@go-to-k/cdkd 0.278.46 → 0.278.47

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-BIqcmiVb.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-B8i-yWiB.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BauyF7RU.js";
+import { t as ASGProvider } from "./asg-provider-CLULpXoZ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -30452,8 +30452,8 @@ var Route53Provider = class {
 				Id: physicalId,
 				Comment: comment
 			}));
-			await this.applyHostedZoneTags(physicalId, properties, logicalId);
-			await this.applyQueryLoggingConfig(physicalId, properties, logicalId);
+			await this.applyHostedZoneTags(physicalId, properties, logicalId, previousProperties);
+			await this.applyQueryLoggingConfig(physicalId, properties, logicalId, previousProperties);
 			await this.syncVPCAssociations(physicalId, properties, logicalId);
 			const prevEnabled = previousProperties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED";
 			const nextEnabled = properties["HostedZoneFeatures"]?.["AcceleratedRecoveryStatus"] === "ENABLED";
@@ -30472,6 +30472,7 @@ var Route53Provider = class {
 				}
 			};
 		} catch (error) {
+			if (error instanceof CdkdError) throw error;
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to update hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
@@ -30796,34 +30797,95 @@ var Route53Provider = class {
 	/**
 	* Apply tags to a hosted zone using ChangeTagsForResource.
 	* CFn property: HostedZoneTags (array of {Key, Value}).
-	*/
-	async applyHostedZoneTags(zoneId, properties, logicalId) {
-		const tags = properties["HostedZoneTags"];
-		if (!tags || !Array.isArray(tags) || tags.length === 0) return;
+	*
+	* `previousProperties` is passed on the UPDATE path only, and turns this
+	* from an add-only apply into a real DIFF (issue #1160). Without it a tag
+	* removed from the template stayed on the zone forever — the add-only shape
+	* has no way to express a removal, and the `length === 0` early return made
+	* clearing ALL tags a silent no-op. `ChangeTagsForResource` takes
+	* `RemoveTagKeys` alongside `AddTags` in ONE call, and CloudFormation does
+	* untag a removed tag (live A/B, 2026-08-10), so the previous-minus-desired
+	* key set is sent as removals. Create keeps passing `undefined` — there is
+	* nothing to remove from a zone that did not exist a moment ago.
+	*/
+	async applyHostedZoneTags(zoneId, properties, logicalId, previousProperties) {
+		const desiredRaw = properties["HostedZoneTags"];
+		if (desiredRaw != null && !Array.isArray(desiredRaw)) {
+			this.logger.warn(`AWS::Route53::HostedZone HostedZoneTags must be an array on ${logicalId}; ignoring it and leaving the live tags untouched (no tag is added or removed)`);
+			return;
+		}
+		const tags = this.readHostedZoneTags(properties);
+		if (Array.isArray(desiredRaw) && tags.length !== desiredRaw.length) {
+			this.logger.warn(`AWS::Route53::HostedZone HostedZoneTags on ${logicalId} carries ${desiredRaw.length - tags.length} entr(y|ies) with a non-string Key or Value (check for an unresolved intrinsic); leaving the live tags untouched rather than applying a partial set or removing the tags those entries name`);
+			return;
+		}
+		const previousTags = previousProperties ? this.readHostedZoneTags(previousProperties) : void 0;
+		const desiredKeys = new Set(tags.map((t) => t.Key));
+		const removeTagKeys = [...new Set((previousTags ?? []).map((t) => t.Key).filter((key) => key.length > 0 && !desiredKeys.has(key)))];
+		if (tags.length === 0 && removeTagKeys.length === 0) return;
 		try {
 			await this.getClient().send(new ChangeTagsForResourceCommand({
 				ResourceType: "hostedzone",
 				ResourceId: zoneId,
-				AddTags: tags.map((t) => ({
+				...tags.length > 0 && { AddTags: tags.map((t) => ({
 					Key: t.Key,
 					Value: t.Value
-				}))
+				})) },
+				...removeTagKeys.length > 0 && { RemoveTagKeys: removeTagKeys }
 			}));
-			this.logger.debug(`Applied ${tags.length} tag(s) to hosted zone ${logicalId}`);
+			this.logger.debug(`Applied ${tags.length} tag(s) and removed ${removeTagKeys.length} tag(s) on hosted zone ${logicalId}`);
 		} catch (error) {
-			this.logger.warn(`Failed to apply tags to hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			const detail = error instanceof Error ? error.message : String(error);
+			if (removeTagKeys.length > 0) throw new ProvisioningError(`Failed to remove tag(s) ${removeTagKeys.join(", ")} from hosted zone ${logicalId}: ${detail}. The removal will NOT be retried on the next deploy (state no longer records the tag), so it is reported instead of ignored.`, "AWS::Route53::HostedZone", logicalId, zoneId, error instanceof Error ? error : void 0);
+			this.logger.warn(`Failed to apply tags to hosted zone ${logicalId}: ${detail}`);
 		}
 	}
 	/**
+	* Read `HostedZoneTags` off a property bag, dropping entries whose shape an
+	* unresolved intrinsic or a hand-authored L1 made unusable. Returns a
+	* possibly-SHORTER list rather than throwing — the caller compares the length
+	* against the raw input to decide whether the read was lossy, and only the
+	* DESIRED side treats a lossy read as a refusal. The previous (state-borne)
+	* side stays permissive: a record an older binary wrote must not block an
+	* ordinary update, which a rollback replay could not then edit its way out of.
+	*
+	* `Value` is validated as well as `Key`. Route 53 rejects a tag whose value
+	* is absent or non-string, and because Add and Remove ride the SAME
+	* `ChangeTagsForResource` call, one bad value would fail the whole request —
+	* silently taking the REMOVALS down with it.
+	*/
+	readHostedZoneTags(properties) {
+		const tags = properties["HostedZoneTags"];
+		if (!Array.isArray(tags)) return [];
+		return tags.filter((t) => {
+			if (typeof t !== "object" || t === null) return false;
+			const entry = t;
+			return typeof entry.Key === "string" && typeof entry.Value === "string";
+		});
+	}
+	/**
 	* Apply QueryLoggingConfig to a hosted zone.
 	* CFn property: QueryLoggingConfig ({ CloudWatchLogsLogGroupArn }).
 	* Only one query logging config per hosted zone is allowed.
 	*/
-	async applyQueryLoggingConfig(zoneId, properties, logicalId) {
-		const queryLoggingConfig = properties["QueryLoggingConfig"];
-		if (!queryLoggingConfig) return;
-		const cloudWatchLogsLogGroupArn = queryLoggingConfig["CloudWatchLogsLogGroupArn"];
-		if (!cloudWatchLogsLogGroupArn) return;
+	async applyQueryLoggingConfig(zoneId, properties, logicalId, previousProperties) {
+		const cloudWatchLogsLogGroupArn = this.readQueryLogGroupArn(properties);
+		const desiredBlock = properties["QueryLoggingConfig"];
+		const desiredBlockIsObject = typeof desiredBlock === "object" && desiredBlock !== null && !Array.isArray(desiredBlock);
+		const desiredArnPresent = desiredBlockIsObject && desiredBlock["CloudWatchLogsLogGroupArn"] !== void 0;
+		if (cloudWatchLogsLogGroupArn === void 0 && desiredBlock != null && (!desiredBlockIsObject || desiredArnPresent)) {
+			this.logger.warn(`AWS::Route53::HostedZone QueryLoggingConfig on ${logicalId} carries no usable CloudWatchLogsLogGroupArn; leaving the live query logging config untouched (omit the block entirely to delete it)`);
+			return;
+		}
+		if (cloudWatchLogsLogGroupArn === void 0) {
+			if (previousProperties !== void 0 && this.readQueryLogGroupArn(previousProperties)) {
+				this.logger.debug(`QueryLoggingConfig removed from template for hosted zone ${logicalId}; deleting the live config`);
+				await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
+				const remaining = await this.listQueryLoggingConfigIds(zoneId);
+				if (remaining.length > 0) throw new ProvisioningError(`QueryLoggingConfig was removed from the template for hosted zone ${logicalId} but the live config (${remaining.join(", ")}) is still present. The removal will NOT be retried on the next deploy (state no longer records the property), so it is reported instead of ignored.`, "AWS::Route53::HostedZone", logicalId, zoneId);
+			}
+			return;
+		}
 		try {
 			await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
 			await this.getClient().send(new CreateQueryLoggingConfigCommand({
@@ -30840,6 +30902,36 @@ var Route53Provider = class {
 		}
 	}
 	/**
+	* Read `QueryLoggingConfig.CloudWatchLogsLogGroupArn` off a property bag,
+	* returning `undefined` for an absent block, a malformed container, or a
+	* blank / non-string ARN. One helper so the DESIRED and PREVIOUS sides
+	* cannot classify the same shape differently — an asymmetry there would
+	* make a removal fire (or not) depending on which side was malformed.
+	*/
+	readQueryLogGroupArn(properties) {
+		const config = properties["QueryLoggingConfig"];
+		if (typeof config !== "object" || config === null || Array.isArray(config)) return void 0;
+		const arn = config["CloudWatchLogsLogGroupArn"];
+		return typeof arn === "string" && arn.length > 0 ? arn : void 0;
+	}
+	/**
+	* List the live query-logging config ids for a hosted zone.
+	*
+	* Used by the REMOVAL path to VERIFY the delete landed, because
+	* `deleteQueryLoggingConfigForZone` deliberately swallows its failures and a
+	* swallowed removal is permanent (see the call site). A zone that has gone
+	* away counts as "no config", so the NotFound shapes resolve to `[]` rather
+	* than failing the deploy on a resource that is already absent.
+	*/
+	async listQueryLoggingConfigIds(zoneId) {
+		try {
+			return ((await this.getClient().send(new ListQueryLoggingConfigsCommand({ HostedZoneId: zoneId }))).QueryLoggingConfigs ?? []).map((config) => config.Id).filter((id) => typeof id === "string");
+		} catch (error) {
+			if (error instanceof Error && (error.name === "NoSuchHostedZone" || error.name === "NoSuchQueryLoggingConfig")) return [];
+			throw error;
+		}
+	}
+	/**
 	* Delete query logging config(s) for a hosted zone.
 	*/
 	async deleteQueryLoggingConfigForZone(zoneId, logicalId) {
@@ -67472,7 +67564,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.46");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.47");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;