@go-to-k/cdkd 0.207.3 → 0.207.5

package/dist/cli.js

@@ -11888,6 +11888,33 @@ var SSMParameterProvider = class {
 		this.ssmClient = awsClients.ssm;
 	}
 	/**
+	* Normalize a CFn `AWS::SSM::Parameter.Tags` value into the SDK `Tag[]`
+	* shape. Unlike most CFn resources (whose `Tags` is a `{Key,Value}[]` list),
+	* `AWS::SSM::Parameter.Tags` is a key->value **map** (`{ "Env": "prod" }`) —
+	* CDK synthesizes the map form, so `properties['Tags'].map(...)` throws
+	* `Tags.map is not a function`. Accept the map (canonical) AND the list
+	* (defensive, in case a hand-authored / escape-hatched template supplies it),
+	* coerce each value to a string (SSM tag values must be strings), and drop
+	* `aws:`-prefixed reserved keys (AWS rejects user attempts to set them).
+	*/
+	cfnTagsToSdkTags(raw) {
+		if (raw === void 0 || raw === null) return [];
+		const coerce = (v) => typeof v === "string" ? v : typeof v === "number" || typeof v === "boolean" ? String(v) : "";
+		let entries;
+		if (Array.isArray(raw)) entries = raw.map((t) => [t?.["Key"], t?.["Value"]]);
+		else if (typeof raw === "object") entries = Object.entries(raw);
+		else entries = [];
+		const out = [];
+		for (const [key, value] of entries) {
+			if (typeof key !== "string" || key.length === 0 || key.startsWith("aws:")) continue;
+			out.push({
+				Key: key,
+				Value: coerce(value)
+			});
+		}
+		return out;
+	}
+	/**
 	* Create an SSM parameter
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -11913,17 +11940,12 @@ var SSMParameterProvider = class {
 			if (properties["DataType"]) putParams.DataType = properties["DataType"];
 			await this.ssmClient.send(new PutParameterCommand(putParams));
 			try {
-				if (properties["Tags"]) {
-					const ssmTags = properties["Tags"].map((t) => ({
-						Key: t.Key,
-						Value: t.Value
-					}));
-					await this.ssmClient.send(new AddTagsToResourceCommand({
-						ResourceType: "Parameter",
-						ResourceId: name,
-						Tags: ssmTags
-					}));
-				}
+				const ssmTags = this.cfnTagsToSdkTags(properties["Tags"]);
+				if (ssmTags.length > 0) await this.ssmClient.send(new AddTagsToResourceCommand({
+					ResourceType: "Parameter",
+					ResourceId: name,
+					Tags: ssmTags
+				}));
 			} catch (innerError) {
 				try {
 					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
@@ -11967,25 +11989,21 @@ var SSMParameterProvider = class {
 			if (properties["Policies"] !== void 0) putParams.Policies = properties["Policies"];
 			if (properties["DataType"] !== void 0) putParams.DataType = properties["DataType"];
 			await this.ssmClient.send(new PutParameterCommand(putParams));
-			const newTags = properties["Tags"];
-			const oldTags = previousProperties["Tags"];
-			if (JSON.stringify(newTags) !== JSON.stringify(oldTags)) {
-				if (oldTags && oldTags.length > 0) await this.ssmClient.send(new RemoveTagsFromResourceCommand({
+			const newTags = this.cfnTagsToSdkTags(properties["Tags"]);
+			const oldTags = this.cfnTagsToSdkTags(previousProperties["Tags"]);
+			const tagKey = (t) => t.Key;
+			const sortedJson = (tags) => JSON.stringify([...tags].sort((a, b) => tagKey(a).localeCompare(tagKey(b))));
+			if (sortedJson(newTags) !== sortedJson(oldTags)) {
+				if (oldTags.length > 0) await this.ssmClient.send(new RemoveTagsFromResourceCommand({
 					ResourceType: "Parameter",
 					ResourceId: physicalId,
 					TagKeys: oldTags.map((t) => t.Key)
 				}));
-				if (newTags && newTags.length > 0) {
-					const ssmTags = newTags.map((t) => ({
-						Key: t.Key,
-						Value: t.Value
-					}));
-					await this.ssmClient.send(new AddTagsToResourceCommand({
-						ResourceType: "Parameter",
-						ResourceId: physicalId,
-						Tags: ssmTags
-					}));
-				}
+				if (newTags.length > 0) await this.ssmClient.send(new AddTagsToResourceCommand({
+					ResourceType: "Parameter",
+					ResourceId: physicalId,
+					Tags: newTags
+				}));
 				this.logger.debug(`Updated tags for SSM parameter ${physicalId}`);
 			}
 			this.logger.debug(`Successfully updated SSM parameter ${logicalId}`);
@@ -12096,10 +12114,11 @@ var SSMParameterProvider = class {
 		} catch {}
 		if (!policiesEmitted) result["Policies"] = [];
 		try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.ssmClient.send(new ListTagsForResourceCommand$2({
+			const tagArr = normalizeAwsTagsToCfn((await this.ssmClient.send(new ListTagsForResourceCommand$2({
 				ResourceType: "Parameter",
 				ResourceId: physicalId
 			}))).TagList);
+			result["Tags"] = Object.fromEntries(tagArr.map((t) => [t.Key, t.Value]));
 		} catch {}
 		return result;
 	}
@@ -23170,11 +23189,19 @@ var Route53Provider = class {
 	*      DISABLED / undefined / NoSuchHostedZone → return early (nothing
 	*      to do, the delete will proceed normally or hit the existing
 	*      NoSuchHostedZone short-circuit).
-	*   2. ENABLING / ENABLED → issue `UpdateHostedZoneFeatures(false)` then
-	*      poll `GetHostedZone` until the status settles to DISABLED.
-	*   3. DISABLING → poll without re-issuing the toggle.
-	*   4. *_FAILED / *_HOSTED_ZONE_LOCKED → surface the AWS error to the
-	*      operator (out of scope for cdkd to recover automatically).
+	*   2. ENABLING / ENABLING_HOSTED_ZONE_LOCKED → wait for the enable to
+	*      settle (AWS rejects a disable while enabling is in flight), then
+	*      fall through to the disable below.
+	*   3. ENABLED → issue `UpdateHostedZoneFeatures(false)` then poll
+	*      `GetHostedZone` until the status settles to DISABLED.
+	*   4. DISABLING / DISABLING_HOSTED_ZONE_LOCKED → poll without re-issuing
+	*      the toggle. The `*_HOSTED_ZONE_LOCKED` states are transient
+	*      sub-states of the enable/disable transition (AWS briefly locks the
+	*      zone mid-transition) — they settle to ENABLED / DISABLED on their
+	*      own, so cdkd waits through them rather than treating them as a
+	*      terminal failure.
+	*   5. *_FAILED → surface the AWS error to the operator (out of scope for
+	*      cdkd to recover automatically).
 	*
 	* Poll budget: env-overridable timeout (default 10 min) + interval
 	* (default 15s; tests override via env to keep runs fast). Failure to
@@ -23194,12 +23221,7 @@ var Route53Provider = class {
 			}
 		};
 		const deadline = Date.now() + timeoutMs;
-		const TERMINAL_FAILED = new Set([
-			"ENABLE_FAILED",
-			"DISABLE_FAILED",
-			"ENABLING_HOSTED_ZONE_LOCKED",
-			"DISABLING_HOSTED_ZONE_LOCKED"
-		]);
+		const TERMINAL_FAILED = new Set(["ENABLE_FAILED", "DISABLE_FAILED"]);
 		const waitFor = async (targets, label) => {
 			while (Date.now() < deadline) {
 				const status = await readStatus();
@@ -23218,8 +23240,8 @@ var Route53Provider = class {
 		let current = await readStatus();
 		if (current === void 0 || current === "DISABLED") return;
 		if (TERMINAL_FAILED.has(current)) throw new ProvisioningError(`Cannot delete hosted zone ${logicalId} (${physicalId}): AcceleratedRecoveryStatus is '${current}' — operator must resolve before destroy can proceed`, "AWS::Route53::HostedZone", logicalId, physicalId);
-		if (current === "ENABLING") {
-			this.logger.debug(`Hosted zone ${physicalId} is ENABLING; waiting for it to settle before issuing disable`);
+		if (current === "ENABLING" || current === "ENABLING_HOSTED_ZONE_LOCKED") {
+			this.logger.debug(`Hosted zone ${physicalId} is ${current} (an enabling phase); waiting for it to settle before issuing disable`);
 			current = await waitFor(new Set(["ENABLED", "DISABLED"]), "ENABLED or DISABLED");
 			if (current === void 0 || current === "DISABLED") return;
 		}
@@ -23229,7 +23251,7 @@ var Route53Provider = class {
 				HostedZoneId: physicalId,
 				EnableAcceleratedRecovery: false
 			}));
-		} else if (current === "DISABLING") this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecovery is already DISABLING; waiting for settle`);
+		} else if (current === "DISABLING" || current === "DISABLING_HOSTED_ZONE_LOCKED") this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecovery is already ${current} (a disabling phase); waiting for settle`);
 		const settled = await waitFor(new Set(["DISABLED"]), "DISABLED");
 		this.logger.debug(`Hosted zone ${physicalId} AcceleratedRecoveryStatus settled to ${settled ?? "undefined (zone gone)"}`);
 	}
@@ -52696,7 +52718,7 @@ function reorderArgs(argv) {
 */
 async function main() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.207.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.207.5");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());