource <id>=<arn>` to pin a specific version.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -10372,35 +10185,7 @@ var LambdaLayerVersionProvider = class {
 			if (err instanceof ResourceNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.lambdaClient.send(new ListLayersCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Layers,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (layer) => {
-				if (!layer.LayerArn || !layer.LatestMatchingVersion?.LayerVersionArn) return void 0;
-				try {
-					return await this.lambdaClient.send(new ListTagsCommand({ Resource: layer.LayerArn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.LatestMatchingVersion.LayerVersionArn,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -10608,6 +10393,394 @@ var LambdaEventInvokeConfigProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/lambda-microvm-image-provider.ts
+/**
+* AWS Lambda MicroVM Image Provider
+*
+* Implements `AWS::Lambda::MicrovmImage` using the dedicated `lambda-microvms`
+* service SDK (`@aws-sdk/client-lambda-microvms`) — NOT `@aws-sdk/client-lambda`.
+* The MicroVM image APIs (`CreateMicrovmImage` / `GetMicrovmImage` /
+* `UpdateMicrovmImage` / `DeleteMicrovmImage`) live in their own service model.
+*
+* **The build is asynchronous.** `CreateMicrovmImage` returns immediately with
+* the image in `CREATING` state; Lambda then downloads the code artifact zip
+* from S3, runs the Dockerfile, starts the application, and captures a
+* Firecracker snapshot. The image reaches `CREATED` on success or
+* `CREATE_FAILED` on failure (build logs land in CloudWatch under
+* `/aws/lambda/microvms/<name>`). `create()` polls `GetMicrovmImage` until the
+* image reaches `CREATED`. `UpdateMicrovmImage` triggers the same async rebuild
+* (`UPDATING` -> `UPDATED` / `UPDATE_FAILED`).
+*
+* `CDKD_NO_WAIT=true` (or `cdkd deploy --no-wait`) short-circuits the create /
+* update poll and returns immediately with the image ARN. The build continues
+* asynchronously on the AWS side — cdkd will NOT observe a later
+* `CREATE_FAILED`, and an immediate `destroy` may race the in-flight build.
+* The Cloud Control fallback path does NOT honor `--no-wait` (it always polls
+* its request token to a terminal state), so this SDK provider is what makes
+* `--no-wait` effective for this resource type.
+*
+* **Physical id is the image ARN** (`primaryIdentifier` = `/properties/ImageArn`,
+* an AWS-assigned read-only attribute). CFn `Ref` returns the ARN. `Name` is a
+* create-only property, so a `Name` change is routed to REPLACEMENT by cdkd's
+* create-only detection (`getCreateOnlyPropertyPaths`) and never reaches
+* `update()`.
+*
+* **CFn <-> SDK shape translation.** The template carries CloudFormation-schema
+* PascalCase properties (e.g. `CodeArtifact: { Uri }`, `Tags: [{Key, Value}]`,
+* `Logging: { Disabled: true }`); the SDK expects camelCase with different
+* container shapes (`codeArtifact: { uri }`, `tags: Record<string,string>`,
+* `logging: { disabled: {} }`). The mapping helpers below translate each field
+* explicitly so this provider accepts the exact same template the Cloud Control
+* fallback would.
+*
+* **Tags update out-of-band.** `Tags` is `tagUpdatable` but is NOT a field on
+* `UpdateMicrovmImage`, so `update()` reconciles tag changes via `TagResource`
+* / `UntagResource` (no rebuild). A change limited to `Tags` skips the
+* `UpdateMicrovmImage` rebuild entirely; only a build-affecting property change
+* ({@link BUILD_AFFECTING_CFN_KEYS}) issues the async rebuild.
+*/
+var LambdaMicrovmImageProvider = class {
+	client;
+	logger = getLogger().child("LambdaMicrovmImageProvider");
+	maxPollAttempts = Number(process.env["CDKD_MICROVM_IMAGE_POLL_ATTEMPTS"] ?? 180);
+	pollIntervalMs = Number(process.env["CDKD_MICROVM_IMAGE_POLL_INTERVAL_MS"] ?? 1e4);
+	constructor() {
+		this.client = getAwsClients().lambdaMicrovms;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::Lambda::MicrovmImage", /* @__PURE__ */ new Set([
+		"Name",
+		"BaseImageArn",
+		"BaseImageVersion",
+		"BuildRoleArn",
+		"Description",
+		"CodeArtifact",
+		"Logging",
+		"EgressNetworkConnectors",
+		"CpuConfigurations",
+		"Resources",
+		"AdditionalOsCapabilities",
+		"Hooks",
+		"EnvironmentVariables",
+		"Tags"
+	])]]);
+	unhandledByDesign = /* @__PURE__ */ new Map([["AWS::Lambda::MicrovmImage", /* @__PURE__ */ new Map([
+		["ImageArn", "AWS-managed read-only attribute (primaryIdentifier / physical id)"],
+		["State", "AWS-managed read-only attribute"],
+		["LatestActiveImageVersion", "AWS-managed read-only attribute"],
+		["LatestFailedImageVersion", "AWS-managed read-only attribute"],
+		["CreatedAt", "AWS-managed read-only attribute"],
+		["UpdatedAt", "AWS-managed read-only attribute"]
+	])]]);
+	getMinResourceTimeoutMs() {
+		return this.maxPollAttempts * this.pollIntervalMs;
+	}
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating MicroVM image ${logicalId}`);
+		const name = properties["Name"];
+		const baseImageArn = properties["BaseImageArn"];
+		const buildRoleArn = properties["BuildRoleArn"];
+		const codeArtifact = mapCodeArtifact(properties["CodeArtifact"]);
+		const missing = [
+			!name && "Name",
+			!baseImageArn && "BaseImageArn",
+			!buildRoleArn && "BuildRoleArn",
+			!codeArtifact && "CodeArtifact.Uri"
+		].filter(Boolean);
+		if (missing.length > 0) throw new ProvisioningError(`${missing.join(", ")} ${missing.length === 1 ? "is" : "are"} required for MicroVM image ${logicalId}`, resourceType, logicalId);
+		const input = {
+			name,
+			baseImageArn,
+			buildRoleArn,
+			codeArtifact,
+			...buildCommonImageInput(properties)
+		};
+		const tags = mapKeyValueListToRecord(properties["Tags"]);
+		if (tags) input.tags = tags;
+		try {
+			const response = await this.client.send(new CreateMicrovmImageCommand(input));
+			const imageArn = response.imageArn;
+			if (!imageArn) throw new ProvisioningError(`CreateMicrovmImage succeeded but no imageArn returned for ${logicalId}`, resourceType, logicalId);
+			this.logger.debug(`Created MicroVM image ${logicalId}: ${imageArn} (state=${response.state})`);
+			const noWait = process.env["CDKD_NO_WAIT"] === "true";
+			let latest = {
+				state: response.state,
+				latestActiveImageVersion: response.latestActiveImageVersion,
+				latestFailedImageVersion: response.latestFailedImageVersion,
+				createdAt: response.createdAt,
+				updatedAt: response.updatedAt
+			};
+			if (!noWait) latest = await this.waitForTerminalState(imageArn, logicalId, "create");
+			else this.logger.warn(`Skipping wait for MicroVM image ${logicalId} (CDKD_NO_WAIT=true). The build continues asynchronously; a CREATE_FAILED will not be observed here.`);
+			return {
+				physicalId: imageArn,
+				attributes: this.buildAttributes(imageArn, latest.state, {
+					latestActiveImageVersion: latest.latestActiveImageVersion,
+					latestFailedImageVersion: latest.latestFailedImageVersion,
+					createdAt: latest.createdAt,
+					updatedAt: latest.updatedAt
+				})
+			};
+		} catch (error) {
+			throw this.wrapError("create", logicalId, resourceType, void 0, error);
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating MicroVM image ${logicalId}: ${physicalId}`);
+		if (properties["Name"] !== previousProperties["Name"]) throw new ProvisioningError(`MicroVM image ${logicalId} Name is create-only and cannot be changed in place (${String(previousProperties["Name"])} -> ${String(properties["Name"])}); this requires replacement.`, resourceType, logicalId, physicalId);
+		try {
+			await this.reconcileTags(physicalId, properties["Tags"], previousProperties["Tags"]);
+			if (!BUILD_AFFECTING_CFN_KEYS.some((key) => JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key]))) {
+				this.logger.debug(`MicroVM image ${logicalId}: only tags changed, skipping UpdateMicrovmImage rebuild`);
+				const current = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: physicalId }));
+				return {
+					physicalId,
+					wasReplaced: false,
+					attributes: this.buildAttributes(physicalId, current.state, current)
+				};
+			}
+			const baseImageArn = properties["BaseImageArn"];
+			const buildRoleArn = properties["BuildRoleArn"];
+			const codeArtifact = mapCodeArtifact(properties["CodeArtifact"]);
+			if (!baseImageArn || !buildRoleArn || !codeArtifact) throw new ProvisioningError(`BaseImageArn, BuildRoleArn, and CodeArtifact.Uri are required to update MicroVM image ${logicalId}`, resourceType, logicalId, physicalId);
+			const input = {
+				imageIdentifier: physicalId,
+				baseImageArn,
+				buildRoleArn,
+				codeArtifact,
+				...buildCommonImageInput(properties),
+				environmentVariables: mapKeyValueListToRecord(properties["EnvironmentVariables"]) ?? {}
+			};
+			await this.client.send(new UpdateMicrovmImageCommand(input));
+			const noWait = process.env["CDKD_NO_WAIT"] === "true";
+			let latest;
+			if (!noWait) latest = await this.waitForTerminalState(physicalId, logicalId, "update");
+			else this.logger.warn(`Skipping wait for MicroVM image ${logicalId} update (CDKD_NO_WAIT=true). The rebuild continues asynchronously.`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: this.buildAttributes(physicalId, latest?.state, {
+					latestActiveImageVersion: latest?.latestActiveImageVersion,
+					latestFailedImageVersion: latest?.latestFailedImageVersion,
+					createdAt: latest?.createdAt,
+					updatedAt: latest?.updatedAt
+				})
+			};
+		} catch (error) {
+			throw this.wrapError("update", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting MicroVM image ${logicalId}: ${physicalId}`);
+		try {
+			try {
+				await this.client.send(new DeleteMicrovmImageCommand({ imageIdentifier: physicalId }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$7) {
+					assertRegionMatch(await this.client.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(`MicroVM image ${physicalId} does not exist, skipping deletion`);
+					return;
+				}
+				throw error;
+			}
+			await this.waitForDeleted(physicalId, logicalId);
+			this.logger.debug(`Successfully deleted MicroVM image ${logicalId}`);
+		} catch (error) {
+			throw this.wrapError("delete", logicalId, resourceType, physicalId, error);
+		}
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "ImageArn") return physicalId;
+		const resp = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: physicalId }));
+		switch (attributeName) {
+			case "State": return resp.state;
+			case "LatestActiveImageVersion": return resp.latestActiveImageVersion;
+			case "LatestFailedImageVersion": return resp.latestFailedImageVersion;
+			case "CreatedAt": return resp.createdAt?.toISOString();
+			case "UpdatedAt": return resp.updatedAt?.toISOString();
+			default: return;
+		}
+	}
+	buildAttributes(imageArn, state, extra) {
+		const attributes = { ImageArn: imageArn };
+		if (state !== void 0) attributes["State"] = state;
+		if (extra.latestActiveImageVersion !== void 0) attributes["LatestActiveImageVersion"] = extra.latestActiveImageVersion;
+		if (extra.latestFailedImageVersion !== void 0) attributes["LatestFailedImageVersion"] = extra.latestFailedImageVersion;
+		if (extra.createdAt !== void 0) attributes["CreatedAt"] = extra.createdAt.toISOString();
+		if (extra.updatedAt !== void 0) attributes["UpdatedAt"] = extra.updatedAt.toISOString();
+		return attributes;
+	}
+	/**
+	* Poll `GetMicrovmImage` until the image reaches a terminal success state
+	* (`CREATED` after create, `CREATED` / `UPDATED` after update). Throws on the
+	* matching failure state (`CREATE_FAILED` / `UPDATE_FAILED`) or on
+	* poll-cap exhaustion.
+	*/
+	async waitForTerminalState(imageArn, logicalId, operation) {
+		this.logger.debug(`Waiting for MicroVM image ${imageArn} to finish ${operation}...`);
+		for (let attempt = 1; attempt <= this.maxPollAttempts; attempt++) {
+			const resp = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: imageArn }));
+			const state = resp.state;
+			if (state === "CREATED" || state === "UPDATED") {
+				this.logger.debug(`MicroVM image ${imageArn} reached ${state}`);
+				return resp;
+			}
+			if (state === "CREATE_FAILED" || state === "UPDATE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered ${state} during ${operation}. Check the build logs in CloudWatch under /aws/lambda/microvms/ to diagnose.`);
+			this.logger.debug(`MicroVM image ${imageArn} state: ${state} (attempt ${attempt}/${this.maxPollAttempts})`);
+			await sleep$2(this.pollIntervalMs);
+		}
+		throw new Error(`MicroVM image ${logicalId} (${imageArn}) did not finish ${operation} within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s. Increase --resource-timeout AWS::Lambda::MicrovmImage=<duration> or set CDKD_NO_WAIT=true.`);
+	}
+	/**
+	* Poll `GetMicrovmImage` until it 404s (image fully deleted). Throws on
+	* `DELETE_FAILED` or poll-cap exhaustion.
+	*/
+	async waitForDeleted(imageArn, logicalId) {
+		for (let attempt = 1; attempt <= this.maxPollAttempts; attempt++) {
+			let resp;
+			try {
+				resp = await this.client.send(new GetMicrovmImageCommand({ imageIdentifier: imageArn }));
+			} catch (error) {
+				if (error instanceof ResourceNotFoundException$7) return;
+				throw error;
+			}
+			if (resp.state === "DELETE_FAILED") throw new Error(`MicroVM image ${logicalId} (${imageArn}) entered DELETE_FAILED. Check the CloudWatch build logs under /aws/lambda/microvms/ to diagnose.`);
+			this.logger.debug(`MicroVM image ${imageArn} state: ${resp.state} (delete attempt ${attempt}/${this.maxPollAttempts})`);
+			await sleep$2(this.pollIntervalMs);
+		}
+		throw new Error(`MicroVM image ${logicalId} (${imageArn}) was not fully deleted within ${this.maxPollAttempts * this.pollIntervalMs / 1e3}s.`);
+	}
+	/**
+	* Reconcile the resource's tags to the desired set via TagResource /
+	* UntagResource (diff of the CFn `Tags` list, old vs new). Tags are NOT a
+	* field on UpdateMicrovmImage, so this is the only way a tag change reaches
+	* AWS on update — and it applies without an image rebuild.
+	*/
+	async reconcileTags(physicalId, newTags, oldTags) {
+		const newMap = mapKeyValueListToRecord(newTags) ?? {};
+		const oldMap = mapKeyValueListToRecord(oldTags) ?? {};
+		const keysToRemove = Object.keys(oldMap).filter((k) => !(k in newMap));
+		const tagsToAdd = {};
+		for (const [k, v] of Object.entries(newMap)) if (oldMap[k] !== v) tagsToAdd[k] = v;
+		if (keysToRemove.length > 0) await this.client.send(new UntagResourceCommand$10({
+			Resource: physicalId,
+			TagKeys: keysToRemove
+		}));
+		if (Object.keys(tagsToAdd).length > 0) await this.client.send(new TagResourceCommand$10({
+			Resource: physicalId,
+			Tags: tagsToAdd
+		}));
+	}
+	wrapError(operation, logicalId, resourceType, physicalId, error) {
+		if (error instanceof ProvisioningError) return error;
+		const cause = error instanceof Error ? error : void 0;
+		return new ProvisioningError(`Failed to ${operation} MicroVM image ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+	}
+};
+/**
+* CFn property names whose change requires an UpdateMicrovmImage call (an async
+* image rebuild). Everything the SDK's UpdateMicrovmImage accepts EXCEPT tags
+* (which reconcile out-of-band via TagResource / UntagResource) and Name
+* (create-only). A change limited to `Tags` skips the rebuild.
+*/
+const BUILD_AFFECTING_CFN_KEYS = [
+	"BaseImageArn",
+	"BaseImageVersion",
+	"BuildRoleArn",
+	"Description",
+	"CodeArtifact",
+	"Logging",
+	"EgressNetworkConnectors",
+	"CpuConfigurations",
+	"Resources",
+	"AdditionalOsCapabilities",
+	"Hooks",
+	"EnvironmentVariables"
+];
+function sleep$2(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+* Build the optional create/update input fields shared by both operations,
+* translating each from its CloudFormation-schema shape to the SDK shape.
+* Only defined fields are included so the request never carries `undefined`.
+*/
+function buildCommonImageInput(properties) {
+	const input = {};
+	if (typeof properties["BaseImageVersion"] === "string") input.baseImageVersion = properties["BaseImageVersion"];
+	if (typeof properties["Description"] === "string") input.description = properties["Description"];
+	const logging = mapLogging(properties["Logging"]);
+	if (logging) input.logging = logging;
+	if (Array.isArray(properties["EgressNetworkConnectors"])) input.egressNetworkConnectors = properties["EgressNetworkConnectors"];
+	const cpuConfigurations = mapCpuConfigurations(properties["CpuConfigurations"]);
+	if (cpuConfigurations) input.cpuConfigurations = cpuConfigurations;
+	const resources = mapResources(properties["Resources"]);
+	if (resources) input.resources = resources;
+	if (Array.isArray(properties["AdditionalOsCapabilities"])) input.additionalOsCapabilities = properties["AdditionalOsCapabilities"];
+	const hooks = mapHooks(properties["Hooks"]);
+	if (hooks) input.hooks = hooks;
+	const environmentVariables = mapKeyValueListToRecord(properties["EnvironmentVariables"]);
+	if (environmentVariables) input.environmentVariables = environmentVariables;
+	return input;
+}
+function mapCodeArtifact(value) {
+	if (!isRecord(value)) return void 0;
+	const uri = value["Uri"];
+	return typeof uri === "string" ? { uri } : void 0;
+}
+function mapLogging(value) {
+	if (!isRecord(value)) return void 0;
+	if (value["Disabled"] === true) return { disabled: {} };
+	const cloudWatch = value["CloudWatch"];
+	if (isRecord(cloudWatch)) {
+		const cw = {};
+		if (typeof cloudWatch["LogGroup"] === "string") cw.logGroup = cloudWatch["LogGroup"];
+		if (typeof cloudWatch["LogStream"] === "string") cw.logStream = cloudWatch["LogStream"];
+		return { cloudWatch: cw };
+	}
+}
+function mapCpuConfigurations(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter(isRecord).map((c) => ({ architecture: c["Architecture"] }));
+}
+function mapResources(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.filter(isRecord).map((r) => Number(r["MinimumMemoryInMiB"])).filter((n) => Number.isFinite(n)).map((minimumMemoryInMiB) => ({ minimumMemoryInMiB }));
+}
+/**
+* Translate the CFn `Hooks` structure (PascalCase keys throughout, all leaf
+* values are strings/numbers) to the SDK `hooks` shape (camelCase keys). Safe
+* to lower-case the first character of every key recursively because Hooks
+* carries no tagged unions and no array-of-record members.
+*/
+function mapHooks(value) {
+	if (!isRecord(value)) return void 0;
+	return lowerFirstKeysDeep(value);
+}
+/**
+* Convert a CFn `[{Key, Value}]` list (used by both `Tags` and
+* `EnvironmentVariables`) to the SDK `Record<string, string>` shape. Returns
+* `undefined` for an empty / absent list so the request omits the field.
+*/
+function mapKeyValueListToRecord(value) {
+	if (!Array.isArray(value)) return void 0;
+	const out = {};
+	for (const entry of value) if (isRecord(entry) && typeof entry["Key"] === "string") out[entry["Key"]] = typeof entry["Value"] === "string" ? entry["Value"] : "";
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+function lowerFirstKeysDeep(value) {
+	if (Array.isArray(value)) return value.map(lowerFirstKeysDeep);
+	if (isRecord(value)) {
+		const out = {};
+		for (const [k, v] of Object.entries(value)) out[k.charAt(0).toLowerCase() + k.slice(1)] = lowerFirstKeysDeep(v);
+		return out;
+	}
+	return value;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 /**
@@ -11465,11 +11638,6 @@ var DynamoDBTableProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override or `Properties.TableName` → verify via `DescribeTable`.
-	*  2. `ListTables` + `ListTagsOfResource`, match `aws:cdk:path` tag.
-	*
-	* Tags require the table ARN, which `DescribeTable` provides; the loop
-	* therefore costs one `DescribeTable` per table just to read the ARN.
-	* Acceptable for typical DynamoDB cardinalities.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "TableName");
@@ -11483,33 +11651,7 @@ var DynamoDBTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
-				return {
-					items: list.TableNames,
-					nextMarker: list.LastEvaluatedTableName
-				};
-			},
-			describe: async (name) => {
-				try {
-					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-					if (!arn) return void 0;
-					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$1) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -12683,7 +12825,6 @@ var DynamoDBGlobalTableProvider = class {
 	*
 	* Lookup order:
 	*   1. `--resource` override or `Properties.TableName` → verify via DescribeTable.
-	*   2. `ListTables` + `ListTagsOfResource`, match `aws:cdk:path` tag.
 	*
 	* Same shape as `DynamoDBTableProvider.import()`. The provider returns
 	* the physical id only; cdkd's import flow does the attribute capture
@@ -12701,33 +12842,7 @@ var DynamoDBGlobalTableProvider = class {
 			if (err instanceof ResourceNotFoundException$1) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.dynamoDBClient.send(new ListTablesCommand({ ...marker && { ExclusiveStartTableName: marker } }));
-				return {
-					items: list.TableNames,
-					nextMarker: list.LastEvaluatedTableName
-				};
-			},
-			describe: async (name) => {
-				try {
-					const arn = (await this.dynamoDBClient.send(new DescribeTableCommand({ TableName: name }))).Table?.TableArn;
-					if (!arn) return void 0;
-					return await this.dynamoDBClient.send(new ListTagsOfResourceCommand({ ResourceArn: arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$1) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 	async waitForTableActive(tableName, logicalId, maxAttempts = 120) {
 		for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -13277,11 +13392,6 @@ var LogsLogGroupProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.LogGroupName` → verify via
 	*     `DescribeLogGroups` (filtered by name prefix).
-	*  2. `aws:cdk:path` tag match via `DescribeLogGroups` + `ListTagsForResource`.
-	*
-	* `ListTagsForResource` for log groups uses the log-group ARN. The
-	* `DescribeLogGroups` response includes the ARN, so no extra round-trip
-	* is needed beyond the per-group tag lookup.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "LogGroupName");
@@ -13294,36 +13404,7 @@ var LogsLogGroupProvider = class {
 			if (err instanceof ResourceNotFoundException$4) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.logsClient.send(new DescribeLogGroupsCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.logGroups,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (g) => {
-				if (!g.logGroupName || !g.arn) return void 0;
-				const arnForTags = g.arn.replace(/:\*$/, "");
-				try {
-					return await this.logsClient.send(new ListTagsForResourceCommand$5({ resourceArn: arnForTags }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$4) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.logGroupName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -13640,32 +13721,7 @@ var CloudWatchAlarmProvider = class {
 			if (this.isNotFound(err)) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.cloudWatchClient.send(new DescribeAlarmsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: [...list.MetricAlarms ?? [], ...list.CompositeAlarms ?? []],
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (a) => {
-				if (!a.AlarmArn || !a.AlarmName) return void 0;
-				try {
-					return await this.cloudWatchClient.send(new ListTagsForResourceCommand$4({ ResourceARN: a.AlarmArn }));
-				} catch (err) {
-					if (this.isNotFound(err)) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.AlarmName,
-			attributes: {}
-		};
+		return null;
 	}
 	isNotFound(err) {
 		if (!(err instanceof Error)) return false;
@@ -13919,7 +13975,6 @@ var SecretsManagerSecretProvider = class {
 	* Lookup order:
 	*  1. `--resource` override (ARN) → verify via `DescribeSecret`.
 	*  2. `Properties.Name` → `DescribeSecret` (accepts name).
-	*  3. `aws:cdk:path` tag match via `ListSecrets` (which already returns Tags).
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -13943,24 +13998,7 @@ var SecretsManagerSecretProvider = class {
 			if (err instanceof ResourceNotFoundException$3) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.smClient.send(new ListSecretsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.SecretList,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (secret) => secret.ARN ? secret : void 0,
-			tagsOf: (secret) => secret.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.ARN,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -14230,12 +14268,10 @@ var SSMParameterProvider = class {
 	*
 	* SSM physical IDs ARE the parameter names (`/foo/bar`). The CDK template
 	* usually carries `Properties.Name` explicitly, so the explicit-name path
-	* covers most cases. The tag-based fallback is rarely needed.
+	* covers most cases.
 	*
 	* Lookup order:
 	*  1. `--resource` override or `Properties.Name` → verify via `GetParameter`.
-	*  2. `aws:cdk:path` tag match via `DescribeParameters` + `ListTagsForResource`
-	*     (`ResourceType: 'Parameter'`, `ResourceId: <name>`).
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
@@ -14249,35 +14285,7 @@ var SSMParameterProvider = class {
 			if (err instanceof ParameterNotFound) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.ssmClient.send(new DescribeParametersCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.Parameters,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (p) => {
-				if (!p.Name) return void 0;
-				try {
-					return await this.ssmClient.send(new ListTagsForResourceCommand$2({
-						ResourceType: "Parameter",
-						ResourceId: p.Name
-					}));
-				} catch (err) {
-					if (err instanceof ParameterNotFound) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.TagList
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -14559,12 +14567,6 @@ var EventBridgeRuleProvider = class {
 	*  2. If the template carries `Properties.Name` use that as the rule
 	*     name lookup, then verify with `DescribeRule` and return the
 	*     rule's ARN as physicalId.
-	*  3. Walk `ListRules(EventBusName?)` and match `aws:cdk:path` via
-	*     `ListTagsForResource(ResourceARN=rule.Arn)`. Returns the rule
-	*     ARN as physicalId — same shape that `create` returns.
-	*
-	* EventBridge tags use the standard `Tag[]` array shape
-	* (`Key`/`Value`).
 	*/
 	async import(input) {
 		const eventBusName = input.properties["EventBusName"];
@@ -14598,30 +14600,7 @@ var EventBridgeRuleProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.eventBridgeClient.send(new ListRulesCommand({
-					...eventBusName && { EventBusName: eventBusName },
-					...marker && { NextToken: marker }
-				}));
-				return {
-					items: list.Rules,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (rule) => {
-				if (!rule.Arn) return void 0;
-				return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: rule.Arn }));
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Arn,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Extract rule name from an ARN
@@ -14892,7 +14871,6 @@ var EventBridgeBusProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override or `Properties.Name` → verify via `DescribeEventBus`.
-	*  2. `aws:cdk:path` tag match via `ListEventBuses` + `ListTagsForResource`.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "Name");
@@ -14906,32 +14884,7 @@ var EventBridgeBusProvider = class {
 			if (err instanceof ResourceNotFoundException$2) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.eventBridgeClient.send(new ListEventBusesCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.EventBuses,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (bus) => {
-				if (!bus.Name || !bus.Arn) return void 0;
-				try {
-					return await this.eventBridgeClient.send(new ListTagsForResourceCommand$1({ ResourceARN: bus.Arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$2) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -20419,8 +20372,7 @@ var CloudFrontDistributionProvider = class {
 	*
 	* CloudFront distributions don't carry a template-supplied name
 	* (physical id is the AWS-generated `E...` distribution id), so the
-	* lookup is either explicit-override or `aws:cdk:path` tag match
-	* via `ListDistributions` + `ListTagsForResource(ARN)`.
+	* lookup is explicit-override only.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -20433,32 +20385,7 @@ var CloudFrontDistributionProvider = class {
 			if (err instanceof NoSuchDistribution) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.cloudFrontClient.send(new ListDistributionsCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DistributionList?.Items,
-					nextMarker: list.DistributionList?.IsTruncated ? list.DistributionList?.NextMarker : void 0
-				};
-			},
-			describe: async (d) => {
-				if (!d.Id || !d.ARN) return void 0;
-				try {
-					return await this.cloudFrontClient.send(new ListTagsForResourceCommand$3({ Resource: d.ARN }));
-				} catch (err) {
-					if (err instanceof NoSuchDistribution) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags?.Items
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Id,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -21459,10 +21386,6 @@ var StepFunctionsProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource <id>=<arn>` override → verify with `DescribeStateMachine`.
-	*  2. Walk `ListStateMachines` → `ListTagsForResource(arn)` via the shared
-	*     `importTagWalk` helper. SFN returns lowercase `key`/`value` tags, so
-	*     `tagsOf` maps them to the `Key`/`Value` shape the walk's
-	*     `aws:cdk:path` matcher expects.
 	*
 	* SFN state machines do not expose a template-supplied name field
 	* usable as a stable physicalId — the physicalId is the ARN — so the
@@ -21480,30 +21403,7 @@ var StepFunctionsProvider = class {
 			if (err instanceof StateMachineDoesNotExist) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListStateMachinesCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.stateMachines,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (sm) => {
-				if (!sm.stateMachineArn) return void 0;
-				return await this.getClient().send(new ListTagsForResourceCommand$11({ resourceArn: sm.stateMachineArn }));
-			},
-			tagsOf: (tagsResp) => (tagsResp.tags ?? []).map((t) => ({
-				Key: t.key,
-				Value: t.value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.stateMachineArn,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via SFN's
@@ -21526,14 +21426,14 @@ var StepFunctionsProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$12({
+			await this.getClient().send(new UntagResourceCommand$13({
 				resourceArn: stateMachineArn,
 				tagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from SFN state machine ${stateMachineArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$12({
+			await this.getClient().send(new TagResourceCommand$13({
 				resourceArn: stateMachineArn,
 				tags: tagsToAdd
 			}));
@@ -22145,14 +22045,14 @@ var ECSProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$13({
+			await this.getClient().send(new UntagResourceCommand$14({
 				resourceArn,
 				tagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ECS resource ${resourceArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$13({
+			await this.getClient().send(new TagResourceCommand$14({
 				resourceArn,
 				tags: tagsToAdd
 			}));
@@ -25637,11 +25537,10 @@ var DocDBProvider = class {
 	* Supported types: `AWS::DocDB::DBInstance`, `AWS::DocDB::DBCluster`,
 	* `AWS::DocDB::DBSubnetGroup`. Identifier name properties (`DBInstance
 	* Identifier` / `DBClusterIdentifier` / `DBSubnetGroupName`) are usually
-	* present in CDK templates; fall back to `aws:cdk:path` tag lookup via
-	* the corresponding `Describe*` + `ListTagsForResource` pair otherwise.
-	* The fallback walk runs through the shared `importTagWalk` helper, so the
-	* N+1 `ListTagsForResource` burst is retried with exponential backoff when
-	* AWS throttles it instead of aborting the whole import.
+	* present in CDK templates and are resolved via the corresponding
+	* `Describe*` existence check. There is no `aws:cdk:path` tag fallback:
+	* AWS rejects `aws:`-prefixed tag writes, so that tag never exists on a
+	* real resource and the walk could not match (issue #1134).
 	*/
 	async import(input) {
 		switch (input.resourceType) {
@@ -25757,24 +25656,7 @@ var DocDBProvider = class {
 			if (err.name === "DBInstanceNotFoundFault") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeDBInstancesCommand$1({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DBInstances,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (inst) => inst.DBInstanceIdentifier && inst.DBInstanceArn ? await this.listTagsForResource(inst.DBInstanceArn) : void 0,
-			tagsOf: (tags) => tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.DBInstanceIdentifier,
-			attributes: {}
-		};
+		return null;
 	}
 	async importDBCluster(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBClusterIdentifier");
@@ -25788,24 +25670,7 @@ var DocDBProvider = class {
 			if (err.name === "DBClusterNotFoundFault") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeDBClustersCommand$1({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DBClusters,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (c) => c.DBClusterIdentifier && c.DBClusterArn ? await this.listTagsForResource(c.DBClusterArn) : void 0,
-			tagsOf: (tags) => tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.DBClusterIdentifier,
-			attributes: {}
-		};
+		return null;
 	}
 	async importDBSubnetGroup(input) {
 		const explicit = resolveExplicitPhysicalId(input, "DBSubnetGroupName");
@@ -25819,33 +25684,7 @@ var DocDBProvider = class {
 			if (err.name === "DBSubnetGroupNotFoundFault") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeDBSubnetGroupsCommand$1({ ...marker && { Marker: marker } }));
-				return {
-					items: list.DBSubnetGroups,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (sg) => sg.DBSubnetGroupName && sg.DBSubnetGroupArn ? await this.listTagsForResource(sg.DBSubnetGroupArn) : void 0,
-			tagsOf: (tags) => tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.DBSubnetGroupName,
-			attributes: {}
-		};
-	}
-	/**
-	* `ListTagsForResource` for the tag-walk import path. Returns the tag list
-	* (possibly empty) so `importTagWalk` can match `aws:cdk:path` against it;
-	* `undefined` is reserved for "skip this candidate", which the callers signal
-	* before calling this.
-	*/
-	async listTagsForResource(resourceArn) {
-		return (await this.getClient().send(new ListTagsForResourceCommand$12({ ResourceName: resourceArn }))).TagList ?? [];
+		return null;
 	}
 };
 
@@ -27625,7 +27464,7 @@ var CognitoUserPoolProvider = class {
 				if (!templatedActive) try {
 					needsFlip = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }))).UserPool?.DeletionProtection === "ACTIVE";
 				} catch (descError) {
-					if (descError instanceof ResourceNotFoundException$7) {
+					if (descError instanceof ResourceNotFoundException$8) {
 						assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 						this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 						return;
@@ -27648,7 +27487,7 @@ var CognitoUserPoolProvider = class {
 			await this.getClient().send(new DeleteUserPoolCommand({ UserPoolId: physicalId }));
 			this.logger.debug(`Successfully deleted Cognito User Pool ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$7) {
+			if (error instanceof ResourceNotFoundException$8) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Cognito User Pool ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -27681,7 +27520,7 @@ var CognitoUserPoolProvider = class {
 		try {
 			resp = await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: physicalId }));
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$7) return void 0;
+			if (err instanceof ResourceNotFoundException$8) return void 0;
 			throw err;
 		}
 		const pool = resp.UserPool;
@@ -27739,19 +27578,13 @@ var CognitoUserPoolProvider = class {
 	*  1. `--resource` override → `DescribeUserPool` to verify.
 	*  2. `Properties.UserPoolName` (when CDK template carries it) →
 	*     `ListUserPools` walk + name match.
-	*  3. `aws:cdk:path` tag match via `ListUserPools` +
-	*     `ListTagsForResource(<arn>)`. Cognito's tag map uses the same
-	*     `Tags: { [key]: value }` shape as Lambda.
-	*
-	* Steps 2 and 3 share ONE `ListUserPools` walk (per candidate: name check
-	* first, then the two tag reads, only when a `cdkPath` is present), which
-	* runs through the shared `importTagWalk` helper so the N+1 read burst
-	* (DescribeUserPool for the ARN, then ListTagsForResource) is retried with
-	* exponential backoff when AWS throttles it instead of aborting the whole
-	* import. The name match is expressed to the walk as a synthetic
-	* `aws:cdk:path` tag carrying the walk's own lookup key, so a name-only
-	* template (no CDK path metadata) still resolves without any per-candidate
-	* API call, matching the previous inline loop.
+	*
+	* The `aws:cdk:path` tag match that used to ride the same `ListUserPools`
+	* walk is gone (issue #1134): AWS rejects `aws:`-prefixed tag writes, so
+	* that tag never exists on a real resource and the walk could not match.
+	* Auto-mode import resolves ids from CloudFormation's
+	* `DescribeStackResources` or the template's physical name; without a
+	* `UserPoolName` there is nothing to match.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -27761,52 +27594,24 @@ var CognitoUserPoolProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$7) return null;
+			if (err instanceof ResourceNotFoundException$8) return null;
 			throw err;
 		}
 		const desiredName = typeof input.properties?.["UserPoolName"] === "string" ? input.properties["UserPoolName"] : void 0;
-		const walkCdkPath = input.cdkPath || (desiredName ? `cdkd:cognito-user-pool-name:${desiredName}` : void 0);
-		/** Sentinel detail for a candidate matched by its user pool name. */
-		const NAME_MATCH = { nameMatch: true };
-		const match = await importTagWalk({
-			cdkPath: walkCdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListUserPoolsCommand({
-					MaxResults: 60,
-					...marker && { NextToken: marker }
-				}));
-				return {
-					items: list.UserPools,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (pool) => {
-				if (!pool.Id) return void 0;
-				if (desiredName && pool.Name === desiredName) return NAME_MATCH;
-				if (!input.cdkPath) return void 0;
-				try {
-					const arn = (await this.getClient().send(new DescribeUserPoolCommand({ UserPoolId: pool.Id }))).UserPool?.Arn;
-					if (!arn) return void 0;
-					return await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceArn: arn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$7) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (detail) => "nameMatch" in detail ? [{
-				Key: CDK_PATH_TAG,
-				Value: walkCdkPath
-			}] : Object.entries(detail.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Id,
-			attributes: {}
-		};
+		if (!desiredName) return null;
+		let marker;
+		do {
+			const list = await this.getClient().send(new ListUserPoolsCommand({
+				MaxResults: 60,
+				...marker && { NextToken: marker }
+			}));
+			for (const pool of list.UserPools ?? []) if (pool.Id && pool.Name === desiredName) return {
+				physicalId: pool.Id,
+				attributes: {}
+			};
+			marker = list.NextToken;
+		} while (marker);
+		return null;
 	}
 };
 
@@ -28807,11 +28612,11 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		const hasAdds = !!newTags && newTags.length > 0;
 		if (removedKeys.length === 0 && !hasAdds) return;
 		const arn = await this.resolveNamespaceArn(physicalId);
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$14({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$15({
 			ResourceARN: arn,
 			TagKeys: removedKeys
 		}));
-		if (hasAdds) await this.getClient().send(new TagResourceCommand$14({
+		if (hasAdds) await this.getClient().send(new TagResourceCommand$15({
 			ResourceARN: arn,
 			Tags: newTags
 		}));
@@ -28999,7 +28804,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	/** Best-effort tag fetch via `ListTagsForResource(ResourceARN)`. */
 	async attachTags(result, arn) {
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: arn }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$14({ ResourceARN: arn }))).Tags);
 		} catch (err) {
 			this.logger.debug(`ServiceDiscovery ListTagsForResource(${arn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
@@ -29447,7 +29252,7 @@ var AppSyncProvider = class {
 		const tagsToAdd = {};
 		for (const [k, v] of Object.entries(newMap)) if (oldMap[k] !== v) tagsToAdd[k] = v;
 		if (tagKeysToRemove.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$15({
+			await this.getClient().send(new UntagResourceCommand$16({
 				resourceArn: arn,
 				tagKeys: tagKeysToRemove
 			}));
@@ -29455,7 +29260,7 @@ var AppSyncProvider = class {
 			throw this.wrapUpdateError(error, resourceType, logicalId, apiId, "GraphqlApi (untag)");
 		}
 		if (Object.keys(tagsToAdd).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$15({
+			await this.getClient().send(new TagResourceCommand$16({
 				resourceArn: arn,
 				tags: tagsToAdd
 			}));
@@ -31900,14 +31705,14 @@ var KMSProvider = class {
 		const tagsToRemove = [];
 		for (const k of oldMap.keys()) if (!newMap.has(k)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$10({
+			await this.getClient().send(new UntagResourceCommand$11({
 				KeyId: keyId,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from KMS Key ${keyId}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new TagResourceCommand$10({
+			await this.getClient().send(new TagResourceCommand$11({
 				KeyId: keyId,
 				Tags: tagsToAdd
 			}));
@@ -32082,8 +31887,8 @@ var KMSProvider = class {
 	* KMS keys have no `Properties.KeyName` field — physical IDs are
 	* AWS-generated UUIDs. So:
 	*  - For `AWS::KMS::Key`: `--resource MyKey=<keyId>` is the only explicit
-	*    path; auto-lookup walks `ListKeys` + `ListResourceTags` matching
-	*    `aws:cdk:path`.
+	*    path; there is no auto-lookup (a key reaching here without an explicit
+	*    id or a CloudFormation-resolved physical id returns `null`).
 	*  - For `AWS::KMS::Alias`: `Properties.AliasName` is explicit and reliable.
 	*/
 	async import(input) {
@@ -32116,36 +31921,7 @@ var KMSProvider = class {
 			if (err instanceof NotFoundException$2) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListKeysCommand({ ...marker && { Marker: marker } }));
-				return {
-					items: list.Keys,
-					nextMarker: list.NextMarker
-				};
-			},
-			describe: async (key) => {
-				if (!key.KeyId) return void 0;
-				try {
-					return await this.getClient().send(new ListResourceTagsCommand({ KeyId: key.KeyId }));
-				} catch (err) {
-					if (err.name === "AccessDeniedException" || err instanceof NotFoundException$2) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => (tagsResp.Tags ?? []).map((t) => ({
-				Key: t.TagKey,
-				Value: t.TagValue
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.KeyId,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -32532,11 +32308,11 @@ var BudgetsBudgetProvider = class {
 		const removedKeys = oldTags.map((t) => t.Key).filter((k) => {
 			return typeof k === "string" && !newKeys.has(k);
 		});
-		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$16({
+		if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$17({
 			ResourceARN: arn,
 			ResourceTagKeys: removedKeys
 		}));
-		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$16({
+		if (newTags.length > 0) await this.getClient().send(new TagResourceCommand$17({
 			ResourceARN: arn,
 			ResourceTags: newTags
 		}));
@@ -32593,9 +32369,6 @@ var BudgetsBudgetProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.Budget.BudgetName` → verify via
 	*     `DescribeBudget`.
-	*  2. `aws:cdk:path` tag match: walk `DescribeBudgets` and check each
-	*     budget's tags via `ListTagsForResource` (budget ARNs are
-	*     region-free, so the lookup works from any deploy region).
 	*/
 	async import(input) {
 		const rawBudget = input.properties["Budget"] ?? {};
@@ -32615,31 +32388,7 @@ var BudgetsBudgetProvider = class {
 			if (error instanceof NotFoundException$5) return null;
 			throw error;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await client.send(new DescribeBudgetsCommand({
-					AccountId: accountId,
-					...marker && { NextToken: marker }
-				}));
-				return {
-					items: list.Budgets,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (budget) => {
-				if (!budget.BudgetName) return void 0;
-				return await client.send(new ListTagsForResourceCommand$16({ ResourceARN: this.budgetArn(accountId, budget.BudgetName) }));
-			},
-			tagsOf: (tags) => tags.ResourceTags
-		});
-		if (!match) return null;
-		const budgetName = match.summary.BudgetName;
-		return {
-			physicalId: budgetName,
-			attributes: { Arn: this.budgetArn(accountId, budgetName) }
-		};
+		return null;
 	}
 };
 
@@ -32846,7 +32595,7 @@ var KinesisStreamProvider = class {
 			}));
 			this.logger.debug(`Successfully deleted Kinesis stream ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$8) {
+			if (error instanceof ResourceNotFoundException$9) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -32893,14 +32642,6 @@ var KinesisStreamProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.Name` → verify
 	*     with `DescribeStream`.
-	*  2. Walk `ListStreams` (paged via `ExclusiveStartStreamName`) and
-	*     match the `aws:cdk:path` tag via `ListTagsForStream(StreamName)`.
-	*     The walk runs through the shared `importTagWalk` helper, so the N+1
-	*     tag-read burst is retried with exponential backoff when AWS
-	*     throttles it instead of aborting the whole import.
-	*
-	* Kinesis tags use the standard `Tag[]` array shape (`Key`/`Value`),
-	* so the walk's `matchesCdkPath` matcher applies directly.
 	*/
 	/**
 	* Read the AWS-current Kinesis stream configuration in CFn-property shape.
@@ -32929,7 +32670,7 @@ var KinesisStreamProvider = class {
 		try {
 			stream = (await this.getClient().send(new DescribeStreamCommand({ StreamName: physicalId }))).StreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			throw err;
 		}
 		if (!stream) return void 0;
@@ -32947,7 +32688,7 @@ var KinesisStreamProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForStreamCommand({ StreamName: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			this.logger.debug(`Kinesis ListTagsForStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 		}
 		return result;
@@ -32961,28 +32702,10 @@ var KinesisStreamProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return null;
+			if (err instanceof ResourceNotFoundException$9) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListStreamsCommand({ ...marker && { ExclusiveStartStreamName: marker } }));
-				const names = list.StreamNames ?? [];
-				return {
-					items: names,
-					nextMarker: list.HasMoreStreams && names.length > 0 ? names[names.length - 1] : void 0
-				};
-			},
-			describe: async (streamName) => await this.getClient().send(new ListTagsForStreamCommand({ StreamName: streamName })),
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Poll DescribeStream until the stream reaches ACTIVE status
@@ -33158,7 +32881,7 @@ var KinesisStreamConsumerProvider = class {
 			await this.getClient().send(new DeregisterStreamConsumerCommand({ ConsumerARN: physicalId }));
 			this.logger.debug(`Successfully deregistered Kinesis stream consumer ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$8) {
+			if (error instanceof ResourceNotFoundException$9) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Kinesis stream consumer ${physicalId} not found, skipping`);
 				return;
@@ -33204,7 +32927,7 @@ var KinesisStreamConsumerProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeStreamConsumerCommand({ ConsumerARN: physicalId }))).ConsumerDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -33212,9 +32935,9 @@ var KinesisStreamConsumerProvider = class {
 		if (desc.ConsumerName !== void 0) result["ConsumerName"] = desc.ConsumerName;
 		if (desc.StreamARN !== void 0) result["StreamARN"] = desc.StreamARN;
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ ResourceARN: physicalId }))).Tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$15({ ResourceARN: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$8) return void 0;
+			if (err instanceof ResourceNotFoundException$9) return void 0;
 			this.logger.debug(`ListTagsForResource(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
 		}
@@ -33236,14 +32959,14 @@ var KinesisStreamConsumerProvider = class {
 		const tagsToRemove = [];
 		for (const k of Object.keys(oldMap)) if (!(k in newMap)) tagsToRemove.push(k);
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new UntagResourceCommand$17({
+			await this.getClient().send(new UntagResourceCommand$18({
 				ResourceARN: consumerArn,
 				TagKeys: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream consumer ${consumerArn}`);
 		}
 		if (Object.keys(tagsToAdd).length > 0) {
-			await this.getClient().send(new TagResourceCommand$17({
+			await this.getClient().send(new TagResourceCommand$18({
 				ResourceARN: consumerArn,
 				Tags: tagsToAdd
 			}));
@@ -33420,7 +33143,7 @@ var SchedulerScheduleProvider = class {
 			}));
 			this.logger.debug(`Deleted Schedule ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) {
+			if (error instanceof ResourceNotFoundException$10) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Schedule ${logicalId} already deleted (not found), treating as success`);
 				return;
@@ -33442,7 +33165,7 @@ var SchedulerScheduleProvider = class {
 			return (await this.getClient().send(new GetScheduleCommand({ Name: physicalId }))).Arn;
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			const customGroupHint = error instanceof ResourceNotFoundException$9 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
+			const customGroupHint = error instanceof ResourceNotFoundException$10 ? " Schedules in a custom group cannot be looked up by bare name; the Arn is normally served from cdkd state attributes." : "";
 			throw new ProvisioningError(`Failed to resolve Arn for Schedule ${physicalId}: ${cause?.message ?? String(error)}.${customGroupHint}`, resourceType, physicalId, physicalId, cause);
 		}
 	}
@@ -33472,7 +33195,7 @@ var SchedulerScheduleProvider = class {
 				...response.Target !== void 0 && { Target: response.Target }
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) return;
+			if (error instanceof ResourceNotFoundException$10) return;
 			throw error;
 		}
 	}
@@ -33498,7 +33221,7 @@ var SchedulerScheduleProvider = class {
 				attributes: response.Arn ? { Arn: response.Arn } : {}
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$9) return null;
+			if (error instanceof ResourceNotFoundException$10) return null;
 			throw error;
 		}
 	}
@@ -34129,19 +33852,6 @@ var EFSProvider = class {
 			if (err instanceof FileSystemNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		let marker;
-		do {
-			const list = await this.getClient().send(new DescribeFileSystemsCommand({ ...marker && { Marker: marker } }));
-			for (const fs of list.FileSystems ?? []) {
-				if (!fs.FileSystemId) continue;
-				if (matchesCdkPath(fs.Tags, input.cdkPath)) return {
-					physicalId: fs.FileSystemId,
-					attributes: {}
-				};
-			}
-			marker = list.NextMarker;
-		} while (marker);
 		return null;
 	}
 	async importAccessPoint(input) {
@@ -34155,23 +33865,6 @@ var EFSProvider = class {
 			if (err instanceof AccessPointNotFound) return null;
 			throw err;
 		}
-		if (!input.cdkPath) return null;
-		const fileSystemId = input.properties["FileSystemId"];
-		let nextToken;
-		do {
-			const list = await this.getClient().send(new DescribeAccessPointsCommand({
-				...nextToken && { NextToken: nextToken },
-				...fileSystemId && { FileSystemId: fileSystemId }
-			}));
-			for (const ap of list.AccessPoints ?? []) {
-				if (!ap.AccessPointId) continue;
-				if (matchesCdkPath(ap.Tags, input.cdkPath)) return {
-					physicalId: ap.AccessPointId,
-					attributes: {}
-				};
-			}
-			nextToken = list.NextToken;
-		} while (nextToken);
 		return null;
 	}
 };
@@ -34890,11 +34583,11 @@ var FSxFileSystemProvider = class {
 		}
 		const toRemove = [];
 		for (const key of prev.keys()) if (key !== void 0 && !next.has(key)) toRemove.push(key);
-		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$18({
+		if (toSet.length > 0) await this.getClient().send(new TagResourceCommand$19({
 			ResourceARN: arn,
 			Tags: toSet
 		}));
-		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$18({
+		if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$19({
 			ResourceARN: arn,
 			TagKeys: toRemove
 		}));
@@ -35322,18 +35015,6 @@ const CREATE_READY_STATES = /* @__PURE__ */ new Set(["WAITING", "RUNNING"]);
 */
 const TERMINAL_STATES = /* @__PURE__ */ new Set(["TERMINATED", "TERMINATED_WITH_ERRORS"]);
 /**
-* Cluster states that mean "the cluster is alive" — the `ListClusters` filter
-* used by `import()` discovery so a long-gone `TERMINATED*` cluster is never
-* adopted. Everything except the two `TERMINAL_STATES`.
-*/
-const NON_TERMINATED_STATES = [
-	"STARTING",
-	"BOOTSTRAPPING",
-	"RUNNING",
-	"WAITING",
-	"TERMINATING"
-];
-/**
 * Top-level CFn properties that map to a MUTABLE EMR API surface. Every other
 * property is either registry-createOnly (routed through DELETE+CREATE by the
 * replacement-detection layer) or lives inside the `Instances` block (handled
@@ -35842,12 +35523,6 @@ var EMRClusterProvider = class {
 	*     the physical id — a cluster's id (`j-...`) is service-generated, while
 	*     the template `Name` is only the display name — so no name fallback
 	*     applies (`resolveExplicitPhysicalId(..., null)`).
-	*  2. Tag-based lookup: `ListClusters` filtered to the non-terminated states
-	*     (a `TERMINATED*` cluster is gone and must never be adopted), then a
-	*     `DescribeCluster` per candidate to read `Tags` (the list summaries do
-	*     NOT carry tags) and match `aws:cdk:path`. The walk runs through the
-	*     shared `importTagWalk` helper, so each list page / describe is retried
-	*     with exponential backoff when AWS throttles the N+1 read burst.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, null);
@@ -35859,42 +35534,20 @@ var EMRClusterProvider = class {
 				attributes: this.buildAttributes(cluster)
 			};
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListClustersCommand({
-					ClusterStates: [...NON_TERMINATED_STATES],
-					...marker && { Marker: marker }
-				}));
-				return {
-					items: list.Clusters,
-					nextMarker: list.Marker
-				};
-			},
-			describe: async (summary) => summary.Id ? await this.describeClusterOrUndefined(summary.Id) : void 0,
-			tagsOf: (cluster) => cluster.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Id,
-			attributes: this.buildAttributes(match.detail)
-		};
+		return null;
 	}
 	/**
 	* `DescribeCluster` that maps a not-found (`InvalidRequestException` — the
 	* cluster id is unknown in this region / aged out of Describe) to
 	* `undefined` instead of throwing, so `import()` can treat it as "no match"
-	* rather than aborting the whole adoption run.
+	* rather than aborting the whole adoption run. Also consumed by
+	* `readCurrentState` for the same gone-cluster tolerance.
 	*
-	* `undefined`, NOT `null`, is load-bearing: `importTagWalk` skips a candidate
-	* on `detail === undefined`, and an actual `null` would flow into `tagsOf`
-	* and `TypeError`. Also note the mapping is BROAD — `InvalidRequestException`
-	* covers more than not-found, so a genuine failure here degrades to "no
-	* match" and a subsequent deploy would CREATE a duplicate cluster rather than
-	* adopt the existing one. The walk logs each skip at debug so the case is at
-	* least visible under `--verbose`; narrowing the mapping needs a
-	* message/code-level discriminator AWS does not currently document.
+	* Note the mapping is BROAD — `InvalidRequestException` covers more than
+	* not-found, so a genuine failure here degrades to "no match" and a
+	* subsequent deploy would CREATE a duplicate cluster rather than adopt the
+	* existing one. Narrowing the mapping needs a message/code-level
+	* discriminator AWS does not currently document.
 	*/
 	async describeClusterOrUndefined(clusterId) {
 		try {
@@ -37218,7 +36871,7 @@ var FirehoseProvider = class {
 			await this.getClient().send(new DeleteDeliveryStreamCommand({ DeliveryStreamName: physicalId }));
 			this.logger.debug(`Successfully deleted Firehose delivery stream ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$10) {
+			if (error instanceof ResourceNotFoundException$11) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Firehose delivery stream ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -37755,7 +37408,7 @@ var FirehoseProvider = class {
 		try {
 			desc = (await this.getClient().send(new DescribeDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).DeliveryStreamDescription;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return void 0;
+			if (err instanceof ResourceNotFoundException$11) return void 0;
 			throw err;
 		}
 		if (!desc) return void 0;
@@ -37786,7 +37439,7 @@ var FirehoseProvider = class {
 		try {
 			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId }))).Tags);
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return void 0;
+			if (err instanceof ResourceNotFoundException$11) return void 0;
 			this.logger.debug(`Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
 		}
@@ -37823,28 +37476,10 @@ var FirehoseProvider = class {
 				attributes: {}
 			};
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$10) return null;
+			if (err instanceof ResourceNotFoundException$11) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListDeliveryStreamsCommand({ ...marker && { ExclusiveStartDeliveryStreamName: marker } }));
-				const names = list.DeliveryStreamNames ?? [];
-				return {
-					items: names,
-					nextMarker: list.HasMoreDeliveryStreams && names.length > 0 ? names[names.length - 1] : void 0
-				};
-			},
-			describe: async (name) => await this.getClient().send(new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: name })),
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary,
-			attributes: {}
-		};
+		return null;
 	}
 	/**
 	* Wait for a delivery stream to become ACTIVE.
@@ -38350,32 +37985,7 @@ var CloudTrailProvider = class {
 			if (err instanceof TrailNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListTrailsCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.Trails,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (trail) => {
-				if (!trail.TrailARN || !trail.Name) return void 0;
-				try {
-					return await this.getClient().send(new ListTagsCommand$1({ ResourceIdList: [trail.TrailARN] }));
-				} catch (err) {
-					if (err instanceof TrailNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.ResourceTagList?.[0]?.TagsList
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -38608,7 +38218,7 @@ var CodeBuildProvider = class {
 			await this.getClient().send(new DeleteProjectCommand({ name: physicalId }));
 			this.logger.debug(`Successfully deleted CodeBuild Project ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$11) {
+			if (error instanceof ResourceNotFoundException$12) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`CodeBuild Project ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -38663,7 +38273,7 @@ var CodeBuildProvider = class {
 		try {
 			project = (await this.getClient().send(new BatchGetProjectsCommand({ names: [physicalId] }))).projects?.[0];
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return void 0;
+			if (err instanceof ResourceNotFoundException$12) return void 0;
 			throw err;
 		}
 		if (!project) return void 0;
@@ -38808,7 +38418,7 @@ var CodeBuildProvider = class {
 				attributes: {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$11) return null;
+			if (err instanceof ResourceNotFoundException$12) return null;
 			throw err;
 		}
 		return null;
@@ -39048,11 +38658,11 @@ var CodeCommitRepositoryProvider = class {
 				const repoArn = metadata?.Arn;
 				if (repoArn) {
 					const removedKeys = Object.keys(oldTagMap).filter((k) => !(k in newTagMap));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$19({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$20({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$19({
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$20({
 						resourceArn: repoArn,
 						tags: newTagMap
 					}));
@@ -39180,7 +38790,7 @@ var CodeCommitRepositoryProvider = class {
 		if (!metadata) return void 0;
 		let tags = [];
 		if (metadata.Arn) try {
-			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }))).tags);
+			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$16({ resourceArn: metadata.Arn }))).tags);
 		} catch (err) {
 			if (err instanceof RepositoryDoesNotExistException) return void 0;
 			throw err;
@@ -39215,9 +38825,6 @@ var CodeCommitRepositoryProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.RepositoryName` → verify via
 	*     `GetRepository`.
-	*  2. `ListRepositories` paginated, then `ListTagsForResource(arn)` per
-	*     repository to match `aws:cdk:path` (CodeCommit uses the
-	*     `Record<string, string>` tag-map shape).
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "RepositoryName");
@@ -39231,42 +38838,7 @@ var CodeCommitRepositoryProvider = class {
 			if (err instanceof RepositoryDoesNotExistException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListRepositoriesCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.repositories,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (repo) => {
-				if (!repo.repositoryName) return void 0;
-				let metadata;
-				try {
-					metadata = await this.getRepositoryMetadata(repo.repositoryName);
-				} catch (err) {
-					if (err instanceof RepositoryDoesNotExistException) return void 0;
-					throw err;
-				}
-				if (!metadata?.Arn) return void 0;
-				const tagsResp = await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: metadata.Arn }));
-				return {
-					metadata,
-					tags: tagsResp.tags
-				};
-			},
-			tagsOf: (detail) => Object.entries(detail.tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.repositoryName,
-			attributes: this.toAttributes(match.detail.metadata)
-		};
+		return null;
 	}
 	/**
 	* Seed the repository's initial commit from the CFn `Code` property.
@@ -39470,7 +39042,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = Object.keys(oldTags).filter((k) => !(k in newTags));
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$20({
+					await this.getClient().send(new UntagResourceCommand$21({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -39479,7 +39051,7 @@ var DLMLifecyclePolicyProvider = class {
 				const tagsToAdd = {};
 				for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) tagsToAdd[k] = v;
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$20({
+					await this.getClient().send(new TagResourceCommand$21({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -39503,7 +39075,7 @@ var DLMLifecyclePolicyProvider = class {
 			await this.getClient().send(new DeleteLifecyclePolicyCommand$1({ PolicyId: physicalId }));
 			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) {
+			if (error instanceof ResourceNotFoundException$13) {
 				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
 				return;
@@ -39554,7 +39126,7 @@ var DLMLifecyclePolicyProvider = class {
 				Tags: normalizeAwsTagsToCfn(policy.Tags)
 			};
 		} catch (error) {
-			if (error instanceof ResourceNotFoundException$12) return;
+			if (error instanceof ResourceNotFoundException$13) return;
 			throw error;
 		}
 	}
@@ -39581,9 +39153,6 @@ var DLMLifecyclePolicyProvider = class {
 	*  1. `--resource` override (`knownPhysicalId`) -> verify via
 	*     GetLifecyclePolicy. There is no template name property — the policy
 	*     id is service-generated — so no name fallback applies.
-	*  2. Tag-based lookup: GetLifecyclePolicies returns every policy summary
-	*     WITH its tag map in a single unpaginated call, so the `aws:cdk:path`
-	*     match needs no per-policy follow-up.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) try {
@@ -39593,26 +39162,10 @@ var DLMLifecyclePolicyProvider = class {
 				attributes: response.Policy.PolicyArn ? { Arn: response.Policy.PolicyArn } : {}
 			} : null;
 		} catch (err) {
-			if (err instanceof ResourceNotFoundException$12) return null;
+			if (err instanceof ResourceNotFoundException$13) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async () => {
-				return { items: (await this.getClient().send(new GetLifecyclePoliciesCommand({}))).Policies };
-			},
-			describe: async (policy) => policy.PolicyId ? policy : void 0,
-			tagsOf: (policy) => Object.entries(policy.Tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.PolicyId,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -39689,11 +39242,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$21({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$22({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$21({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$22({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -39821,7 +39374,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -39835,8 +39388,6 @@ var S3VectorsProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.VectorBucketName`
 	*     → verify via `GetVectorBucket`. The physical id is the bucket name.
-	*  2. `ListVectorBuckets` paginator + `ListTagsForResource(resourceArn)`
-	*     (tags map keyed by tag name) and match `aws:cdk:path`.
 	*/
 	async import(input) {
 		const explicit = input.knownPhysicalId ?? (typeof input.properties?.["VectorBucketName"] === "string" && input.properties["VectorBucketName"].length > 0 ? input.properties["VectorBucketName"] : void 0);
@@ -39850,35 +39401,7 @@ var S3VectorsProvider = class {
 			if (this.isNotFoundError(err)) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new ListVectorBucketsCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.vectorBuckets,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (bucket) => {
-				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) return void 0;
-				try {
-					return await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.vectorBucketArn }));
-				} catch (err) {
-					if (this.isNotFoundError(err)) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => Object.entries(tagsResp.tags ?? {}).map(([Key, Value]) => ({
-				Key,
-				Value
-			}))
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.vectorBucketName,
-			attributes: {}
-		};
+		return null;
 	}
 	isNotFoundError(error) {
 		if (error instanceof Error) {
@@ -40091,10 +39614,6 @@ var S3DirectoryBucketProvider = class {
 	* Lookup order:
 	*  1. `--resource <id>=<name>` override or `Properties.BucketName` →
 	*     verify via `HeadBucket`.
-	*  2. `ListDirectoryBuckets` paginator + `GetBucketTagging` (TagSet:
-	*     Tag[]) and match `aws:cdk:path`. `GetBucketTagging` may surface
-	*     `NoSuchTagSet` / `AccessDenied` per-bucket — those are skipped
-	*     rather than fatal.
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "BucketName");
@@ -40109,33 +39628,7 @@ var S3DirectoryBucketProvider = class {
 			if (e.name === "NotFound" || e.name === "NoSuchBucket") return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (token) => {
-				const list = await this.s3Client.send(new ListDirectoryBucketsCommand({ ...token && { ContinuationToken: token } }));
-				return {
-					items: list.Buckets,
-					nextMarker: list.ContinuationToken
-				};
-			},
-			describe: async (b) => {
-				if (!b.Name) return void 0;
-				try {
-					return await this.s3Client.send(new GetBucketTaggingCommand({ Bucket: b.Name }));
-				} catch (err) {
-					const e = err;
-					if (e.name === "NoSuchTagSet" || e.name === "AccessDenied") return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagging) => tagging.TagSet
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.Name,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -40251,7 +39744,7 @@ var S3TablesProvider = class {
 				if (!namespaceName) continue;
 				let tableContinuationToken;
 				do {
-					const tablesResult = await this.getClient().send(new ListTablesCommand$1({
+					const tablesResult = await this.getClient().send(new ListTablesCommand({
 						tableBucketARN,
 						namespace: namespaceName,
 						continuationToken: tableContinuationToken
@@ -40591,7 +40084,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$20({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -40645,7 +40138,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$22({
+			await this.getClient().send(new UntagResourceCommand$23({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -40654,7 +40147,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$22({
+			await this.getClient().send(new TagResourceCommand$23({
 				resourceArn,
 				tags: upserts
 			}));
@@ -40686,7 +40179,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$22({
+			await this.getClient().send(new UntagResourceCommand$23({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -40695,7 +40188,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$22({
+			await this.getClient().send(new TagResourceCommand$23({
 				resourceArn,
 				tags: upserts
 			}));
@@ -40878,11 +40371,11 @@ var ECRProvider = class {
 				if (repoArn) {
 					const newKeys = new Set((newTags ?? []).map((t) => t.Key).filter((k) => !!k));
 					const removedKeys = (oldTags ?? []).map((t) => t.Key).filter((k) => !!k && !newKeys.has(k));
-					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$11({
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$12({
 						resourceArn: repoArn,
 						tagKeys: removedKeys
 					}));
-					if (newTags && newTags.length > 0) await this.getClient().send(new TagResourceCommand$11({
+					if (newTags && newTags.length > 0) await this.getClient().send(new TagResourceCommand$12({
 						resourceArn: repoArn,
 						tags: newTags
 					}));
@@ -40993,8 +40486,6 @@ var ECRProvider = class {
 	* Lookup order:
 	*  1. `--resource` override or `Properties.RepositoryName` → verify via
 	*     `DescribeRepositories`.
-	*  2. `DescribeRepositories` paginated, then `ListTagsForResource(arn)`
-	*     per repository to match `aws:cdk:path` (`Tag[]` array shape).
 	*/
 	async import(input) {
 		const explicit = resolveExplicitPhysicalId(input, "RepositoryName");
@@ -41007,32 +40498,7 @@ var ECRProvider = class {
 			if (err instanceof RepositoryNotFoundException) return null;
 			throw err;
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.getClient().send(new DescribeRepositoriesCommand({ ...marker && { nextToken: marker } }));
-				return {
-					items: list.repositories,
-					nextMarker: list.nextToken
-				};
-			},
-			describe: async (repo) => {
-				if (!repo.repositoryArn || !repo.repositoryName) return void 0;
-				try {
-					return await this.getClient().send(new ListTagsForResourceCommand$8({ resourceArn: repo.repositoryArn }));
-				} catch (err) {
-					if (err instanceof RepositoryNotFoundException) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.tags
-		});
-		if (!match) return null;
-		return {
-			physicalId: match.summary.repositoryName,
-			attributes: {}
-		};
+		return null;
 	}
 };
 
@@ -42090,10 +41556,6 @@ var ACMCertificateProvider = class {
 	*
 	* Lookup order:
 	*  1. `--resource` override (must be an ARN — ACM has no other unique id).
-	*  2. Tag-based `aws:cdk:path` match across `ListCertificates` +
-	*     `ListTagsForCertificate`. NOTE: ACM has no `Scope: Local` filter —
-	*     `ListCertificates` returns customer-managed certs only (AWS-managed
-	*     certs are not surfaced via this API), so no extra guard is needed.
 	*/
 	async import(input) {
 		if (input.knownPhysicalId) {
@@ -42113,36 +41575,7 @@ var ACMCertificateProvider = class {
 				throw err;
 			}
 		}
-		const match = await importTagWalk({
-			cdkPath: input.cdkPath,
-			logicalId: input.logicalId,
-			listPage: async (marker) => {
-				const list = await this.acmClient.send(new ListCertificatesCommand({ ...marker && { NextToken: marker } }));
-				return {
-					items: list.CertificateSummaryList,
-					nextMarker: list.NextToken
-				};
-			},
-			describe: async (summary) => {
-				if (!summary.CertificateArn) return void 0;
-				try {
-					return await this.acmClient.send(new ListTagsForCertificateCommand({ CertificateArn: summary.CertificateArn }));
-				} catch (err) {
-					if (err instanceof ResourceNotFoundException$6) return void 0;
-					throw err;
-				}
-			},
-			tagsOf: (tagsResp) => tagsResp.Tags
-		});
-		if (!match) return null;
-		const arn = match.summary.CertificateArn;
-		return {
-			physicalId: arn,
-			attributes: {
-				Arn: arn,
-				CertificateArn: arn
-			}
-		};
+		return null;
 	}
 	/**
 	* Poll `DescribeCertificate` until status === `ISSUED`. On the FIRST poll
@@ -42255,6 +41688,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::Lambda::EventSourceMapping", new LambdaEventSourceMappingProvider());
 	registry.register("AWS::Lambda::LayerVersion", new LambdaLayerVersionProvider());
 	registry.register("AWS::Lambda::EventInvokeConfig", new LambdaEventInvokeConfigProvider());
+	registry.register("AWS::Lambda::MicrovmImage", new LambdaMicrovmImageProvider());
 	registry.register("AWS::DynamoDB::Table", new DynamoDBTableProvider());
 	registry.register("AWS::DynamoDB::GlobalTable", new DynamoDBGlobalTableProvider());
 	registry.register("AWS::Logs::LogGroup", new LogsLogGroupProvider());
@@ -42572,15 +42006,17 @@ async function deployCommand(stacks, options) {
 		logger.info(cyan(synthesisStatusMessage(app, "Synthesizing CDK app...")));
 		const synthesizer = new Synthesizer();
 		const context = parseContextOptions(options.context);
-		const { stacks: allStacks } = await synthesizer.synthesize({
+		const synthOptions = {
 			app: options.app,
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
 			...Object.keys(context).length > 0 && { context },
 			stateBucket,
-			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
-		});
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
+			deferMacroExpansion: true
+		};
+		const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
 		logger.debug(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
@@ -42619,6 +42055,7 @@ async function deployCommand(stacks, options) {
 			};
 			for (const stack of [...targetStacks]) addDependencies(stack.stackName);
 		}
+		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({ region: options.region || process.env["AWS_REGION"] || "us-east-1" });
 		const accountId = (await stsClient.send(new GetCallerIdentityCommand({}))).Account;
@@ -44279,15 +43716,17 @@ async function diffCommand(stacks, options) {
 		logger.info(synthesisStatusMessage(app, "Synthesizing CDK app..."));
 		const synthesizer = new Synthesizer();
 		const context = parseContextOptions(options.context);
-		const { stacks: allStacks } = await synthesizer.synthesize({
+		const synthOptions = {
 			app: options.app,
 			output: options.output,
 			...options.region && { region: options.region },
 			...options.profile && { profile: options.profile },
 			...Object.keys(context).length > 0 && { context },
 			stateBucket,
-			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
-		});
+			...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } },
+			deferMacroExpansion: true
+		};
+		const { stacks: allStacks } = await synthesizer.synthesize(synthOptions);
 		logger.info(`Found ${allStacks.length} stack(s) in assembly`);
 		const stackPatterns = stacks.length > 0 ? stacks : options.stack ? [options.stack] : [];
 		let targetStacks;
@@ -44296,6 +43735,7 @@ async function diffCommand(stacks, options) {
 		else if (allStacks.length === 1) targetStacks = allStacks;
 		else throw new Error(`Multiple stacks found: ${allStacks.map(describeStack).join(", ")}. Specify stack name(s) or use --all`);
 		if (targetStacks.length === 0) throw new Error(stackPatterns.length > 0 ? `No stacks matching ${stackPatterns.join(", ")} found in assembly. Available: ${allStacks.map(describeStack).join(", ")}` : "No stacks found in assembly");
+		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const stateConfig = {
 			bucket: stateBucket,
 			prefix: options.statePrefix
@@ -45524,8 +44964,7 @@ async function destroyCommand(stackArgs, options) {
 				app: appCmd,
 				output: options.output || "cdk.out",
 				...Object.keys(context).length > 0 && { context },
-				stateBucket,
-				...options.profile && { macroExpandS3ClientOpts: { profile: options.profile } }
+				deferMacroExpansion: true
 			});
 			appStacks = result.stacks.map((s) => ({
 				stackName: s.stackName,
@@ -51728,12 +51167,10 @@ async function importOne(task) {
 		outcome: "skipped-no-impl",
 		reason: `provider does not implement import (yet)`
 	};
-	const cdkPath = readCdkPath(resource);
 	const properties = substituteOverrideRefs(resource.Properties ?? {}, overrides);
 	const input = {
 		logicalId,
 		resourceType: resource.Type,
-		cdkPath,
 		stackName,
 		region,
 		properties,
@@ -51745,7 +51182,7 @@ async function importOne(task) {
 			logicalId,
 			resourceType: resource.Type,
 			outcome: "skipped-not-found",
-			reason: "no matching AWS resource"
+			reason: `no matching AWS resource — pass --resource ${logicalId}=<physicalId> to adopt it explicitly`
 		};
 		return {
 			logicalId,
@@ -61823,7 +61260,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.257.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.258.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());