@go-to-k/cdkd 0.280.42 → 0.280.44

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-CuwZzHlM.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-nEjymkij.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-a9iV8VG_.js";
+import { t as ASGProvider } from "./asg-provider-BBKdxCVP.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -33013,6 +33013,102 @@ function isZoneDisabledForMutationError(error) {
 	return error instanceof Error && error.message.includes("is marked disabled for mutation");
 }
 /**
+* A `HostedZoneName` that resolved cleanly but matches no zone.
+*
+* Distinct from "no zone was specified": the DELETE path treats a vanished
+* zone as already-gone (the zone's records went with it) rather than surfacing
+* a misconfiguration error that would block `cdkd destroy`.
+*/
+var HostedZoneNameNotFoundError = class HostedZoneNameNotFoundError extends ProvisioningError {
+	constructor(message, resourceType, logicalId, physicalId, cause) {
+		super(message, resourceType, logicalId, physicalId, cause);
+		this.name = "HostedZoneNameNotFoundError";
+		Object.setPrototypeOf(this, HostedZoneNameNotFoundError.prototype);
+	}
+};
+/** Segment count of cdkd's `AWS::Route53::RecordSet` composite physicalId. */
+const RECORD_SET_COMPOSITE_SEGMENTS = 3;
+/**
+* Parse cdkd's composite record-set physicalId `<hostedZoneId>|<Name>|<Type>`.
+*
+* Returns `undefined` for anything else — most importantly CloudFormation's
+* OWN physicalId for this type, which is the record name alone (`Ref` on an
+* `AWS::Route53::RecordSet` returns the domain name, and a DNS name can never
+* contain `|`). `cdkd import` stored that scalar verbatim before issue #1658,
+* so state files in the wild carry BOTH shapes and every consumer has to know
+* which one it is holding.
+*/
+function parseRecordSetCompositeId(physicalId) {
+	const parts = physicalId.split("|");
+	if (parts.length !== RECORD_SET_COMPOSITE_SEGMENTS) return void 0;
+	const [hostedZoneId, name, type] = parts;
+	if (!hostedZoneId || !name || !type) return void 0;
+	return {
+		hostedZoneId,
+		name,
+		type
+	};
+}
+/**
+* Octal escapes that must NOT be decoded, because decoding them is not
+* injective — two genuinely different names would compare EQUAL:
+*
+* - `056` is a period INSIDE a label. Route 53 reports the single-label
+*   record `a.b` (period escaped) as `a\\056b.example.com.`, which decodes to
+*   `a.b.example.com.` — identical to the different, two-label record
+*   `a.b.example.com`.
+* - `134` is a literal backslash, which would re-introduce escape ambiguity.
+*
+* A false MATCH is far worse than a false miss here: the compare drives which
+* record `readCurrentState` reports and which hosted zone `create` picks, so
+* collapsing two records would target the wrong one.
+*/
+const UNDECODABLE_OCTAL_ESCAPES = /* @__PURE__ */ new Set(["056", "134"]);
+/**
+* Canonicalize a record name for comparison.
+*
+* Two AWS-side spellings have to be absorbed, and missing either one makes
+* `readCurrentState` return `undefined` — which reads as "drift unknown"
+* rather than as an error:
+*
+* - Route 53 reports every name fully qualified with a TRAILING DOT, while a
+*   template may declare it either way.
+* - Special characters come back OCTAL-ESCAPED: `*.example.com` is reported as
+*   `\\052.example.com.`. That affects every wildcard record, including ones
+*   cdkd created itself, so decoding it here fixes drift for the whole
+*   population rather than only the imported ones.
+*
+* Known bound: Route 53 escapes per BYTE, so a non-ASCII name decodes to
+* latin-1 mojibake and will not match its template spelling. That is a false
+* MISS (drift unknown), never a false match, and CDK emits punycode for
+* internationalized names in practice.
+*/
+function normalizeRecordName(name) {
+	const lowered = name.replace(/\\([0-7]{3})/g, (match, oct) => UNDECODABLE_OCTAL_ESCAPES.has(oct) ? match : String.fromCharCode(parseInt(oct, 8))).toLowerCase();
+	return lowered.endsWith(".") ? lowered : `${lowered}.`;
+}
+/**
+* Canonicalize a name for the QUERY side of a Route 53 list call.
+*
+* `normalizeRecordName` above is the COMPARE-side canonicalizer, and the two
+* are deliberately NOT the same function. Route 53 orders both hosted zones
+* and record sets by reversed labels of the name it STORES — lower-cased and
+* escape-ENCODED — and a `DNSName` / `StartRecordName` start key in any other
+* spelling positions the window somewhere else entirely. So the query side
+* must move TOWARD AWS's spelling (lower-case, encode `*`), where the compare
+* side moves AWS's answer toward the template's (decode escapes).
+*
+* Decoding here would be actively wrong: `*.example.com` sorts at `*` (0x2A)
+* while AWS stores `\052.example.com` and sorts it at `\` (0x5C), so every
+* name whose first label begins with `-` / `+` / a digit / an upper-case
+* letter falls BETWEEN them — with a bounded page, the wildcard record we
+* asked for is skipped straight past.
+*/
+function canonicalizeQueryName(name) {
+	const lowered = name.toLowerCase().replaceAll("*", "\\052");
+	return lowered.endsWith(".") ? lowered : `${lowered}.`;
+}
+/**
 * AWS Route 53 Provider
 *
 * Implements resource provisioning for Route 53 resources:
@@ -33351,10 +33447,20 @@ var Route53Provider = class {
 	}
 	async deleteRecordSet(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Route 53 record set ${logicalId}: ${physicalId}`);
-		const parts = physicalId.split("|");
-		if (parts.length !== 3) throw new ProvisioningError(`Invalid record set physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
-		const [hostedZoneId] = parts;
 		if (!properties) throw new ProvisioningError(`Properties required to delete record set ${logicalId}`, resourceType, logicalId, physicalId);
+		const composite = parseRecordSetCompositeId(physicalId);
+		let hostedZoneId;
+		if (composite) hostedZoneId = composite.hostedZoneId;
+		else try {
+			hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType, physicalId, { requireUnambiguousZoneName: true });
+		} catch (error) {
+			if (error instanceof HostedZoneNameNotFoundError) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.warn(`Hosted zone "${String(properties?.["HostedZoneName"])}" for record set ${logicalId} (${physicalId}) no longer exists; treating the record as already deleted and dropping it from state.`);
+				return;
+			}
+			throw error;
+		}
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const sendDelete = () => this.getClient().send(new ChangeResourceRecordSetsCommand({
@@ -33702,22 +33808,65 @@ var Route53Provider = class {
 	* If HostedZoneId is provided, use it directly.
 	* If HostedZoneName is provided, resolve it to a HostedZoneId via ListHostedZonesByName.
 	*/
-	async resolveHostedZoneId(properties, logicalId, resourceType, physicalId) {
+	async resolveHostedZoneId(properties, logicalId, resourceType, physicalId, options) {
 		const hostedZoneId = properties["HostedZoneId"];
-		if (hostedZoneId) return hostedZoneId;
+		if (typeof hostedZoneId === "string" && hostedZoneId) return hostedZoneId;
+		let lookupErrorMessage;
+		let lookupErrorCause;
 		const hostedZoneName = properties["HostedZoneName"];
-		if (hostedZoneName) try {
-			const zones = (await this.getClient().send(new ListHostedZonesByNameCommand({
-				DNSName: hostedZoneName,
-				MaxItems: 1
-			}))).HostedZones ?? [];
-			const normalizedName = hostedZoneName.endsWith(".") ? hostedZoneName : `${hostedZoneName}.`;
-			const matchedZone = zones.find((z) => z.Name === normalizedName);
+		if (typeof hostedZoneName === "string" && hostedZoneName) {
+			let matched = [];
+			let absenceIsSound = false;
+			try {
+				const response = await this.getClient().send(new ListHostedZonesByNameCommand({
+					DNSName: canonicalizeQueryName(hostedZoneName),
+					MaxItems: 5
+				}));
+				const zones = response.HostedZones ?? [];
+				const normalizedName = normalizeRecordName(hostedZoneName);
+				matched = zones.filter((z) => normalizeRecordName(z.Name ?? "") === normalizedName);
+				absenceIsSound = !hostedZoneName.includes("\\") && (zones.length > 0 || response.IsTruncated !== true);
+			} catch (error) {
+				lookupErrorMessage = error instanceof Error ? error.message : String(error);
+				lookupErrorCause = error instanceof Error ? error : void 0;
+				this.logger.warn(`Failed to resolve HostedZoneName "${hostedZoneName}" for ${logicalId}: ${lookupErrorMessage}`);
+			}
+			if (matched.length > 1 && options?.requireUnambiguousZoneName) throw new ProvisioningError(`HostedZoneName "${hostedZoneName}" matches ${matched.length} hosted zones for ${logicalId} (split-horizon public/private DNS). Refusing to guess which one this record belongs to — set HostedZoneId explicitly, or pass the '<zoneId>|<name>|<type>' composite via --resource.`, resourceType, logicalId, physicalId);
+			const matchedZone = matched[0];
 			if (matchedZone?.Id) return matchedZone.Id.replace("/hostedzone/", "");
-		} catch (error) {
-			this.logger.warn(`Failed to resolve HostedZoneName "${hostedZoneName}" for ${logicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			if (absenceIsSound) throw new HostedZoneNameNotFoundError(`HostedZoneName "${hostedZoneName}" matches no hosted zone in this account/region for ${logicalId}`, resourceType, logicalId, physicalId);
+		}
+		throw new ProvisioningError(lookupErrorMessage ? `Could not resolve HostedZoneName "${String(hostedZoneName)}" for record set ${logicalId}: ${lookupErrorMessage}` : `Either HostedZoneId or HostedZoneName is required for record set ${logicalId}`, resourceType, logicalId, physicalId, lookupErrorCause);
+	}
+	/**
+	* Recover `(hostedZoneId, name, type)` for a record set from EITHER shape of
+	* physicalId (issue #1658).
+	*
+	* cdkd's own composite carries all three. CloudFormation's physicalId is the
+	* record name alone, so the zone has to be resolved from the recorded
+	* properties — which is exactly what `createRecordSet` does, so the answer is
+	* the same triple the composite would have held. Returns `undefined` (rather
+	* than throwing) when the zone cannot be resolved, because both callers of
+	* this helper treat "cannot determine" as "nothing to report" rather than as
+	* a failure.
+	*/
+	async resolveRecordSetIdentity(physicalId, properties, options) {
+		const composite = parseRecordSetCompositeId(physicalId);
+		if (composite) return composite;
+		if (!properties) return void 0;
+		const name = typeof properties["Name"] === "string" ? properties["Name"] : physicalId;
+		const type = properties["Type"];
+		if (!name || typeof type !== "string" || !type) return void 0;
+		try {
+			return {
+				hostedZoneId: await this.resolveHostedZoneId(properties, "RecordSet", "AWS::Route53::RecordSet", physicalId, options),
+				name,
+				type
+			};
+		} catch (err) {
+			this.logger.debug(`Cannot resolve record-set identity for '${physicalId}': ${err instanceof Error ? err.message : String(err)}`);
+			return;
 		}
-		throw new ProvisioningError(`Either HostedZoneId or HostedZoneName is required for record set ${logicalId}`, resourceType, logicalId, physicalId);
 	}
 	/**
 	* Read the AWS-current Route 53 resource configuration in CFn-property shape.
@@ -33733,17 +33882,21 @@ var Route53Provider = class {
 	*    `CloudWatchLogsLogGroupArn` to match cdkd state).
 	*  - `RecordSet` → `ListResourceRecordSets` filtered to the exact
 	*    `(name, type)` pair from the composite physicalId
-	*    (`{zoneId}|{name}|{type}`). Surfaces TTL, ResourceRecords (with
+	*    (`{zoneId}|{name}|{type}`), or — for a state record carrying
+	*    CloudFormation's scalar physicalId, written by `cdkd import`
+	*    before issue #1658 — from the recorded properties, so drift is
+	*    reported for those records instead of silently skipped.
+	*    Surfaces TTL, ResourceRecords (with
 	*    `[{Value}]` -> string[] re-shape to match cdkd state), AliasTarget,
 	*    Weight, Region, Failover, MultiValueAnswer, HealthCheckId,
 	*    GeoLocation, GeoProximityLocation, CidrRoutingConfig, SetIdentifier.
 	*
 	* Returns `undefined` when the parent zone is gone (`NoSuchHostedZone`).
 	*/
-	async readCurrentState(physicalId, _logicalId, resourceType) {
+	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::Route53::HostedZone": return this.readHostedZone(physicalId);
-			case "AWS::Route53::RecordSet": return this.readRecordSet(physicalId);
+			case "AWS::Route53::RecordSet": return this.readRecordSet(physicalId, properties);
 			default: return;
 		}
 	}
@@ -33789,24 +33942,24 @@ var Route53Provider = class {
 		}
 		return result;
 	}
-	async readRecordSet(physicalId) {
-		const parts = physicalId.split("|");
-		if (parts.length < 3) return void 0;
-		const [hostedZoneId, name, type] = parts;
-		if (!hostedZoneId || !name || !type) return void 0;
+	async readRecordSet(physicalId, properties) {
+		const identity = await this.resolveRecordSetIdentity(physicalId, properties);
+		if (!identity) return void 0;
+		const { hostedZoneId, name, type } = identity;
 		let resp;
 		try {
 			resp = await this.getClient().send(new ListResourceRecordSetsCommand({
 				HostedZoneId: hostedZoneId,
-				StartRecordName: name,
+				StartRecordName: canonicalizeQueryName(name),
 				StartRecordType: type,
-				MaxItems: 1
+				MaxItems: 5
 			}));
 		} catch (err) {
 			if (err instanceof Error && err.name === "NoSuchHostedZone") return void 0;
 			throw err;
 		}
-		const recordSet = resp.ResourceRecordSets?.find((r) => r.Name === name && r.Type === type);
+		const wantedName = normalizeRecordName(name);
+		const recordSet = resp.ResourceRecordSets?.find((r) => r.Name !== void 0 && normalizeRecordName(r.Name) === wantedName && r.Type === type);
 		if (!recordSet) return void 0;
 		const result = {
 			HostedZoneId: hostedZoneId,
@@ -33861,23 +34014,89 @@ var Route53Provider = class {
 	/**
 	* Adopt an existing Route 53 resource into cdkd state.
 	*
-	* Supported types: `AWS::Route53::HostedZone` (full tag-based
-	* lookup); `AWS::Route53::RecordSet` (override-only — RecordSets are
-	* not taggable, and the composite child-of-zone identity makes auto
-	* lookup impractical).
+	* Supported types: `AWS::Route53::HostedZone` (override-only);
+	* `AWS::Route53::RecordSet` (override-only too — the supplied id is
+	* CANONICALIZED rather than trusted, using the template's
+	* `HostedZoneId` / `HostedZoneName` + `Name` + `Type` and verified
+	* against AWS, but an import with no override still declines because
+	* a RecordSet has no standalone identity for auto mode to key on).
 	*/
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::Route53::HostedZone": return this.importHostedZone(input);
-			case "AWS::Route53::RecordSet":
-				if (input.knownPhysicalId) return {
-					physicalId: input.knownPhysicalId,
-					attributes: {}
-				};
-				return null;
+			case "AWS::Route53::RecordSet": return this.importRecordSet(input);
 			default: return null;
 		}
 	}
+	/**
+	* Adopt an existing record set (issue #1658).
+	*
+	* cdkd's physicalId is the composite `<hostedZoneId>|<Name>|<Type>` that
+	* `createRecordSet` returns, but CloudFormation's is the record NAME alone.
+	* In auto / `--migrate-from-cloudformation` mode `knownPhysicalId` is NOT a
+	* user choice — the overrides are pre-populated from the CFn stack's
+	* `DescribeStackResources` — so storing it verbatim wrote an id this
+	* provider's own `delete` could not parse, and the migrated stack became
+	* undestroyable with the defect only surfacing after the CFn stack had
+	* already been retired.
+	*
+	* So re-canonicalize instead, the way `AWS::EC2::EIP` already does: an
+	* already-composite override passes through (the documented
+	* `--resource 'Id=zone|name|type'` form), anything else is rebuilt from the
+	* template properties and VERIFIED against AWS.
+	*
+	* **Canonicalization is BEST-EFFORT and never drops the row.** When the
+	* identity cannot be resolved or verified, the supplied id is adopted
+	* VERBATIM with a warning rather than returning `null`. Returning `null`
+	* there would be strictly worse than the bug this fixes: `import.ts` only
+	* aborts when ZERO resources import, so under
+	* `--migrate-from-cloudformation` the run proceeds to `UpdateStack(Retain)`
+	* + `DeleteStack` and the record ends up in NEITHER CloudFormation nor cdkd
+	* state — after which the next deploy CREATEs over a live RRSet and fails.
+	* Adopting verbatim is safe now precisely because `deleteRecordSet` and
+	* `readRecordSet` both accept the scalar form (the other half of this fix).
+	*
+	* The ordinary shape that makes verification legitimately fail is a
+	* `HostedZoneId` still carrying an unresolved intrinsic (`import.ts`
+	* substitutes only single-key `{Ref}` before calling a provider). A
+	* split-horizon zone name is refused for safety and lands here too.
+	* (Wildcard records used to fail here as well; `normalizeRecordName` now
+	* decodes Route 53's octal escapes, so they canonicalize normally.)
+	*
+	* This stays OVERRIDE-ONLY (see the "sub-resources without a standalone
+	* identity" list in docs/import.md): the id is now derived from the template
+	* rather than trusted, but an import with no override at all still declines,
+	* because a RecordSet has no standalone identity for auto mode to key on.
+	*/
+	async importRecordSet(input) {
+		const known = input.knownPhysicalId;
+		if (!known) return null;
+		if (parseRecordSetCompositeId(known)) return {
+			physicalId: known,
+			attributes: {}
+		};
+		const adoptVerbatim = (reason) => {
+			this.logger.warn(`Record set ${input.logicalId}: could not canonicalize physical id '${known}' (${reason}). Adopting it as-is — delete and drift both accept this form, but a later deploy that UPDATEs the record will rewrite it to cdkd's '<zoneId>|<name>|<type>' composite.`);
+			return {
+				physicalId: known,
+				attributes: {}
+			};
+		};
+		const identity = await this.resolveRecordSetIdentity(known, input.properties, { requireUnambiguousZoneName: true });
+		if (!identity) return adoptVerbatim("the template does not unambiguously resolve to a hosted zone + Name + Type");
+		const compositeId = `${identity.hostedZoneId}|${identity.name}|${identity.type}`;
+		let observed;
+		try {
+			observed = await this.readRecordSet(compositeId);
+		} catch (err) {
+			return adoptVerbatim(`verification failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (!observed) return adoptVerbatim("the record was not found under the resolved hosted zone");
+		return {
+			physicalId: compositeId,
+			attributes: {}
+		};
+	}
 	async importHostedZone(input) {
 		if (input.knownPhysicalId) try {
 			await this.getClient().send(new GetHostedZoneCommand({ Id: input.knownPhysicalId }));
@@ -61573,7 +61792,7 @@ async function importCommand(stackArg, options) {
 			accountIdForNestedSynth = identity.Account;
 		}
 		const selectiveMode = overrides.size > 0 && !options.auto && !options.migrateFromCloudformation;
-		if (selectiveMode) logger.info(`Selective mode: only importing the ${overrides.size} resource(s) you listed (${[...overrides.keys()].join(", ")}). Pass --auto to also tag-import the rest.`);
+		if (selectiveMode) logger.info(`Selective mode: only importing the ${overrides.size} resource(s) you listed (${[...overrides.keys()].join(", ")}). Pass --auto to also auto-resolve the rest.`);
 		if (!selectiveMode && !migrationCfnStackName) {
 			const cfnResources = await tryGetCloudFormationResourceMap(stackInfo.stackName, awsClients.cloudFormation);
 			if (cfnResources) {
@@ -62147,9 +62366,14 @@ async function confirmPrompt(prompt) {
 * Three usage modes:
 *
 *   1. **Auto mode** (no overrides): `cdkd import MyStack`
-*      Imports every resource in the template via tag-based lookup
-*      (`aws:cdk:path`). cdkd's value-add over CDK CLI — useful for
-*      adopting a whole stack that was previously deployed by `cdk deploy`.
+*      Imports every resource in the template, resolving each physical id
+*      from the template's explicit physical-name property and then from a
+*      same-named CloudFormation stack's `DescribeStackResources` (issue
+*      #1128 / #1130). cdkd's value-add over CDK CLI — useful for adopting
+*      a whole stack that was previously deployed by `cdk deploy`. (There is
+*      deliberately no `aws:cdk:path` tag walk: AWS reserves the `aws:` tag
+*      prefix, so that tag never exists on a real resource — issue #1134
+*      removed the walk from every provider.)
 *
 *   2. **Selective mode** (CDK CLI parity, default when overrides given):
 *      `cdkd import MyStack --resource MyBucket=my-bucket-name`
@@ -62163,11 +62387,11 @@ async function confirmPrompt(prompt) {
 *   3. **Hybrid mode** (`--auto` with overrides):
 *      `cdkd import MyStack --resource MyBucket=name --auto`
 *      Listed resources use the explicit physical id; all other
-*      resources still go through tag-based auto-import. The pre-PR
+*      resources still go through auto-resolution. The pre-PR
 *      default behavior, now opt-in.
 */
 function createImportCommand() {
-	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource via the aws:cdk:path tag. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to also tag-import the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also tag-import everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / tag-based auto-lookup), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the tag-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO tag-import every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "After cdkd state is written, retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(importCommand));
+	const cmd = new Command("import").description("Adopt already-deployed AWS resources into cdkd state. Reads the CDK app to find logical IDs, resource types, and dependencies. With no flags, imports every resource, resolving each physical id from the template's physical-name property and then from a same-named CloudFormation stack's DescribeStackResources. With --resource / --resource-mapping, only the listed resources are imported (CDK CLI parity); pass --auto to auto-resolve the rest.").argument("[stack]", "Stack to import. Optional when the synthesized app contains exactly one stack.").option("--resource <id=physical>", "Explicit physical-id override for one logical ID. Repeatable. When at least one --resource is given, only listed resources are imported (CDK CLI parity). Pass --auto to also auto-resolve everything else.", collectMultiple, []).option("--resource-mapping <file>", "Path to a JSON file of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping` compatible). Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping-inline.").option("--resource-mapping-inline <json>", "Inline JSON object of {logicalId: physicalId} overrides (CDK CLI `cdk import --resource-mapping-inline` compatible). Same shape as --resource-mapping but supplied as a string — useful for non-TTY CI scripts that do not want a separate file. Implies selective mode unless --auto is set. Mutually exclusive with --resource-mapping.").option("--record-resource-mapping <file>", "After cdkd resolves every logical ID (via --resource / --resource-mapping / auto-resolution), write the resulting {logicalId: physicalId} map to <file> as JSON. Useful in auto / hybrid mode for capturing the auto-resolved mapping and feeding it back as --resource-mapping in non-interactive CI re-runs. Written before the confirmation prompt (so the user can review the file before saying \"yes\") and even when the user says \"no\". Mirrors `cdk import --record-resource-mapping`.").option("--auto", "Hybrid mode: when explicit overrides are supplied, ALSO auto-resolve every other resource in the template. Without this flag, --resource / --resource-mapping behave as a whitelist (CDK CLI parity).", false).option("--dry-run", "Show planned imports without writing state", false).option("--force", "Confirm a destructive write to existing state. Required for auto / whole-stack import when state already exists (rebuilds the entire resource map). Also required in selective mode if a listed override would overwrite a resource already in state. Not needed for a pure selective merge (adding new resources without touching unlisted entries).", false).option("--migrate-from-cloudformation [cfn-stack-name]", "After cdkd state is written, retire the named CloudFormation stack (deletes the CFn stack record; AWS resources are NOT deleted): inject DeletionPolicy=Retain and UpdateReplacePolicy=Retain on every resource via UpdateStack, then DeleteStack. cdkd takes over management. Pass without a value to use the cdkd stack name as the CFn stack name (the typical case for a CDK app that was previously deployed via `cdk deploy`); pass an explicit value when the CFn stack name differs.").addOption(useCdkBootstrapAssetsOption).action(withErrorHandling(importCommand));
 	[
 		...commonOptions,
 		...appOptions,
@@ -71931,7 +72155,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.42");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.44");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;