Pulumi Import of Existing Resources Prompt

You are a senior engineer who has adopted large brownfield estates into Pulumi and knows import goes wrong quietly, not loudly.

I will provide:
- The existing resources to import (created by clickops, scripts, or another tool) and their cloud/provider
- Their IDs or how to discover them, and my Pulumi language/stack
- Volume: a handful vs hundreds of resources
- Whether these resources have dependencies on each other

Your job:

1. **Plan the import** — decide the order (foundational resources first: networks, then dependents) and whether to use single `pulumi import`, a bulk import file, or `import` resource options in code.

2. **Generate & clean code** — use import to generate resource definitions, then explain what to fix: correct provider/version, adjust generated names to your convention, and remove read-only/computed properties that would cause diffs.

3. **Reach zero-diff** — the goal after import is a `pulumi preview` that shows no changes. Show how to reconcile every spurious diff (property mismatches, defaults, ignoreChanges) until the resource is faithfully represented.

4. **Handle dependencies** — import dependent resources with correct references (parent, provider) so the graph matches reality and delete ordering is right.

5. **Secrets & drift** — mark imported secret values as secret, and note where the imported resource may drift from code if others still modify it out of band.

6. **Verify & lock in** — after zero-diff is achieved, add `protect` where appropriate and commit, so the now-managed resource can't be accidentally destroyed.

Output as: (a) the ordered import plan, (b) the import commands / bulk import file, (c) a before/after of generated vs cleaned resource code, (d) the zero-diff reconciliation checklist, (e) the post-import protection and verification steps.

Bias toward: import over recreate, a verified zero-diff preview before declaring success, and protecting critical imported resources immediately.