@go-to-k/cdkd 0.278.32 → 0.278.34

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as withRetry, $t as getAwsClients, A as red, At as synthesisStatusMessage, B as isTerminationProtectionPropagationError, Bt as stateBucketExistenceConfirmed, C as isStatefulRecreateTargetSync, Cn as normalizeAwsError, Ct as formatDockerLoginError, D as cyan, Dt as AssetManifestLoader, E as bold, Et as runDockerStreaming, F as ProviderRegistry, Ft as resolveCaptureObservedState, G as normalizeAwsTagsToCfn, Gt as findLargeInlineResources, H as cfnRefValueFromPhysicalId, Ht as CFN_TEMPLATE_BODY_LIMIT, I as findActionableSilentDrops, It as resolveSkipPrefix, J as readConfigString, Jt as AssemblyReader, K as resolveExplicitPhysicalId, Kt as uploadCfnTemplate, L as CloudControlProvider, Lt as resolveStateBucketWithDefault, M as IAMRoleProvider, Mt as getLegacyStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveApp, O as gray, Ot as getDockerImageBySourceHash, P as clearOnUpdateRemoval, Pt as resolveAutoAssetStorage, Q as describeTypeWithThrottleRetry, Qt as AwsClients, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefaultAndSource, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as buildDockerImage, T as formatResourceLine, Tt as runDockerForeground, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_URL_LIMIT, V as IntrinsicFunctionResolver, Vt as warnDeprecatedNoPrefixCliFlag, W as WAFv2WebACLProvider, Wt as MIGRATE_TMP_PREFIX, X as applyRoleArnIfSet, Y as requireConfigString, Yt as processStackMessages, Z as DiffCalculator, Zt as resolveBucketRegion, _ as createPreDeleteFinalSnapshot, _n as StackHasActiveImportsError, _t as ensureAssetStorage, a as DeploymentEventsStore, at as S3StateBackend, b as unsupportedFinalSnapshotError, bt as validateAssetBucketName, c as replayFailedOperations, cn as LocalMigrateError, ct as AssetPublisher, d as IMPLICIT_DELETE_DEPENDENCIES, dn as MissingCdkCliError, dt as buildAssetRedirectMap, en as resetAwsClients, et as isRetryableTransientError, f as computeImplicitDeleteEdges, fn as NestedStackChildDirectDestroyError, ft as createAssetRedirectResolver, g as ccRoutedFinalSnapshotError, gn as ResourceUpdateNotSupportedError, gt as BOOTSTRAP_MARKER_PREFIX, h as buildFinalSnapshotIdentifier, hn as ResourceTimeoutError, ht as AssetModeResolver, i as DeploymentEventsReader, it as LockManager, j as yellow, jt as getDefaultStateBucketName, k as green, kt as Synthesizer, l as replayRollback, ln as LocalStartServiceError, lt as stringifyValue, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ProvisioningError, mt as rewriteTemplateAssetReferences, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as DagBuilder, o as planFailedOps, on as DeployCancelledError, ot as rebuildClientForBucketRegion, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as PartialFailureError, pt as loadPublishableAssetManifest, q as assertRegionMatch, qt as expectedOwnerParam, r as DeployEngine, rn as CdkdError, rt as TemplateParser, s as planRollback, sn as LocalInvokeBuildError$1, st as shouldRetainResource, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as setAwsClients, tt as isThrottlingError, u as withResourceDeadline, ut as WorkGraph, v as isFinalSnapshotError, vn as StackTerminationProtectionError, vt as getBootstrapMarkerKey, w as renderStatefulReason, wn as withErrorHandling, wt as getDockerCmd, x as extractDeploymentEventError, xt as validateContainerRepoName, y as refusesFinalSnapshot, yt as parseBootstrapMarker, z as disableInstanceApiTermination, zt as resolveUseCdkBootstrapAssets } from "./deploy-engine-CEVFHtcP.js";
+import { $ as withRetry, $t as getAwsClients, A as red, At as synthesisStatusMessage, B as isTerminationProtectionPropagationError, Bt as stateBucketExistenceConfirmed, C as isStatefulRecreateTargetSync, Cn as normalizeAwsError, Ct as formatDockerLoginError, D as cyan, Dt as AssetManifestLoader, E as bold, Et as runDockerStreaming, F as ProviderRegistry, Ft as resolveCaptureObservedState, G as normalizeAwsTagsToCfn, Gt as findLargeInlineResources, H as cfnRefValueFromPhysicalId, Ht as CFN_TEMPLATE_BODY_LIMIT, I as findActionableSilentDrops, It as resolveSkipPrefix, J as readConfigString, Jt as AssemblyReader, K as resolveExplicitPhysicalId, Kt as uploadCfnTemplate, L as CloudControlProvider, Lt as resolveStateBucketWithDefault, M as IAMRoleProvider, Mt as getLegacyStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as resolveApp, O as gray, Ot as getDockerImageBySourceHash, P as clearOnUpdateRemoval, Pt as resolveAutoAssetStorage, Q as describeTypeWithThrottleRetry, Qt as AwsClients, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefaultAndSource, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as buildDockerImage, T as formatResourceLine, Tt as runDockerForeground, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_URL_LIMIT, V as IntrinsicFunctionResolver, Vt as warnDeprecatedNoPrefixCliFlag, W as WAFv2WebACLProvider, Wt as MIGRATE_TMP_PREFIX, X as applyRoleArnIfSet, Y as requireConfigString, Yt as processStackMessages, Z as DiffCalculator, Zt as resolveBucketRegion, _ as createPreDeleteFinalSnapshot, _n as StackHasActiveImportsError, _t as ensureAssetStorage, a as DeploymentEventsStore, at as S3StateBackend, b as unsupportedFinalSnapshotError, bt as validateAssetBucketName, c as replayFailedOperations, cn as LocalMigrateError, ct as AssetPublisher, d as IMPLICIT_DELETE_DEPENDENCIES, dn as MissingCdkCliError, dt as buildAssetRedirectMap, en as resetAwsClients, et as isRetryableTransientError, f as computeImplicitDeleteEdges, fn as NestedStackChildDirectDestroyError, ft as createAssetRedirectResolver, g as ccRoutedFinalSnapshotError, gn as ResourceUpdateNotSupportedError, gt as BOOTSTRAP_MARKER_PREFIX, h as buildFinalSnapshotIdentifier, hn as ResourceTimeoutError, ht as AssetModeResolver, i as DeploymentEventsReader, it as LockManager, j as yellow, jt as getDefaultStateBucketName, k as green, kt as Synthesizer, l as replayRollback, ln as LocalStartServiceError, lt as stringifyValue, m as PRE_DELETE_SNAPSHOT_TYPES, mn as ProvisioningError, mt as rewriteTemplateAssetReferences, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as DagBuilder, o as planFailedOps, on as DeployCancelledError, ot as rebuildClientForBucketRegion, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as PartialFailureError, pt as loadPublishableAssetManifest, q as assertRegionMatch, qt as expectedOwnerParam, r as DeployEngine, rn as CdkdError, rt as TemplateParser, s as planRollback, sn as LocalInvokeBuildError$1, st as shouldRetainResource, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as setAwsClients, tt as isThrottlingError, u as withResourceDeadline, ut as WorkGraph, v as isFinalSnapshotError, vn as StackTerminationProtectionError, vt as getBootstrapMarkerKey, w as renderStatefulReason, wn as withErrorHandling, wt as getDockerCmd, x as extractDeploymentEventError, xt as validateContainerRepoName, y as refusesFinalSnapshot, yt as parseBootstrapMarker, z as disableInstanceApiTermination, zt as resolveUseCdkBootstrapAssets } from "./deploy-engine-Dp2u4Ktr.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DLlrKwbd.js";
+import { t as ASGProvider } from "./asg-provider-Cta08VYI.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -33886,6 +33886,8 @@ var GlueProvider = class {
 			result.StorageDescriptor = this.buildStorageDescriptor(sd);
 		}
 		if (tableInput["PartitionKeys"] !== void 0) result.PartitionKeys = tableInput["PartitionKeys"];
+		if (tableInput["TargetTable"] !== void 0) result.TargetTable = tableInput["TargetTable"];
+		if (tableInput["ViewDefinition"] !== void 0) result.ViewDefinition = tableInput["ViewDefinition"];
 		return result;
 	}
 	/**
@@ -33901,18 +33903,30 @@ var GlueProvider = class {
 		if (sd["NumberOfBuckets"] !== void 0) result.NumberOfBuckets = sd["NumberOfBuckets"];
 		if (sd["SerdeInfo"] !== void 0) {
 			const serde = sd["SerdeInfo"];
-			if (serde["Parameters"]) {
-				const params = serde["Parameters"];
-				const converted = {};
-				for (const [k, v] of Object.entries(params)) converted[k] = String(v);
-				serde["Parameters"] = converted;
-			}
-			result.SerdeInfo = serde;
+			if (serde["Parameters"]) result.SerdeInfo = {
+				...serde,
+				Parameters: stringifyParameterValues(serde["Parameters"])
+			};
+			else result.SerdeInfo = serde;
 		}
 		if (sd["BucketColumns"] !== void 0) result.BucketColumns = sd["BucketColumns"];
 		if (sd["SortColumns"] !== void 0) result.SortColumns = sd["SortColumns"];
 		if (sd["Parameters"] !== void 0) result.Parameters = sd["Parameters"];
 		if (sd["StoredAsSubDirectories"] !== void 0) result.StoredAsSubDirectories = sd["StoredAsSubDirectories"];
+		if (sd["SkewedInfo"] !== void 0) {
+			const skewed = asRecord(sd["SkewedInfo"]) ?? {};
+			result.SkewedInfo = skewed["SkewedColumnValueLocationMaps"] !== void 0 ? {
+				...skewed,
+				SkewedColumnValueLocationMaps: stringifyParameterValues(skewed["SkewedColumnValueLocationMaps"])
+			} : skewed;
+		}
+		if (sd["SchemaReference"] !== void 0) {
+			const schemaRef = asRecord(sd["SchemaReference"]) ?? {};
+			result.SchemaReference = schemaRef["SchemaVersionNumber"] !== void 0 ? {
+				...schemaRef,
+				SchemaVersionNumber: coerceNumber(schemaRef["SchemaVersionNumber"])
+			} : schemaRef;
+		}
 		return result;
 	}
 	/**
@@ -34843,7 +34857,9 @@ function buildJobCommonFields(p) {
 */
 function stringifyParameterValues(raw) {
 	const params = {};
-	for (const [k, v] of Object.entries(raw ?? {})) params[k] = String(v);
+	const source = asRecord(raw);
+	if (source === void 0) return params;
+	for (const [k, v] of Object.entries(source)) params[k] = String(v);
 	return params;
 }
 /**
@@ -49243,48 +49259,128 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 	}
 }
 /**
-* Build the `newProperties` object passed to `provider.update` during
-* `--revert`. Strategy:
+* A top-level property NAME that carries tags.
 *
-*   1. Start from `awsProperties` (the AWS-current snapshot returned
-*      by `readCurrentState`, which `runRevert` already passes as the
-*      `previousProperties` argument to `provider.update`).
-*   2. For every top-level key whose subtree contains a drifted path,
-*      overwrite it with the corresponding sub-shape from
-*      `desiredProperties` (the state-recorded `observedProperties`).
+* The shape test below is deliberately NOT sufficient on its own: a top-level
+* `[{ Key, Value }]` list is not tag-exclusive — `LoadBalancerAttributes`,
+* `TargetGroupAttributes` and SSM `Association.Targets` all match it. No such
+* property can carry an `aws:`-prefixed or `AmazonECSManaged` key today, so the
+* carve-out would degrade to the identity of the old wholesale overwrite there
+* — but borrowing `canonicalizeTagListsDeep`'s heuristic for a WRITE decision
+* is not justified by its use for a SORT: a sort false positive is harmless, an
+* append is not.
+*/
+function isTagListKey(key) {
+	return key === "Tags" || key.endsWith("Tags");
+}
+/** A CFn-shaped tag list: a non-empty array whose every element has a string `Key`. */
+function isCfnTagList(value) {
+	return Array.isArray(value) && value.length > 0 && value.every((t) => isPlainRecord(t) && typeof t.Key === "string");
+}
+/** The `Key` of every entry in a CFn tag list, in list order. */
+function tagKeys(tags) {
+	return tags.map((t) => t["Key"]);
+}
+/**
+* AWS-SERVICE-authored tag keys a `--revert` must not strip (issue #1501).
 *
-* Why "AWS-current base + drifted overlay" instead of "drifted-only
-* partial":
+* `AmazonECSManaged` is attached by ECS when a capacity provider binds an Auto
+* Scaling group, and managed scaling stops working without it. That entry is
+* the load-bearing one.
 *
-*   Several providers' `update()` implementations diff
-*   `newProperties[K]` against `previousProperties[K]` and treat
-*   `newVal === undefined` as "remove K from AWS" (e.g.
-*   `SNSTopicProvider` calls `SetTopicAttributes(K, '')`,
-*   `IAMRoleProvider.updateManagedPolicies` detaches every previously
-*   attached policy when the new arg is undefined). Passing a
-*   drifted-only partial would silently clear non-drifted attributes
-*   on those providers. Sending the AWS-current value back as the
-*   "new" value for non-drifted keys keeps `JSON.stringify(newVal) ===
-*   JSON.stringify(oldVal)` so the diff is a no-op — no provider
-*   changes required.
+* The `aws:` prefix is DEFENSIVE rather than load-bearing, and the distinction
+* is worth stating: AWS reserves the prefix and rejects a write of one, and the
+* 45 providers that route reads through `normalizeAwsTagsToCfn` strip such keys
+* on the way in — so an `aws:` key can only reach the AWS side of a comparison
+* via the Cloud Control `readCurrentState` path, which returns the raw model.
+* It costs nothing to honor and cdkd can never have authored one.
+*/
+const SERVICE_MANAGED_TAG_KEYS = /* @__PURE__ */ new Set(["AmazonECSManaged"]);
+/** Whether a tag key is AWS-service-authored, per {@link SERVICE_MANAGED_TAG_KEYS}. */
+function isServiceManagedTagKey(key) {
+	return SERVICE_MANAGED_TAG_KEYS.has(key) || key.startsWith("aws:");
+}
+/**
+* Revert a TAG LIST, preserving AWS-SERVICE-authored entries (issue #1501).
 *
-*   For non-diff providers (e.g. `SQSQueueProvider` blindly pushes
-*   every defined key via `SetQueueAttributes`), the AWS-current
-*   value still gets serialised back to the same string AWS already
-*   has, so the round-trip is a no-op for the AWS resource state.
-*   The one exception is `readCurrentState`'s always-emit
-*   placeholder values — e.g. SQS `RedrivePolicy: {}` — which AWS
-*   rejects as invalid input even though they're round-tripped. That
-*   class of value (Class 2 / structurally-incomplete-when-empty) is
-*   handled by per-provider sanitize at the wire-layer; see the SQS
-*   provider's `serializeRedrivePolicy` helper for the canonical
-*   pattern.
+* Everything in {@link buildRevertNewProperties} overwrites a drifted top-level
+* key wholesale, which for `Tags` means "AWS ends up with exactly the tags cdkd
+* state recorded" — so a service-authored tag added after deploy is stripped.
+* The concrete case: ECS attaches `AmazonECSManaged` to an ASG when a capacity
+* provider binds it, and that tag is REQUIRED for managed scaling. Because any
+* CDK ASG declares at least a `Name` tag, `Tags` is template-DECLARED, so the
+* #1498 carve-out (undeclared + captured-empty) correctly does not apply — and
+* the tag list is an ARRAY, which {@link findRevertDroppedAwsKeys}'s walk
+* compares wholesale and never descends into. Post-revert the ASG kept the
+* capacity provider with its managed scaling silently broken (verified live
+* 2026-08-10).
 *
-* The drift comparator never produces array-index segments
-* (`Tags[0].Value`) — array drifts surface as a single entry on the
-* parent path — so `path.split('.', 1)` is always safe to extract the
-* top-level key.
+* The semantic: the baseline still WINS for every ordinary tag — one it has and
+* AWS lost is re-added, one whose value differs is reset, and a
+* user/console-added tag AWS alone has is still REMOVED. Only a
+* {@link isServiceManagedTagKey} entry survives.
+*
+* **This is the issue's option 2, not its option 1, and the choice was settled
+* by a live test rather than by taste.** Option 1 (revert the whole tag list as
+* a diff, so ANY out-of-band add survives) was implemented first and failed the
+* `drift-revert` integ at its final assertion: that fixture injects an
+* `IntegInjected` tag and requires `--revert` to strip it, i.e. "revert removes
+* a console-added tag" is an established contract with a test behind it.
+* Option 1 would redefine revert semantics for a whole property class — which
+* is exactly the design pass the issue said it needed — so the narrow safeguard
+* ships instead, fixing the reported breakage while leaving ordinary tag revert
+* untouched.
+*
+* Scope: TOP-LEVEL tag lists, which is where `buildRevertNewProperties`
+* operates. A tag list nested inside another property (an EC2 launch template's
+* `TagSpecifications`) still reverts wholesale.
+*
+* Order: baseline entries first in baseline order, then the preserved
+* service-managed entries. Providers apply tags as a set and the drift
+* comparator canonicalizes tag-list order on both sides
+* (`drift-normalize.ts`), so the order is for readability / determinism only.
 */
+function mergeTagListForRevert(baselineTags, awsTags) {
+	const baselineKeys = new Set(tagKeys(baselineTags));
+	const seen = /* @__PURE__ */ new Set();
+	const preserved = awsTags.filter((t) => {
+		const key = t["Key"];
+		if (baselineKeys.has(key) || !isServiceManagedTagKey(key) || seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+	return [...baselineTags, ...preserved];
+}
+/**
+* The AWS-service-authored tag keys a `--revert` will PRESERVE rather than
+* strip, i.e. those present on the AWS side of a drifted top-level tag list,
+* absent from the revert baseline, and {@link isServiceManagedTagKey} (issue
+* #1501).
+*
+* Reported in the plan so the carve-out of {@link mergeTagListForRevert} is
+* visible BEFORE the confirmation prompt: a user who did want the tag gone
+* learns here that the revert will not do it.
+*
+* @returns dotted `<Key>.<TagKey>` paths, sorted, e.g. `['Tags.AmazonECSManaged']`.
+*/
+function findRevertPreservedTagKeys(drifts, desiredProperties, awsProperties) {
+	const preserved = /* @__PURE__ */ new Set();
+	const driftedTopLevelKeys = /* @__PURE__ */ new Set();
+	for (const d of drifts) {
+		const topLevelKey = d.path.split(".", 1)[0];
+		if (topLevelKey) driftedTopLevelKeys.add(topLevelKey);
+	}
+	for (const key of driftedTopLevelKeys) {
+		if (!(key in desiredProperties)) continue;
+		if (!isTagListKey(key)) continue;
+		const desiredValue = desiredProperties[key];
+		const awsValue = awsProperties[key];
+		if (!(isCfnTagList(desiredValue) || Array.isArray(desiredValue) && desiredValue.length === 0) || !isCfnTagList(awsValue)) continue;
+		const baselineKeys = new Set(tagKeys(desiredValue));
+		for (const tagKey of tagKeys(awsValue)) if (!baselineKeys.has(tagKey) && isServiceManagedTagKey(tagKey)) preserved.add(`${key}.${tagKey}`);
+	}
+	return [...preserved].sort();
+}
 /**
 * The AWS-authored property paths a `--revert` is about to DROP, for a
 * resource whose state predates observed-capture (issue #1478).
@@ -49361,12 +49457,60 @@ function collectMissingPaths(awsValue, desiredValue, path, out) {
 function isPlainRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/**
+* Build the `newProperties` object passed to `provider.update` during
+* `--revert`. Strategy:
+*
+*   1. Start from `awsProperties` (the AWS-current snapshot returned
+*      by `readCurrentState`, which `runRevert` already passes as the
+*      `previousProperties` argument to `provider.update`).
+*   2. For every top-level key whose subtree contains a drifted path,
+*      overwrite it with the corresponding sub-shape from
+*      `desiredProperties` (the state-recorded `observedProperties`).
+*
+* Why "AWS-current base + drifted overlay" instead of "drifted-only
+* partial":
+*
+*   Several providers' `update()` implementations diff
+*   `newProperties[K]` against `previousProperties[K]` and treat
+*   `newVal === undefined` as "remove K from AWS" (e.g.
+*   `SNSTopicProvider` calls `SetTopicAttributes(K, '')`,
+*   `IAMRoleProvider.updateManagedPolicies` detaches every previously
+*   attached policy when the new arg is undefined). Passing a
+*   drifted-only partial would silently clear non-drifted attributes
+*   on those providers. Sending the AWS-current value back as the
+*   "new" value for non-drifted keys keeps `JSON.stringify(newVal) ===
+*   JSON.stringify(oldVal)` so the diff is a no-op — no provider
+*   changes required.
+*
+*   For non-diff providers (e.g. `SQSQueueProvider` blindly pushes
+*   every defined key via `SetQueueAttributes`), the AWS-current
+*   value still gets serialised back to the same string AWS already
+*   has, so the round-trip is a no-op for the AWS resource state.
+*   The one exception is `readCurrentState`'s always-emit
+*   placeholder values — e.g. SQS `RedrivePolicy: {}` — which AWS
+*   rejects as invalid input even though they're round-tripped. That
+*   class of value (Class 2 / structurally-incomplete-when-empty) is
+*   handled by per-provider sanitize at the wire-layer; see the SQS
+*   provider's `serializeRedrivePolicy` helper for the canonical
+*   pattern.
+*
+* The drift comparator never produces array-index segments
+* (`Tags[0].Value`) — array drifts surface as a single entry on the
+* parent path — so `path.split('.', 1)` is always safe to extract the
+* top-level key.
+*/
 function buildRevertNewProperties(drifts, desiredProperties, awsProperties) {
 	const result = { ...awsProperties };
 	for (const d of drifts) {
 		const topLevelKey = d.path.split(".", 1)[0];
 		if (!topLevelKey) continue;
-		if (topLevelKey in desiredProperties) result[topLevelKey] = desiredProperties[topLevelKey];
+		if (topLevelKey in desiredProperties) {
+			const desiredValue = desiredProperties[topLevelKey];
+			const awsValue = awsProperties[topLevelKey];
+			const baselineIsTagList = isCfnTagList(desiredValue) || Array.isArray(desiredValue) && desiredValue.length === 0;
+			result[topLevelKey] = isTagListKey(topLevelKey) && baselineIsTagList && isCfnTagList(awsValue) ? mergeTagListForRevert(desiredValue, awsValue) : desiredValue;
+		}
 	}
 	return result;
 }
@@ -49489,6 +49633,15 @@ function printRevertPlan(reports) {
 			process.stdout.write(`  → provider.update on ${o.logicalId} (${o.resourceType}): revert ${o.changes.length} ${word}\n`);
 			for (const change of o.changes) process.stdout.write(`    ${change.path}: ${formatScalar(change.awsValue)} -> ${formatScalar(change.stateValue)}\n`);
 			const stateResource = report.state.resources[o.logicalId];
+			if (stateResource) {
+				const preserved = findRevertPreservedTagKeys(o.changes, stateResource.observedProperties ?? stateResource.properties ?? {}, o.awsProperties);
+				if (preserved.length > 0) {
+					const tagWord = preserved.length === 1 ? "tag" : "tags";
+					process.stdout.write(`    ! reverting this tag list KEEPS ${preserved.length} AWS-authored ${tagWord} the baseline does not carry:\n`);
+					for (const path of preserved) process.stdout.write(`        ${path}\n`);
+					process.stdout.write("      Every other tag reverts normally. A service may require these (ECS needs AmazonECSManaged for managed scaling); 'aws:'-prefixed keys are AWS-reserved and cannot be removed by hand.\n");
+				}
+			}
 			if (stateResource && stateResource.observedProperties === void 0) {
 				const dropped = findRevertDroppedAwsKeys(o.changes, stateResource.properties ?? {}, o.awsProperties);
 				if (dropped.length > 0) {
@@ -66447,7 +66600,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.32");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.34");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;