@go-to-k/cdkd 0.280.43 → 0.280.45

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-92FflEWX.js";
+import { $ as requireConfigArray, $t as expectedOwnerParam, A as green, An as withErrorHandling, At as getDockerCmd, B as slowCcOperationTimeoutMs, Bt as resolveAutoAssetStorage, C as MULTI_REGION_RECREATE_BLOCKED_TYPES, Cn as StackHasActiveImportsError, Ct as ensureAssetStorage, D as bold, Dt as validateContainerRepoName, E as formatResourceLine, Et as validateAssetBucketName, F as clearOnUpdateRemoval, Ft as Synthesizer, G as refStateLookupFromResource, Gt as resolveUseCdkBootstrapAssets, H as isTerminationProtectionPropagationError, Ht as resolveSkipPrefix, I as ProviderRegistry, It as synthesisStatusMessage, J as resolveExplicitPhysicalId, Jt as CFN_TEMPLATE_BODY_LIMIT, K as WAFv2WebACLProvider, Kt as stateBucketExistenceConfirmed, L as findActionableSilentDrops, Lt as getDefaultStateBucketName, M as yellow, Mt as runDockerStreaming, N as IAMRoleProvider, Nt as AssetManifestLoader, O as cyan, Ot as buildDockerImage, P as collectInlinePolicyNamesManagedBySiblings, Pt as getDockerImageBySourceHash, Q as replayWarn, Qt as uploadCfnTemplate, R as findSilentDropProperties, Rt as getLegacyStateBucketName, S as extractDeploymentEventError, Sn as ResourceUpdateNotSupportedError, St as BOOTSTRAP_MARKER_PREFIX, T as renderStatefulReason, Tt as parseBootstrapMarker, U as IntrinsicFunctionResolver, Ut as resolveStateBucketWithDefault, V as disableInstanceApiTermination, Vt as resolveCaptureObservedState, W as cfnRefValueFromPhysicalId, Wt as resolveStateBucketWithDefaultAndSource, X as configStringRefusal, Xt as MIGRATE_TMP_PREFIX, Y as assertRegionMatch, Yt as CFN_TEMPLATE_URL_LIMIT, Z as readConfigString, Zt as findLargeInlineResources, _ as createPreDeleteFinalSnapshot, _n as MissingCdkCliError, _t as buildAssetRedirectMap, a as DeploymentEventsStore, an as getAwsClients, at as withRetry, b as unsupportedFinalSnapshotError, bn as ProvisioningError, bt as rewriteTemplateAssetReferences, c as replayFailedOperations, ct as DagBuilder, d as IMPLICIT_DELETE_DEPENDENCIES, dt as S3StateBackend, en as AssemblyReader, et as requireConfigObject, f as computeImplicitDeleteEdges, fn as DeployCancelledError, ft as rebuildClientForBucketRegion, g as ccRoutedFinalSnapshotError, gt as WorkGraph, h as buildFinalSnapshotIdentifier, hn as LocalStartServiceError, ht as stringifyValue, i as DeploymentEventsReader, in as AwsClients, it as describeTypeWithThrottleRetry, j as red, jt as runDockerForeground, k as gray, kn as normalizeAwsError, kt as formatDockerLoginError, l as replayRollback, ln as CdkdError, lt as TemplateParser, m as PRE_DELETE_SNAPSHOT_TYPES, mn as LocalMigrateError, mt as AssetPublisher, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as applyRoleArnIfSet, o as planFailedOps, on as resetAwsClients, ot as isRetryableTransientError, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalInvokeBuildError$1, pt as shouldRetainResource, q as normalizeAwsTagsToCfn, qt as warnDeprecatedNoPrefixCliFlag, r as DeployEngine, rn as resolveBucketRegion, rt as DiffCalculator, s as planRollback, sn as setAwsClients, st as isThrottlingError, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as processStackMessages, tt as requireConfigString, u as withResourceDeadline, ut as LockManager, v as isFinalSnapshotError, vn as NestedStackChildDirectDestroyError, vt as createAssetRedirectResolver, w as isStatefulRecreateTargetSync, wn as StackTerminationProtectionError, wt as getBootstrapMarkerKey, x as makeCanonicalizePropertiesFn, xn as ResourceTimeoutError, xt as AssetModeResolver, y as refusesFinalSnapshot, yn as PartialFailureError, yt as loadPublishableAssetManifest, z as CloudControlProvider, zt as resolveApp } from "./deploy-engine-Dnfehcah.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as ASGProvider } from "./asg-provider-DhDS2HGs.js";
+import { t as ASGProvider } from "./asg-provider-DwyF44v8.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -33013,6 +33013,102 @@ function isZoneDisabledForMutationError(error) {
 	return error instanceof Error && error.message.includes("is marked disabled for mutation");
 }
 /**
+* A `HostedZoneName` that resolved cleanly but matches no zone.
+*
+* Distinct from "no zone was specified": the DELETE path treats a vanished
+* zone as already-gone (the zone's records went with it) rather than surfacing
+* a misconfiguration error that would block `cdkd destroy`.
+*/
+var HostedZoneNameNotFoundError = class HostedZoneNameNotFoundError extends ProvisioningError {
+	constructor(message, resourceType, logicalId, physicalId, cause) {
+		super(message, resourceType, logicalId, physicalId, cause);
+		this.name = "HostedZoneNameNotFoundError";
+		Object.setPrototypeOf(this, HostedZoneNameNotFoundError.prototype);
+	}
+};
+/** Segment count of cdkd's `AWS::Route53::RecordSet` composite physicalId. */
+const RECORD_SET_COMPOSITE_SEGMENTS = 3;
+/**
+* Parse cdkd's composite record-set physicalId `<hostedZoneId>|<Name>|<Type>`.
+*
+* Returns `undefined` for anything else — most importantly CloudFormation's
+* OWN physicalId for this type, which is the record name alone (`Ref` on an
+* `AWS::Route53::RecordSet` returns the domain name, and a DNS name can never
+* contain `|`). `cdkd import` stored that scalar verbatim before issue #1658,
+* so state files in the wild carry BOTH shapes and every consumer has to know
+* which one it is holding.
+*/
+function parseRecordSetCompositeId(physicalId) {
+	const parts = physicalId.split("|");
+	if (parts.length !== RECORD_SET_COMPOSITE_SEGMENTS) return void 0;
+	const [hostedZoneId, name, type] = parts;
+	if (!hostedZoneId || !name || !type) return void 0;
+	return {
+		hostedZoneId,
+		name,
+		type
+	};
+}
+/**
+* Octal escapes that must NOT be decoded, because decoding them is not
+* injective — two genuinely different names would compare EQUAL:
+*
+* - `056` is a period INSIDE a label. Route 53 reports the single-label
+*   record `a.b` (period escaped) as `a\\056b.example.com.`, which decodes to
+*   `a.b.example.com.` — identical to the different, two-label record
+*   `a.b.example.com`.
+* - `134` is a literal backslash, which would re-introduce escape ambiguity.
+*
+* A false MATCH is far worse than a false miss here: the compare drives which
+* record `readCurrentState` reports and which hosted zone `create` picks, so
+* collapsing two records would target the wrong one.
+*/
+const UNDECODABLE_OCTAL_ESCAPES = /* @__PURE__ */ new Set(["056", "134"]);
+/**
+* Canonicalize a record name for comparison.
+*
+* Two AWS-side spellings have to be absorbed, and missing either one makes
+* `readCurrentState` return `undefined` — which reads as "drift unknown"
+* rather than as an error:
+*
+* - Route 53 reports every name fully qualified with a TRAILING DOT, while a
+*   template may declare it either way.
+* - Special characters come back OCTAL-ESCAPED: `*.example.com` is reported as
+*   `\\052.example.com.`. That affects every wildcard record, including ones
+*   cdkd created itself, so decoding it here fixes drift for the whole
+*   population rather than only the imported ones.
+*
+* Known bound: Route 53 escapes per BYTE, so a non-ASCII name decodes to
+* latin-1 mojibake and will not match its template spelling. That is a false
+* MISS (drift unknown), never a false match, and CDK emits punycode for
+* internationalized names in practice.
+*/
+function normalizeRecordName(name) {
+	const lowered = name.replace(/\\([0-7]{3})/g, (match, oct) => UNDECODABLE_OCTAL_ESCAPES.has(oct) ? match : String.fromCharCode(parseInt(oct, 8))).toLowerCase();
+	return lowered.endsWith(".") ? lowered : `${lowered}.`;
+}
+/**
+* Canonicalize a name for the QUERY side of a Route 53 list call.
+*
+* `normalizeRecordName` above is the COMPARE-side canonicalizer, and the two
+* are deliberately NOT the same function. Route 53 orders both hosted zones
+* and record sets by reversed labels of the name it STORES — lower-cased and
+* escape-ENCODED — and a `DNSName` / `StartRecordName` start key in any other
+* spelling positions the window somewhere else entirely. So the query side
+* must move TOWARD AWS's spelling (lower-case, encode `*`), where the compare
+* side moves AWS's answer toward the template's (decode escapes).
+*
+* Decoding here would be actively wrong: `*.example.com` sorts at `*` (0x2A)
+* while AWS stores `\052.example.com` and sorts it at `\` (0x5C), so every
+* name whose first label begins with `-` / `+` / a digit / an upper-case
+* letter falls BETWEEN them — with a bounded page, the wildcard record we
+* asked for is skipped straight past.
+*/
+function canonicalizeQueryName(name) {
+	const lowered = name.toLowerCase().replaceAll("*", "\\052");
+	return lowered.endsWith(".") ? lowered : `${lowered}.`;
+}
+/**
 * AWS Route 53 Provider
 *
 * Implements resource provisioning for Route 53 resources:
@@ -33351,10 +33447,20 @@ var Route53Provider = class {
 	}
 	async deleteRecordSet(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting Route 53 record set ${logicalId}: ${physicalId}`);
-		const parts = physicalId.split("|");
-		if (parts.length !== 3) throw new ProvisioningError(`Invalid record set physical ID format: ${physicalId}`, resourceType, logicalId, physicalId);
-		const [hostedZoneId] = parts;
 		if (!properties) throw new ProvisioningError(`Properties required to delete record set ${logicalId}`, resourceType, logicalId, physicalId);
+		const composite = parseRecordSetCompositeId(physicalId);
+		let hostedZoneId;
+		if (composite) hostedZoneId = composite.hostedZoneId;
+		else try {
+			hostedZoneId = await this.resolveHostedZoneId(properties, logicalId, resourceType, physicalId, { requireUnambiguousZoneName: true });
+		} catch (error) {
+			if (error instanceof HostedZoneNameNotFoundError) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.warn(`Hosted zone "${String(properties?.["HostedZoneName"])}" for record set ${logicalId} (${physicalId}) no longer exists; treating the record as already deleted and dropping it from state.`);
+				return;
+			}
+			throw error;
+		}
 		try {
 			const resourceRecordSet = this.buildResourceRecordSet(properties);
 			const sendDelete = () => this.getClient().send(new ChangeResourceRecordSetsCommand({
@@ -33702,22 +33808,65 @@ var Route53Provider = class {
 	* If HostedZoneId is provided, use it directly.
 	* If HostedZoneName is provided, resolve it to a HostedZoneId via ListHostedZonesByName.
 	*/
-	async resolveHostedZoneId(properties, logicalId, resourceType, physicalId) {
+	async resolveHostedZoneId(properties, logicalId, resourceType, physicalId, options) {
 		const hostedZoneId = properties["HostedZoneId"];
-		if (hostedZoneId) return hostedZoneId;
+		if (typeof hostedZoneId === "string" && hostedZoneId) return hostedZoneId;
+		let lookupErrorMessage;
+		let lookupErrorCause;
 		const hostedZoneName = properties["HostedZoneName"];
-		if (hostedZoneName) try {
-			const zones = (await this.getClient().send(new ListHostedZonesByNameCommand({
-				DNSName: hostedZoneName,
-				MaxItems: 1
-			}))).HostedZones ?? [];
-			const normalizedName = hostedZoneName.endsWith(".") ? hostedZoneName : `${hostedZoneName}.`;
-			const matchedZone = zones.find((z) => z.Name === normalizedName);
+		if (typeof hostedZoneName === "string" && hostedZoneName) {
+			let matched = [];
+			let absenceIsSound = false;
+			try {
+				const response = await this.getClient().send(new ListHostedZonesByNameCommand({
+					DNSName: canonicalizeQueryName(hostedZoneName),
+					MaxItems: 5
+				}));
+				const zones = response.HostedZones ?? [];
+				const normalizedName = normalizeRecordName(hostedZoneName);
+				matched = zones.filter((z) => normalizeRecordName(z.Name ?? "") === normalizedName);
+				absenceIsSound = !hostedZoneName.includes("\\") && (zones.length > 0 || response.IsTruncated !== true);
+			} catch (error) {
+				lookupErrorMessage = error instanceof Error ? error.message : String(error);
+				lookupErrorCause = error instanceof Error ? error : void 0;
+				this.logger.warn(`Failed to resolve HostedZoneName "${hostedZoneName}" for ${logicalId}: ${lookupErrorMessage}`);
+			}
+			if (matched.length > 1 && options?.requireUnambiguousZoneName) throw new ProvisioningError(`HostedZoneName "${hostedZoneName}" matches ${matched.length} hosted zones for ${logicalId} (split-horizon public/private DNS). Refusing to guess which one this record belongs to — set HostedZoneId explicitly, or pass the '<zoneId>|<name>|<type>' composite via --resource.`, resourceType, logicalId, physicalId);
+			const matchedZone = matched[0];
 			if (matchedZone?.Id) return matchedZone.Id.replace("/hostedzone/", "");
-		} catch (error) {
-			this.logger.warn(`Failed to resolve HostedZoneName "${hostedZoneName}" for ${logicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			if (absenceIsSound) throw new HostedZoneNameNotFoundError(`HostedZoneName "${hostedZoneName}" matches no hosted zone in this account/region for ${logicalId}`, resourceType, logicalId, physicalId);
+		}
+		throw new ProvisioningError(lookupErrorMessage ? `Could not resolve HostedZoneName "${String(hostedZoneName)}" for record set ${logicalId}: ${lookupErrorMessage}` : `Either HostedZoneId or HostedZoneName is required for record set ${logicalId}`, resourceType, logicalId, physicalId, lookupErrorCause);
+	}
+	/**
+	* Recover `(hostedZoneId, name, type)` for a record set from EITHER shape of
+	* physicalId (issue #1658).
+	*
+	* cdkd's own composite carries all three. CloudFormation's physicalId is the
+	* record name alone, so the zone has to be resolved from the recorded
+	* properties — which is exactly what `createRecordSet` does, so the answer is
+	* the same triple the composite would have held. Returns `undefined` (rather
+	* than throwing) when the zone cannot be resolved, because both callers of
+	* this helper treat "cannot determine" as "nothing to report" rather than as
+	* a failure.
+	*/
+	async resolveRecordSetIdentity(physicalId, properties, options) {
+		const composite = parseRecordSetCompositeId(physicalId);
+		if (composite) return composite;
+		if (!properties) return void 0;
+		const name = typeof properties["Name"] === "string" ? properties["Name"] : physicalId;
+		const type = properties["Type"];
+		if (!name || typeof type !== "string" || !type) return void 0;
+		try {
+			return {
+				hostedZoneId: await this.resolveHostedZoneId(properties, "RecordSet", "AWS::Route53::RecordSet", physicalId, options),
+				name,
+				type
+			};
+		} catch (err) {
+			this.logger.debug(`Cannot resolve record-set identity for '${physicalId}': ${err instanceof Error ? err.message : String(err)}`);
+			return;
 		}
-		throw new ProvisioningError(`Either HostedZoneId or HostedZoneName is required for record set ${logicalId}`, resourceType, logicalId, physicalId);
 	}
 	/**
 	* Read the AWS-current Route 53 resource configuration in CFn-property shape.
@@ -33733,17 +33882,21 @@ var Route53Provider = class {
 	*    `CloudWatchLogsLogGroupArn` to match cdkd state).
 	*  - `RecordSet` → `ListResourceRecordSets` filtered to the exact
 	*    `(name, type)` pair from the composite physicalId
-	*    (`{zoneId}|{name}|{type}`). Surfaces TTL, ResourceRecords (with
+	*    (`{zoneId}|{name}|{type}`), or — for a state record carrying
+	*    CloudFormation's scalar physicalId, written by `cdkd import`
+	*    before issue #1658 — from the recorded properties, so drift is
+	*    reported for those records instead of silently skipped.
+	*    Surfaces TTL, ResourceRecords (with
 	*    `[{Value}]` -> string[] re-shape to match cdkd state), AliasTarget,
 	*    Weight, Region, Failover, MultiValueAnswer, HealthCheckId,
 	*    GeoLocation, GeoProximityLocation, CidrRoutingConfig, SetIdentifier.
 	*
 	* Returns `undefined` when the parent zone is gone (`NoSuchHostedZone`).
 	*/
-	async readCurrentState(physicalId, _logicalId, resourceType) {
+	async readCurrentState(physicalId, _logicalId, resourceType, properties) {
 		switch (resourceType) {
 			case "AWS::Route53::HostedZone": return this.readHostedZone(physicalId);
-			case "AWS::Route53::RecordSet": return this.readRecordSet(physicalId);
+			case "AWS::Route53::RecordSet": return this.readRecordSet(physicalId, properties);
 			default: return;
 		}
 	}
@@ -33789,24 +33942,24 @@ var Route53Provider = class {
 		}
 		return result;
 	}
-	async readRecordSet(physicalId) {
-		const parts = physicalId.split("|");
-		if (parts.length < 3) return void 0;
-		const [hostedZoneId, name, type] = parts;
-		if (!hostedZoneId || !name || !type) return void 0;
+	async readRecordSet(physicalId, properties) {
+		const identity = await this.resolveRecordSetIdentity(physicalId, properties);
+		if (!identity) return void 0;
+		const { hostedZoneId, name, type } = identity;
 		let resp;
 		try {
 			resp = await this.getClient().send(new ListResourceRecordSetsCommand({
 				HostedZoneId: hostedZoneId,
-				StartRecordName: name,
+				StartRecordName: canonicalizeQueryName(name),
 				StartRecordType: type,
-				MaxItems: 1
+				MaxItems: 5
 			}));
 		} catch (err) {
 			if (err instanceof Error && err.name === "NoSuchHostedZone") return void 0;
 			throw err;
 		}
-		const recordSet = resp.ResourceRecordSets?.find((r) => r.Name === name && r.Type === type);
+		const wantedName = normalizeRecordName(name);
+		const recordSet = resp.ResourceRecordSets?.find((r) => r.Name !== void 0 && normalizeRecordName(r.Name) === wantedName && r.Type === type);
 		if (!recordSet) return void 0;
 		const result = {
 			HostedZoneId: hostedZoneId,
@@ -33861,23 +34014,89 @@ var Route53Provider = class {
 	/**
 	* Adopt an existing Route 53 resource into cdkd state.
 	*
-	* Supported types: `AWS::Route53::HostedZone` (full tag-based
-	* lookup); `AWS::Route53::RecordSet` (override-only — RecordSets are
-	* not taggable, and the composite child-of-zone identity makes auto
-	* lookup impractical).
+	* Supported types: `AWS::Route53::HostedZone` (override-only);
+	* `AWS::Route53::RecordSet` (override-only too — the supplied id is
+	* CANONICALIZED rather than trusted, using the template's
+	* `HostedZoneId` / `HostedZoneName` + `Name` + `Type` and verified
+	* against AWS, but an import with no override still declines because
+	* a RecordSet has no standalone identity for auto mode to key on).
 	*/
 	async import(input) {
 		switch (input.resourceType) {
 			case "AWS::Route53::HostedZone": return this.importHostedZone(input);
-			case "AWS::Route53::RecordSet":
-				if (input.knownPhysicalId) return {
-					physicalId: input.knownPhysicalId,
-					attributes: {}
-				};
-				return null;
+			case "AWS::Route53::RecordSet": return this.importRecordSet(input);
 			default: return null;
 		}
 	}
+	/**
+	* Adopt an existing record set (issue #1658).
+	*
+	* cdkd's physicalId is the composite `<hostedZoneId>|<Name>|<Type>` that
+	* `createRecordSet` returns, but CloudFormation's is the record NAME alone.
+	* In auto / `--migrate-from-cloudformation` mode `knownPhysicalId` is NOT a
+	* user choice — the overrides are pre-populated from the CFn stack's
+	* `DescribeStackResources` — so storing it verbatim wrote an id this
+	* provider's own `delete` could not parse, and the migrated stack became
+	* undestroyable with the defect only surfacing after the CFn stack had
+	* already been retired.
+	*
+	* So re-canonicalize instead, the way `AWS::EC2::EIP` already does: an
+	* already-composite override passes through (the documented
+	* `--resource 'Id=zone|name|type'` form), anything else is rebuilt from the
+	* template properties and VERIFIED against AWS.
+	*
+	* **Canonicalization is BEST-EFFORT and never drops the row.** When the
+	* identity cannot be resolved or verified, the supplied id is adopted
+	* VERBATIM with a warning rather than returning `null`. Returning `null`
+	* there would be strictly worse than the bug this fixes: `import.ts` only
+	* aborts when ZERO resources import, so under
+	* `--migrate-from-cloudformation` the run proceeds to `UpdateStack(Retain)`
+	* + `DeleteStack` and the record ends up in NEITHER CloudFormation nor cdkd
+	* state — after which the next deploy CREATEs over a live RRSet and fails.
+	* Adopting verbatim is safe now precisely because `deleteRecordSet` and
+	* `readRecordSet` both accept the scalar form (the other half of this fix).
+	*
+	* The ordinary shape that makes verification legitimately fail is a
+	* `HostedZoneId` still carrying an unresolved intrinsic (`import.ts`
+	* substitutes only single-key `{Ref}` before calling a provider). A
+	* split-horizon zone name is refused for safety and lands here too.
+	* (Wildcard records used to fail here as well; `normalizeRecordName` now
+	* decodes Route 53's octal escapes, so they canonicalize normally.)
+	*
+	* This stays OVERRIDE-ONLY (see the "sub-resources without a standalone
+	* identity" list in docs/import.md): the id is now derived from the template
+	* rather than trusted, but an import with no override at all still declines,
+	* because a RecordSet has no standalone identity for auto mode to key on.
+	*/
+	async importRecordSet(input) {
+		const known = input.knownPhysicalId;
+		if (!known) return null;
+		if (parseRecordSetCompositeId(known)) return {
+			physicalId: known,
+			attributes: {}
+		};
+		const adoptVerbatim = (reason) => {
+			this.logger.warn(`Record set ${input.logicalId}: could not canonicalize physical id '${known}' (${reason}). Adopting it as-is — delete and drift both accept this form, but a later deploy that UPDATEs the record will rewrite it to cdkd's '<zoneId>|<name>|<type>' composite.`);
+			return {
+				physicalId: known,
+				attributes: {}
+			};
+		};
+		const identity = await this.resolveRecordSetIdentity(known, input.properties, { requireUnambiguousZoneName: true });
+		if (!identity) return adoptVerbatim("the template does not unambiguously resolve to a hosted zone + Name + Type");
+		const compositeId = `${identity.hostedZoneId}|${identity.name}|${identity.type}`;
+		let observed;
+		try {
+			observed = await this.readRecordSet(compositeId);
+		} catch (err) {
+			return adoptVerbatim(`verification failed: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		if (!observed) return adoptVerbatim("the record was not found under the resolved hosted zone");
+		return {
+			physicalId: compositeId,
+			attributes: {}
+		};
+	}
 	async importHostedZone(input) {
 		if (input.knownPhysicalId) try {
 			await this.getClient().send(new GetHostedZoneCommand({ Id: input.knownPhysicalId }));
@@ -71936,7 +72155,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.43");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.45");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;