@go-to-k/cdkd 0.50.5 → 0.50.7

package/dist/cli.js

@@ -8705,10 +8705,10 @@ var IAMRoleProvider = class {
       const updateParams = {
         RoleName: physicalId
       };
-      if (properties["Description"]) {
+      if (properties["Description"] !== void 0) {
         updateParams.Description = properties["Description"];
       }
-      if (properties["MaxSessionDuration"]) {
+      if (properties["MaxSessionDuration"] !== void 0) {
         updateParams.MaxSessionDuration = properties["MaxSessionDuration"];
       }
       await this.iamClient.send(new UpdateRoleCommand(updateParams));
@@ -10038,6 +10038,7 @@ import {
   ListUserTagsCommand,
   NoSuchEntityException as NoSuchEntityException4,
   TagUserCommand,
+  UntagUserCommand,
   PutUserPermissionsBoundaryCommand,
   DeleteUserPermissionsBoundaryCommand
 } from "@aws-sdk/client-iam";
@@ -10234,16 +10235,11 @@ var IAMUserGroupProvider = class {
   async updateUser(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating IAM user ${logicalId}: ${physicalId}`);
     try {
-      const tags = properties["Tags"];
-      if (tags && Array.isArray(tags)) {
-        await this.iamClient.send(
-          new TagUserCommand({
-            UserName: physicalId,
-            Tags: tags
-          })
-        );
-        this.logger.debug(`Tagged user ${physicalId}`);
-      }
+      await this.applyUserTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const newPermBoundary = properties["PermissionsBoundary"];
       const oldPermBoundary = previousProperties["PermissionsBoundary"];
       if (newPermBoundary !== oldPermBoundary) {
@@ -10492,6 +10488,42 @@ var IAMUserGroupProvider = class {
       throw error;
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via IAM's
+   * `TagUser` / `UntagUser` APIs.
+   */
+  async applyUserTagDiff(userName, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.iamClient.send(
+        new UntagUserCommand({ UserName: userName, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from IAM user ${userName}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.iamClient.send(new TagUserCommand({ UserName: userName, Tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on IAM user ${userName}`);
+    }
+  }
   async updateUserManagedPolicies(userName, newPolicies, oldPolicies) {
     const newSet = new Set(newPolicies || []);
     const oldSet = new Set(oldPolicies || []);
@@ -11224,6 +11256,7 @@ import {
   ListBucketsCommand,
   PutBucketVersioningCommand as PutBucketVersioningCommand2,
   PutBucketTaggingCommand,
+  DeleteBucketTaggingCommand,
   PutBucketOwnershipControlsCommand,
   PutBucketNotificationConfigurationCommand,
   PutBucketCorsCommand,
@@ -11347,6 +11380,52 @@ var S3BucketProvider = class {
     );
     this.logger.debug(`Applied ${tags.length} tags to bucket ${bucketName}`);
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via S3's
+   * `PutBucketTagging` (full-replace) / `DeleteBucketTagging` APIs.
+   *
+   * S3's `PutBucketTagging` replaces the entire tag set in one call, so we
+   * don't need separate add/remove API operations. When the new set is
+   * empty, we issue `DeleteBucketTagging` to clear it. When old and new
+   * are equal, we skip the call entirely.
+   */
+  async applyTagDiff(bucketName, oldTagsRaw, newTagsRaw) {
+    const normalize = (tags) => {
+      const out = [];
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          out.push({ Key: t.Key, Value: t.Value });
+      }
+      return out;
+    };
+    const oldNorm = normalize(oldTagsRaw);
+    const newNorm = normalize(newTagsRaw);
+    if (JSON.stringify(oldNorm) === JSON.stringify(newNorm))
+      return;
+    if (newNorm.length === 0) {
+      try {
+        await this.s3Client.send(
+          new DeleteBucketTaggingCommand({
+            Bucket: bucketName
+          })
+        );
+        this.logger.debug(`Cleared tags from bucket ${bucketName}`);
+      } catch (err) {
+        const e = err;
+        if (e.name === "NoSuchTagSet")
+          return;
+        throw err;
+      }
+      return;
+    }
+    await this.s3Client.send(
+      new PutBucketTaggingCommand({
+        Bucket: bucketName,
+        Tagging: { TagSet: newNorm }
+      })
+    );
+    this.logger.debug(`Replaced tag set on bucket ${bucketName} (${newNorm.length} tags)`);
+  }
   /**
    * Apply CORS configuration
    *
@@ -11890,13 +11969,13 @@ var S3BucketProvider = class {
   /**
    * Apply additional bucket configuration after creation
    */
-  async applyConfiguration(bucketName, properties) {
+  async applyConfiguration(bucketName, properties, skipTags = false) {
     const versioningConfig = properties["VersioningConfiguration"];
     if (versioningConfig) {
       await this.applyVersioning(bucketName, versioningConfig);
     }
     const tags = properties["Tags"];
-    if (tags && Array.isArray(tags) && tags.length > 0) {
+    if (!skipTags && tags && Array.isArray(tags) && tags.length > 0) {
       await this.applyTags(bucketName, tags);
     }
     const ownershipControls = properties["OwnershipControls"];
@@ -12035,7 +12114,7 @@ var S3BucketProvider = class {
   /**
    * Update an S3 bucket
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating S3 bucket ${logicalId}: ${physicalId}`);
     const newBucketName = properties["BucketName"];
     if (newBucketName && newBucketName !== physicalId) {
@@ -12048,7 +12127,17 @@ var S3BucketProvider = class {
       };
     }
     try {
-      await this.applyConfiguration(physicalId, properties);
+      await this.applyConfiguration(
+        physicalId,
+        properties,
+        /* skipTags */
+        true
+      );
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const attributes = await this.buildAttributes(physicalId);
       this.logger.debug(`Successfully updated S3 bucket ${logicalId}`);
       return {
@@ -12546,10 +12635,20 @@ import {
   ListQueuesCommand,
   ListQueueTagsCommand,
   SetQueueAttributesCommand,
+  TagQueueCommand,
+  UntagQueueCommand,
   QueueDoesNotExist
 } from "@aws-sdk/client-sqs";
 import { GetCallerIdentityCommand as GetCallerIdentityCommand4 } from "@aws-sdk/client-sts";
 init_aws_clients();
+function serializeRedrivePolicy(value) {
+  if (value === null || value === void 0)
+    return "";
+  if (typeof value === "object" && Object.keys(value).length === 0) {
+    return "";
+  }
+  return JSON.stringify(value);
+}
 var CDK_TO_SQS_ATTRIBUTES = {
   VisibilityTimeout: "VisibilityTimeout",
   MaximumMessageSize: "MaximumMessageSize",
@@ -12608,7 +12707,7 @@ var SQSQueueProvider = class {
         if (properties[cdkKey] !== void 0) {
           const value = properties[cdkKey];
           if (cdkKey === "RedrivePolicy" && typeof value === "object") {
-            attributes[sqsKey] = JSON.stringify(value);
+            attributes[sqsKey] = serializeRedrivePolicy(value);
           } else {
             attributes[sqsKey] = String(value);
           }
@@ -12656,7 +12755,7 @@ var SQSQueueProvider = class {
   /**
    * Update an SQS queue
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating SQS queue ${logicalId}: ${physicalId}`);
     try {
       const attributes = {};
@@ -12666,7 +12765,7 @@ var SQSQueueProvider = class {
         if (properties[cdkKey] !== void 0) {
           const value = properties[cdkKey];
           if (cdkKey === "RedrivePolicy" && typeof value === "object") {
-            attributes[sqsKey] = JSON.stringify(value);
+            attributes[sqsKey] = serializeRedrivePolicy(value);
           } else {
             attributes[sqsKey] = String(value);
           }
@@ -12681,6 +12780,11 @@ var SQSQueueProvider = class {
         );
         this.logger.debug(`Updated attributes for SQS queue ${physicalId}`);
       }
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const getResponse = await this.sqsClient.send(
         new GetQueueAttributesCommand({
           QueueUrl: physicalId,
@@ -12739,6 +12843,46 @@ var SQSQueueProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via SQS's
+   * `TagQueue` / `UntagQueue` APIs. SQS's `TagQueue` takes a `Tags` map
+   * (`{ key: value }`); `UntagQueue` takes a `TagKeys` array. cdkd state
+   * holds Tags in CFn shape (`[{ Key, Value }]`).
+   */
+  async applyTagDiff(queueUrl, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.sqsClient.send(
+        new UntagQueueCommand({ QueueUrl: queueUrl, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from SQS queue ${queueUrl}`);
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.sqsClient.send(new TagQueueCommand({ QueueUrl: queueUrl, Tags: tagsToAdd }));
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on SQS queue ${queueUrl}`
+      );
+    }
+  }
   /**
    * Construct SQS queue ARN from account/region/queue name
    */
@@ -14080,6 +14224,8 @@ import {
   GetFunctionCommand,
   ListFunctionsCommand,
   ListTagsCommand,
+  TagResourceCommand as TagResourceCommand2,
+  UntagResourceCommand as UntagResourceCommand2,
   ResourceNotFoundException,
   waitUntilFunctionUpdatedV2 as waitUntilFunctionUpdatedV22
 } from "@aws-sdk/client-lambda";
@@ -14297,11 +14443,17 @@ var LambdaFunctionProvider = class {
       const getResponse = await this.lambdaClient.send(
         new GetFunctionCommand({ FunctionName: physicalId })
       );
+      const functionArn = getResponse.Configuration?.FunctionArn;
+      await this.applyTagDiff(
+        functionArn,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       return {
         physicalId,
         wasReplaced: false,
         attributes: {
-          Arn: getResponse.Configuration?.FunctionArn,
+          Arn: functionArn,
           FunctionName: getResponse.Configuration?.FunctionName
         }
       };
@@ -14493,6 +14645,53 @@ var LambdaFunctionProvider = class {
    * one resource type that actually needs it preserves the bug fix
    * without paying the whole-stack tax.
    */
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via Lambda's
+   * `TagResource` / `UntagResource` APIs. Without this, `cdkd deploy`
+   * and `cdkd drift --revert` silently no-op tag changes — the
+   * `UpdateFunctionConfiguration` command does NOT accept a Tags
+   * parameter (Lambda treats tags as a separate API surface).
+   */
+  async applyTagDiff(functionArn, oldTagsRaw, newTagsRaw) {
+    if (!functionArn)
+      return;
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.lambdaClient.send(
+        new UntagResourceCommand2({ Resource: functionArn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(
+        `Removed ${tagsToRemove.length} tag(s) from Lambda function ${functionArn}`
+      );
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.lambdaClient.send(
+        new TagResourceCommand2({ Resource: functionArn, Tags: tagsToAdd })
+      );
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on Lambda function ${functionArn}`
+      );
+    }
+  }
   async waitForFunctionUpdated(logicalId, resourceType, functionName) {
     try {
       await waitUntilFunctionUpdatedV22(
@@ -14827,14 +15026,11 @@ var LambdaFunctionProvider = class {
       if (cfg.EphemeralStorage?.Size !== void 0) {
         result["EphemeralStorage"] = { Size: cfg.EphemeralStorage.Size };
       }
-      const vpc = {
+      result["VpcConfig"] = {
         SubnetIds: cfg.VpcConfig?.SubnetIds ? [...cfg.VpcConfig.SubnetIds] : [],
-        SecurityGroupIds: cfg.VpcConfig?.SecurityGroupIds ? [...cfg.VpcConfig.SecurityGroupIds] : []
+        SecurityGroupIds: cfg.VpcConfig?.SecurityGroupIds ? [...cfg.VpcConfig.SecurityGroupIds] : [],
+        Ipv6AllowedForDualStack: cfg.VpcConfig?.Ipv6AllowedForDualStack ?? false
       };
-      if (cfg.VpcConfig?.Ipv6AllowedForDualStack !== void 0) {
-        vpc["Ipv6AllowedForDualStack"] = cfg.VpcConfig.Ipv6AllowedForDualStack;
-      }
-      result["VpcConfig"] = vpc;
       const tags = normalizeAwsTagsToCfn(resp.Tags);
       result["Tags"] = tags;
       return result;
@@ -15468,6 +15664,8 @@ import {
   DeleteEventSourceMappingCommand,
   UpdateEventSourceMappingCommand,
   GetEventSourceMappingCommand,
+  TagResourceCommand as TagResourceCommand3,
+  UntagResourceCommand as UntagResourceCommand3,
   ResourceNotFoundException as ResourceNotFoundException4
 } from "@aws-sdk/client-lambda";
 init_aws_clients();
@@ -15591,7 +15789,7 @@ var LambdaEventSourceMappingProvider = class {
   /**
    * Update a Lambda Event Source Mapping
    */
-  async update(logicalId, physicalId, _resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, _resourceType, properties, previousProperties) {
     this.logger.debug(`Updating event source mapping ${logicalId}: ${physicalId}`);
     const updateParams = {
       UUID: physicalId,
@@ -15625,7 +15823,17 @@ var LambdaEventSourceMappingProvider = class {
       updateParams.ScalingConfig = properties["ScalingConfig"];
     if (properties["DocumentDBEventSourceConfig"])
       updateParams.DocumentDBEventSourceConfig = properties["DocumentDBEventSourceConfig"];
-    await this.lambdaClient.send(new UpdateEventSourceMappingCommand(updateParams));
+    const updateResp = await this.lambdaClient.send(
+      new UpdateEventSourceMappingCommand(updateParams)
+    );
+    const eventSourceMappingArn = updateResp.EventSourceMappingArn;
+    if (eventSourceMappingArn) {
+      await this.applyTagDiff(
+        eventSourceMappingArn,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
+    }
     this.logger.debug(`Successfully updated event source mapping ${logicalId}`);
     return {
       physicalId,
@@ -15635,6 +15843,46 @@ var LambdaEventSourceMappingProvider = class {
       }
     };
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via Lambda's
+   * `TagResource` / `UntagResource` APIs against the EventSourceMapping
+   * ARN. Lambda's `TagResource` takes `{ Resource, Tags: { key: value } }`;
+   * `UntagResource` takes `{ Resource, TagKeys: [...] }`.
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.lambdaClient.send(
+        new UntagResourceCommand3({ Resource: arn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from EventSourceMapping ${arn}`);
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.lambdaClient.send(new TagResourceCommand3({ Resource: arn, Tags: tagsToAdd }));
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on EventSourceMapping ${arn}`
+      );
+    }
+  }
   /**
    * Delete a Lambda Event Source Mapping
    */
@@ -16068,6 +16316,8 @@ import {
   DescribeTableCommand as DescribeTableCommand2,
   ListTablesCommand,
   ListTagsOfResourceCommand,
+  TagResourceCommand as TagResourceCommand4,
+  UntagResourceCommand as UntagResourceCommand4,
   ResourceNotFoundException as ResourceNotFoundException6
 } from "@aws-sdk/client-dynamodb";
 init_aws_clients();
@@ -16193,13 +16443,20 @@ var DynamoDBTableProvider = class {
    * For immutable property changes (KeySchema, etc.), the deployment layer
    * handles replacement via DELETE + CREATE.
    */
-  async update(logicalId, physicalId, resourceType, _properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating DynamoDB table ${logicalId}: ${physicalId}`);
     try {
       const response = await this.dynamoDBClient.send(
         new DescribeTableCommand2({ TableName: physicalId })
       );
       const table = response.Table;
+      if (table?.TableArn) {
+        await this.applyTagDiff(
+          table.TableArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -16252,6 +16509,45 @@ var DynamoDBTableProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via DynamoDB's
+   * `TagResource` / `UntagResource` APIs. Both take the table ARN as
+   * `ResourceArn`.
+   */
+  async applyTagDiff(tableArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.dynamoDBClient.send(
+        new UntagResourceCommand4({ ResourceArn: tableArn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from DynamoDB table ${tableArn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.dynamoDBClient.send(
+        new TagResourceCommand4({ ResourceArn: tableArn, Tags: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on DynamoDB table ${tableArn}`);
+    }
+  }
   /**
    * Poll DescribeTable until the table reaches ACTIVE status
    *
@@ -16471,8 +16767,8 @@ import {
   ListTagsForResourceCommand as ListTagsForResourceCommand2,
   PutRetentionPolicyCommand,
   DeleteRetentionPolicyCommand,
-  TagResourceCommand as TagResourceCommand2,
-  UntagResourceCommand as UntagResourceCommand2,
+  TagResourceCommand as TagResourceCommand5,
+  UntagResourceCommand as UntagResourceCommand5,
   PutDataProtectionPolicyCommand,
   DeleteDataProtectionPolicyCommand,
   ResourceNotFoundException as ResourceNotFoundException7,
@@ -16622,7 +16918,7 @@ var LogsLogGroupProvider = class {
       if (oldTags && oldTags.length > 0) {
         const oldTagKeys = oldTags.map((t) => t.Key);
         await this.logsClient.send(
-          new UntagResourceCommand2({
+          new UntagResourceCommand5({
             resourceArn: arn2,
             tagKeys: oldTagKeys
           })
@@ -16631,7 +16927,7 @@ var LogsLogGroupProvider = class {
       if (newTags && newTags.length > 0) {
         const tagsMap = Object.fromEntries(newTags.map((t) => [t.Key, t.Value]));
         await this.logsClient.send(
-          new TagResourceCommand2({
+          new TagResourceCommand5({
             resourceArn: arn2,
             tags: tagsMap
           })
@@ -16831,7 +17127,9 @@ import {
   PutMetricAlarmCommand,
   DeleteAlarmsCommand,
   DescribeAlarmsCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand3
+  ListTagsForResourceCommand as ListTagsForResourceCommand3,
+  TagResourceCommand as TagResourceCommand6,
+  UntagResourceCommand as UntagResourceCommand6
 } from "@aws-sdk/client-cloudwatch";
 init_aws_clients();
 var CloudWatchAlarmProvider = class {
@@ -16900,7 +17198,7 @@ var CloudWatchAlarmProvider = class {
    *
    * PutMetricAlarm is idempotent - calling it with the same alarm name updates the alarm.
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating CloudWatch alarm ${logicalId}: ${physicalId}`);
     try {
       await this.cloudWatchClient.send(
@@ -16908,6 +17206,11 @@ var CloudWatchAlarmProvider = class {
       );
       this.logger.debug(`Successfully updated CloudWatch alarm ${logicalId}`);
       const alarmArn = await this.getAlarmArn(physicalId);
+      await this.applyTagDiff(
+        alarmArn,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       return {
         physicalId,
         wasReplaced: false,
@@ -16992,6 +17295,44 @@ var CloudWatchAlarmProvider = class {
       return `arn:aws:cloudwatch:*:*:alarm:${alarmName}`;
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via CloudWatch's
+   * `TagResource` / `UntagResource` APIs (keyed by `ResourceARN`).
+   */
+  async applyTagDiff(resourceArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.cloudWatchClient.send(
+        new UntagResourceCommand6({ ResourceARN: resourceArn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from alarm ${resourceArn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.cloudWatchClient.send(
+        new TagResourceCommand6({ ResourceARN: resourceArn, Tags: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on alarm ${resourceArn}`);
+    }
+  }
   /**
    * Build PutMetricAlarm parameters from CDK properties
    */
@@ -17184,8 +17525,8 @@ import {
   DescribeSecretCommand,
   ListSecretsCommand,
   UpdateSecretCommand,
-  TagResourceCommand as TagResourceCommand3,
-  UntagResourceCommand as UntagResourceCommand3,
+  TagResourceCommand as TagResourceCommand7,
+  UntagResourceCommand as UntagResourceCommand7,
   ReplicateSecretToRegionsCommand,
   RemoveRegionsFromReplicationCommand,
   ResourceNotFoundException as ResourceNotFoundException8
@@ -17298,7 +17639,7 @@ var SecretsManagerSecretProvider = class {
           const oldTagKeys = oldTags.map((t) => t.Key).filter((k) => !!k);
           if (oldTagKeys.length > 0) {
             await this.smClient.send(
-              new UntagResourceCommand3({
+              new UntagResourceCommand7({
                 SecretId: physicalId,
                 TagKeys: oldTagKeys
               })
@@ -17307,7 +17648,7 @@ var SecretsManagerSecretProvider = class {
         }
         if (newTags && newTags.length > 0) {
           await this.smClient.send(
-            new TagResourceCommand3({
+            new TagResourceCommand7({
               SecretId: physicalId,
               Tags: newTags
             })
@@ -17911,8 +18252,8 @@ import {
   ListRulesCommand,
   ListTargetsByRuleCommand,
   ListTagsForResourceCommand as ListTagsForResourceCommand5,
-  TagResourceCommand as TagResourceCommand4,
-  UntagResourceCommand as UntagResourceCommand4,
+  TagResourceCommand as TagResourceCommand8,
+  UntagResourceCommand as UntagResourceCommand8,
   ResourceNotFoundException as ResourceNotFoundException9
 } from "@aws-sdk/client-eventbridge";
 init_aws_clients();
@@ -18065,7 +18406,7 @@ var EventBridgeRuleProvider = class {
           const oldTagKeys = oldTags.map((t) => t.Key).filter((k) => !!k);
           if (oldTagKeys.length > 0) {
             await this.eventBridgeClient.send(
-              new UntagResourceCommand4({
+              new UntagResourceCommand8({
                 ResourceARN: ruleArn,
                 TagKeys: oldTagKeys
               })
@@ -18074,7 +18415,7 @@ var EventBridgeRuleProvider = class {
         }
         if (newTags && newTags.length > 0) {
           await this.eventBridgeClient.send(
-            new TagResourceCommand4({
+            new TagResourceCommand8({
               ResourceARN: ruleArn,
               Tags: newTags
             })
@@ -18381,8 +18722,8 @@ import {
   RemoveTargetsCommand as RemoveTargetsCommand2,
   DeleteRuleCommand as DeleteRuleCommand2,
   ListTargetsByRuleCommand as ListTargetsByRuleCommand2,
-  TagResourceCommand as TagResourceCommand5,
-  UntagResourceCommand as UntagResourceCommand5,
+  TagResourceCommand as TagResourceCommand9,
+  UntagResourceCommand as UntagResourceCommand9,
   ResourceNotFoundException as ResourceNotFoundException10
 } from "@aws-sdk/client-eventbridge";
 init_aws_clients();
@@ -18495,7 +18836,7 @@ var EventBridgeBusProvider = class {
           const oldTagKeys = oldTags.map((t) => t.Key).filter((k) => !!k);
           if (oldTagKeys.length > 0) {
             await this.eventBridgeClient.send(
-              new UntagResourceCommand5({
+              new UntagResourceCommand9({
                 ResourceARN: busArn,
                 TagKeys: oldTagKeys
               })
@@ -18504,7 +18845,7 @@ var EventBridgeBusProvider = class {
         }
         if (newTags && newTags.length > 0) {
           await this.eventBridgeClient.send(
-            new TagResourceCommand5({
+            new TagResourceCommand9({
               ResourceARN: busArn,
               Tags: newTags
             })
@@ -18756,6 +19097,7 @@ import {
   AuthorizeSecurityGroupEgressCommand,
   RevokeSecurityGroupEgressCommand,
   CreateTagsCommand,
+  DeleteTagsCommand,
   DescribeSubnetsCommand as DescribeSubnetsCommand2,
   DescribeSecurityGroupsCommand as DescribeSecurityGroupsCommand2,
   RunInstancesCommand,
@@ -18920,7 +19262,7 @@ var EC2Provider = class {
   async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::EC2::VPC":
-        return this.updateVpc(logicalId, physicalId, resourceType, properties);
+        return this.updateVpc(logicalId, physicalId, resourceType, properties, previousProperties);
       case "AWS::EC2::Subnet":
         return this.updateSubnet(logicalId, physicalId);
       case "AWS::EC2::InternetGateway":
@@ -18958,7 +19300,13 @@ var EC2Provider = class {
           previousProperties
         );
       case "AWS::EC2::Instance":
-        return this.updateInstance(logicalId, physicalId, resourceType, properties);
+        return this.updateInstance(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::EC2::NetworkAcl":
       case "AWS::EC2::NetworkAclEntry":
       case "AWS::EC2::SubnetNetworkAclAssociation":
@@ -19104,7 +19452,7 @@ var EC2Provider = class {
       );
     }
   }
-  async updateVpc(logicalId, physicalId, resourceType, properties) {
+  async updateVpc(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating VPC ${logicalId}: ${physicalId}`);
     try {
       if (properties["EnableDnsHostnames"] !== void 0) {
@@ -19125,7 +19473,11 @@ var EC2Provider = class {
           })
         );
       }
-      await this.applyTags(physicalId, properties, logicalId);
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated VPC ${logicalId}`);
       return {
         physicalId,
@@ -19995,7 +20347,11 @@ var EC2Provider = class {
   async updateSecurityGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating SecurityGroup ${logicalId}: ${physicalId}`);
     try {
-      await this.applyTags(physicalId, properties, logicalId);
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       await this.applySecurityGroupRuleDiff(
         physicalId,
         previousProperties["SecurityGroupIngress"] ?? [],
@@ -20323,10 +20679,14 @@ var EC2Provider = class {
       );
     }
   }
-  async updateInstance(logicalId, physicalId, resourceType, _properties) {
+  async updateInstance(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating EC2 Instance ${logicalId}: ${physicalId}`);
     try {
-      await this.applyTags(physicalId, _properties, logicalId);
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const describeResponse = await this.ec2Client.send(
         new DescribeInstancesCommand({ InstanceIds: [physicalId] })
       );
@@ -20801,7 +21161,10 @@ var EC2Provider = class {
     }
   }
   /**
-   * Apply tags to an EC2 resource
+   * Apply tags to an EC2 resource (create-time, no removal).
+   *
+   * Used by `create*` paths. Update paths should use `applyTagDiff` instead
+   * to handle tag removal too.
    */
   async applyTags(resourceId, properties, logicalId) {
     const tags = properties["Tags"];
@@ -20821,6 +21184,64 @@ var EC2Provider = class {
       }
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via EC2's
+   * `CreateTags` / `DeleteTags` APIs. Used by `update*` paths so that
+   * tag removals reach AWS too. EC2 keys both APIs by a list of resource
+   * ids.
+   */
+  async applyTagDiff(resourceId, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push({ Key: k });
+    }
+    if (tagsToRemove.length > 0) {
+      try {
+        await this.ec2Client.send(
+          new DeleteTagsCommand({
+            Resources: [resourceId],
+            Tags: tagsToRemove
+          })
+        );
+        this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ${resourceId}`);
+      } catch (error) {
+        this.logger.warn(
+          `Failed to remove tags from ${resourceId}: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+    if (tagsToAdd.length > 0) {
+      try {
+        await this.ec2Client.send(
+          new CreateTagsCommand({
+            Resources: [resourceId],
+            Tags: tagsToAdd
+          })
+        );
+        this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on ${resourceId}`);
+      } catch (error) {
+        this.logger.warn(
+          `Failed to add tags on ${resourceId}: ${error instanceof Error ? error.message : String(error)}`
+        );
+      }
+    }
+  }
   /**
    * Check if an error indicates the resource was not found
    */
@@ -21167,6 +21588,8 @@ import {
   CreateAuthorizerCommand,
   DeleteAuthorizerCommand,
   GetAuthorizerCommand,
+  TagResourceCommand as TagResourceCommand10,
+  UntagResourceCommand as UntagResourceCommand10,
   NotFoundException as NotFoundException3
 } from "@aws-sdk/client-api-gateway";
 init_aws_clients();
@@ -21890,24 +22313,24 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
         value: description ?? ""
       });
     }
-    if (patchOperations.length === 0) {
-      this.logger.debug(`No changes detected for API Gateway Stage ${logicalId}`);
-      return {
-        physicalId,
-        wasReplaced: false,
-        attributes: {
-          StageName: physicalId
-        }
-      };
-    }
     try {
-      await this.apiGatewayClient.send(
-        new UpdateStageCommand({
-          restApiId,
-          stageName: physicalId,
-          patchOperations
-        })
-      );
+      if (patchOperations.length > 0) {
+        await this.apiGatewayClient.send(
+          new UpdateStageCommand({
+            restApiId,
+            stageName: physicalId,
+            patchOperations
+          })
+        );
+      }
+      const stageArn = await this.buildStageArn(restApiId, physicalId);
+      if (stageArn) {
+        await this.applyTagDiff(
+          stageArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       this.logger.debug(`Successfully updated API Gateway Stage ${logicalId}`);
       return {
         physicalId,
@@ -22142,6 +22565,63 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
     }
     return Promise.resolve(void 0);
   }
+  /**
+   * Build the ARN for an API Gateway Stage, used for tag mutations.
+   *
+   * Format: `arn:aws:apigateway:{region}::/restapis/{restApiId}/stages/{stageName}`.
+   * The double colon (`::`) is intentional: API Gateway tagging uses an
+   * account-id-less ARN.
+   */
+  async buildStageArn(restApiId, stageName) {
+    try {
+      const region = await this.apiGatewayClient.config.region();
+      return `arn:aws:apigateway:${region}::/restapis/${restApiId}/stages/${stageName}`;
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via API Gateway's
+   * `TagResource` / `UntagResource` APIs. API Gateway's `TagResource` takes
+   * lowercase camelCase fields plus a tag-map (`{ resourceArn, tags: {key: value} }`);
+   * `UntagResource` takes `{ resourceArn, tagKeys: [...] }`.
+   */
+  async applyTagDiff(resourceArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.apiGatewayClient.send(
+        new UntagResourceCommand10({ resourceArn, tagKeys: tagsToRemove })
+      );
+      this.logger.debug(
+        `Removed ${tagsToRemove.length} tag(s) from API Gateway resource ${resourceArn}`
+      );
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.apiGatewayClient.send(new TagResourceCommand10({ resourceArn, tags: tagsToAdd }));
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on API Gateway resource ${resourceArn}`
+      );
+    }
+  }
   /**
    * Sleep for specified milliseconds
    */
@@ -24175,6 +24655,8 @@ import {
   DescribeStateMachineCommand,
   ListStateMachinesCommand,
   ListTagsForResourceCommand as ListTagsForResourceCommand8,
+  TagResourceCommand as TagResourceCommand11,
+  UntagResourceCommand as UntagResourceCommand11,
   StateMachineDoesNotExist
 } from "@aws-sdk/client-sfn";
 var StepFunctionsProvider = class {
@@ -24277,7 +24759,7 @@ var StepFunctionsProvider = class {
   /**
    * Update a Step Functions state machine
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating Step Functions state machine ${logicalId}: ${physicalId}`);
     try {
       const definitionString = this.buildDefinitionString(properties);
@@ -24301,6 +24783,11 @@ var StepFunctionsProvider = class {
         })
       );
       this.logger.debug(`Updated Step Functions state machine ${physicalId}`);
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const describeResponse = await this.getClient().send(
         new DescribeStateMachineCommand({ stateMachineArn: physicalId })
       );
@@ -24502,6 +24989,49 @@ var StepFunctionsProvider = class {
     } while (nextToken);
     return null;
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via SFN's
+   * `TagResource` / `UntagResource` APIs. SFN uses lowercase camelCase
+   * (`{ key, value }`) for tags.
+   */
+  async applyTagDiff(stateMachineArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ key: k, value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new UntagResourceCommand11({ resourceArn: stateMachineArn, tagKeys: tagsToRemove })
+      );
+      this.logger.debug(
+        `Removed ${tagsToRemove.length} tag(s) from SFN state machine ${stateMachineArn}`
+      );
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(
+        new TagResourceCommand11({ resourceArn: stateMachineArn, tags: tagsToAdd })
+      );
+      this.logger.debug(
+        `Added/updated ${tagsToAdd.length} tag(s) on SFN state machine ${stateMachineArn}`
+      );
+    }
+  }
   /**
    * Match SFN's lowercase `key`/`value` tag shape against the CDK path.
    */
@@ -24553,7 +25083,9 @@ import {
   DescribeServicesCommand,
   ListClustersCommand,
   ListServicesCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand9
+  ListTagsForResourceCommand as ListTagsForResourceCommand9,
+  TagResourceCommand as TagResourceCommand12,
+  UntagResourceCommand as UntagResourceCommand12
 } from "@aws-sdk/client-ecs";
 function convertTags(tags) {
   if (!tags || tags.length === 0)
@@ -24648,7 +25180,13 @@ var ECSProvider = class {
   async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::ECS::Cluster":
-        return this.updateCluster(logicalId, physicalId, resourceType, properties);
+        return this.updateCluster(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::ECS::TaskDefinition":
         return this.updateTaskDefinition(logicalId, physicalId, resourceType, properties);
       case "AWS::ECS::Service":
@@ -24740,7 +25278,7 @@ var ECSProvider = class {
       );
     }
   }
-  async updateCluster(logicalId, physicalId, resourceType, properties) {
+  async updateCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating ECS cluster ${logicalId}: ${physicalId}`);
     const client = this.getClient();
     try {
@@ -24758,6 +25296,13 @@ var ECSProvider = class {
         new DescribeClustersCommand({ clusters: [physicalId] })
       );
       const cluster = describeResponse.clusters?.[0];
+      if (cluster?.clusterArn) {
+        await this.applyTagDiff(
+          cluster.clusterArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -25026,6 +25571,13 @@ var ECSProvider = class {
         })
       );
       const service = response.service;
+      if (service?.serviceArn) {
+        await this.applyTagDiff(
+          service.serviceArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -25127,6 +25679,42 @@ var ECSProvider = class {
     }
   }
   // ─── Helpers ────────────────────────────────────────────────────
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via ECS's
+   * `TagResource` / `UntagResource` APIs. ECS uses lowercase camelCase
+   * (`{ key, value }`) for tags. Resource ARN identifies the cluster /
+   * service / task definition.
+   */
+  async applyTagDiff(resourceArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ key: k, value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(new UntagResourceCommand12({ resourceArn, tagKeys: tagsToRemove }));
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ECS resource ${resourceArn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(new TagResourceCommand12({ resourceArn, tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on ECS resource ${resourceArn}`);
+    }
+  }
   /**
    * Convert CFn ContainerDefinitions to ECS SDK format.
    * CFn uses PascalCase, ECS SDK uses camelCase.
@@ -25574,6 +26162,8 @@ import {
   ModifyTargetGroupCommand,
   DescribeTargetGroupsCommand,
   DescribeTagsCommand,
+  AddTagsCommand,
+  RemoveTagsCommand,
   CreateListenerCommand,
   DeleteListenerCommand,
   ModifyListenerCommand,
@@ -25656,14 +26246,26 @@ var ELBv2Provider = class {
         );
     }
   }
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::ElasticLoadBalancingV2::LoadBalancer":
         return this.updateLoadBalancer(logicalId, physicalId, resourceType, properties);
       case "AWS::ElasticLoadBalancingV2::TargetGroup":
-        return this.updateTargetGroup(logicalId, physicalId, resourceType, properties);
+        return this.updateTargetGroup(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::ElasticLoadBalancingV2::Listener":
-        return this.updateListener(logicalId, physicalId, resourceType, properties);
+        return this.updateListener(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       default:
         throw new ProvisioningError(
           `Unsupported resource type: ${resourceType}`,
@@ -25842,7 +26444,7 @@ var ELBv2Provider = class {
       );
     }
   }
-  async updateTargetGroup(logicalId, physicalId, resourceType, properties) {
+  async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating TargetGroup ${logicalId}: ${physicalId}`);
     try {
       const matcher = properties["Matcher"];
@@ -25864,6 +26466,11 @@ var ELBv2Provider = class {
         new DescribeTargetGroupsCommand({ TargetGroupArns: [physicalId] })
       );
       const tg = describeResponse.TargetGroups?.[0];
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated TargetGroup ${logicalId}`);
       return {
         physicalId,
@@ -25957,7 +26564,7 @@ var ELBv2Provider = class {
       );
     }
   }
-  async updateListener(logicalId, physicalId, resourceType, properties) {
+  async updateListener(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating Listener ${logicalId}: ${physicalId}`);
     try {
       const defaultActions = this.convertActions(
@@ -25976,6 +26583,11 @@ var ELBv2Provider = class {
           ...certificates && { Certificates: certificates }
         })
       );
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated Listener ${logicalId}`);
       return {
         physicalId,
@@ -26033,6 +26645,44 @@ var ELBv2Provider = class {
       return [];
     return properties["Tags"];
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via ELBv2's
+   * `AddTags` / `RemoveTags` APIs. Both accept `ResourceArns: [arn]`
+   * (single ARN), `Tags: [{Key, Value}]` for AddTags, and
+   * `TagKeys: [...]` for RemoveTags.
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsCommand({ ResourceArns: [arn], TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ELBv2 resource ${arn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(new AddTagsCommand({ ResourceArns: [arn], Tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on ELBv2 resource ${arn}`);
+    }
+  }
   /**
    * Convert CDK DefaultActions to ELBv2 API Action format
    * CDK uses PascalCase property names matching the ELBv2 API, so pass through.
@@ -26347,7 +26997,9 @@ import {
   DeleteDBSubnetGroupCommand,
   DescribeDBSubnetGroupsCommand,
   ModifyDBSubnetGroupCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand10
+  ListTagsForResourceCommand as ListTagsForResourceCommand10,
+  AddTagsToResourceCommand as AddTagsToResourceCommand2,
+  RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand2
 } from "@aws-sdk/client-rds";
 var RDSProvider = class {
   rdsClient;
@@ -26414,14 +27066,32 @@ var RDSProvider = class {
         );
     }
   }
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::RDS::DBSubnetGroup":
-        return this.updateDBSubnetGroup(logicalId, physicalId, resourceType, properties);
+        return this.updateDBSubnetGroup(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::RDS::DBCluster":
-        return this.updateDBCluster(logicalId, physicalId, resourceType, properties);
+        return this.updateDBCluster(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::RDS::DBInstance":
-        return this.updateDBInstance(logicalId, physicalId, resourceType, properties);
+        return this.updateDBInstance(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       default:
         throw new ProvisioningError(
           `Unsupported resource type: ${resourceType}`,
@@ -26480,7 +27150,7 @@ var RDSProvider = class {
       );
     }
   }
-  async updateDBSubnetGroup(logicalId, physicalId, resourceType, properties) {
+  async updateDBSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating DBSubnetGroup ${logicalId}: ${physicalId}`);
     try {
       await this.getClient().send(
@@ -26490,6 +27160,17 @@ var RDSProvider = class {
           SubnetIds: properties["SubnetIds"]
         })
       );
+      const desc = await this.getClient().send(
+        new DescribeDBSubnetGroupsCommand({ DBSubnetGroupName: physicalId })
+      );
+      const arn = desc.DBSubnetGroups?.[0]?.DBSubnetGroupArn;
+      if (arn) {
+        await this.applyTagDiff(
+          arn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       this.logger.debug(`Successfully updated DBSubnetGroup ${logicalId}`);
       return {
         physicalId,
@@ -26604,7 +27285,7 @@ var RDSProvider = class {
       );
     }
   }
-  async updateDBCluster(logicalId, physicalId, resourceType, properties) {
+  async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating DBCluster ${logicalId}: ${physicalId}`);
     try {
       const serverlessV2Config = properties["ServerlessV2ScalingConfiguration"];
@@ -26628,6 +27309,13 @@ var RDSProvider = class {
       );
       this.logger.debug(`Successfully updated DBCluster ${logicalId}`);
       const described = await this.describeDBCluster(physicalId);
+      if (described?.DBClusterArn) {
+        await this.applyTagDiff(
+          described.DBClusterArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -26745,7 +27433,7 @@ var RDSProvider = class {
       );
     }
   }
-  async updateDBInstance(logicalId, physicalId, resourceType, properties) {
+  async updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating DBInstance ${logicalId}: ${physicalId}`);
     try {
       await this.getClient().send(
@@ -26758,6 +27446,13 @@ var RDSProvider = class {
       );
       this.logger.debug(`Successfully updated DBInstance ${logicalId}`);
       const described = await this.describeDBInstance(physicalId);
+      if (described?.DBInstanceArn) {
+        await this.applyTagDiff(
+          described.DBInstanceArn,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       return {
         physicalId,
         wasReplaced: false,
@@ -26828,6 +27523,45 @@ var RDSProvider = class {
     }
   }
   // ─── Helpers ──────────────────────────────────────────────────────
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via RDS's
+   * `AddTagsToResource` / `RemoveTagsFromResource` APIs (keyed by
+   * `ResourceName=arn`).
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsFromResourceCommand2({ ResourceName: arn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from RDS resource ${arn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(
+        new AddTagsToResourceCommand2({ ResourceName: arn, Tags: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on RDS resource ${arn}`);
+    }
+  }
   buildTags(properties) {
     if (!properties["Tags"])
       return [];
@@ -28115,6 +28849,8 @@ import {
   GetWebACLCommand,
   ListWebACLsCommand,
   ListTagsForResourceCommand as ListTagsForResourceCommand12,
+  TagResourceCommand as TagResourceCommand13,
+  UntagResourceCommand as UntagResourceCommand13,
   WAFNonexistentItemException
 } from "@aws-sdk/client-wafv2";
 function parseWebACLArn(arn) {
@@ -28221,7 +28957,7 @@ var WAFv2WebACLProvider = class {
    * Name and Scope are immutable - changes to those require replacement.
    * UpdateWebACL requires LockToken obtained from GetWebACL.
    */
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating WAFv2 WebACL ${logicalId}: ${physicalId}`);
     try {
       const { id, name, scope } = parseWebACLArn(physicalId);
@@ -28253,6 +28989,11 @@ var WAFv2WebACLProvider = class {
           AssociationConfig: properties["AssociationConfig"]
         })
       );
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated WAFv2 WebACL ${logicalId}`);
       return {
         physicalId,
@@ -28329,6 +29070,42 @@ var WAFv2WebACLProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via WAFv2's
+   * `TagResource` / `UntagResource` APIs (keyed by `ResourceARN`).
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new UntagResourceCommand13({ ResourceARN: arn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from WAFv2 WebACL ${arn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(new TagResourceCommand13({ ResourceARN: arn, Tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on WAFv2 WebACL ${arn}`);
+    }
+  }
   /**
    * Read the AWS-current WAFv2 WebACL configuration in CFn-property shape.
    *
@@ -28943,7 +29720,9 @@ import {
   DeleteCacheSubnetGroupCommand,
   ModifyCacheSubnetGroupCommand,
   ModifyCacheClusterCommand,
-  ListTagsForResourceCommand as ListTagsForResourceCommand14
+  ListTagsForResourceCommand as ListTagsForResourceCommand14,
+  AddTagsToResourceCommand as AddTagsToResourceCommand3,
+  RemoveTagsFromResourceCommand as RemoveTagsFromResourceCommand3
 } from "@aws-sdk/client-elasticache";
 import { STSClient as STSClient6, GetCallerIdentityCommand as GetCallerIdentityCommand6 } from "@aws-sdk/client-sts";
 var ElastiCacheProvider = class {
@@ -29009,12 +29788,18 @@ var ElastiCacheProvider = class {
         );
     }
   }
-  async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::ElastiCache::SubnetGroup":
         return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties);
       case "AWS::ElastiCache::CacheCluster":
-        return this.updateCacheCluster(logicalId, physicalId, resourceType, properties);
+        return this.updateCacheCluster(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       default:
         throw new ProvisioningError(
           `Unsupported resource type: ${resourceType}`,
@@ -29199,7 +29984,7 @@ var ElastiCacheProvider = class {
       );
     }
   }
-  async updateCacheCluster(logicalId, physicalId, resourceType, properties) {
+  async updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating CacheCluster ${logicalId}: ${physicalId}`);
     try {
       await this.getClient().send(
@@ -29222,6 +30007,13 @@ var ElastiCacheProvider = class {
       this.logger.debug(`Successfully updated CacheCluster ${logicalId}`);
       await this.waitForClusterAvailable(physicalId);
       const described = await this.describeCacheCluster(physicalId);
+      if (described?.ARN) {
+        await this.applyTagDiff(
+          described.ARN,
+          previousProperties["Tags"],
+          properties["Tags"]
+        );
+      }
       const attributes = {};
       if (described?.CacheNodes?.[0]?.Endpoint) {
         const endpoint = described.CacheNodes[0].Endpoint;
@@ -29286,6 +30078,45 @@ var ElastiCacheProvider = class {
     }
   }
   // ─── Helpers ──────────────────────────────────────────────────────
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via ElastiCache's
+   * `AddTagsToResource` / `RemoveTagsFromResource` APIs (keyed by
+   * `ResourceName=arn`).
+   */
+  async applyTagDiff(arn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsFromResourceCommand3({ ResourceName: arn, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from ElastiCache resource ${arn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(
+        new AddTagsToResourceCommand3({ ResourceName: arn, Tags: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on ElastiCache resource ${arn}`);
+    }
+  }
   buildTags(properties) {
     if (!properties["Tags"])
       return [];
@@ -31613,8 +32444,8 @@ import {
   PutKeyPolicyCommand,
   EnableKeyCommand,
   DisableKeyCommand,
-  TagResourceCommand as TagResourceCommand6,
-  UntagResourceCommand as UntagResourceCommand6,
+  TagResourceCommand as TagResourceCommand14,
+  UntagResourceCommand as UntagResourceCommand14,
   NotFoundException as NotFoundException5
 } from "@aws-sdk/client-kms";
 var KMSProvider = class {
@@ -31799,26 +32630,11 @@ var KMSProvider = class {
           await this.getClient().send(new EnableKeyCommand({ KeyId: physicalId }));
         }
       }
-      const newTags = properties["Tags"];
-      const oldTags = previousProperties["Tags"];
-      if (JSON.stringify(newTags) !== JSON.stringify(oldTags)) {
-        if (oldTags && oldTags.length > 0) {
-          await this.getClient().send(
-            new UntagResourceCommand6({
-              KeyId: physicalId,
-              TagKeys: oldTags.map((t) => t.Key)
-            })
-          );
-        }
-        if (newTags && newTags.length > 0) {
-          await this.getClient().send(
-            new TagResourceCommand6({
-              KeyId: physicalId,
-              Tags: newTags.map((t) => ({ TagKey: t.Key, TagValue: t.Value }))
-            })
-          );
-        }
-      }
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const newKeyPolicy = properties["KeyPolicy"];
       const oldKeyPolicy = previousProperties["KeyPolicy"];
       const newPolicyStr = newKeyPolicy ? typeof newKeyPolicy === "string" ? newKeyPolicy : JSON.stringify(newKeyPolicy) : void 0;
@@ -31880,6 +32696,43 @@ var KMSProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via KMS's
+   * `TagResource` / `UntagResource` APIs. KMS uses `{TagKey, TagValue}`
+   * (NOT the standard `{Key, Value}` shape) keyed by `KeyId`.
+   */
+  async applyTagDiff(keyId, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ TagKey: k, TagValue: v });
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new UntagResourceCommand14({ KeyId: keyId, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from KMS Key ${keyId}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(new TagResourceCommand14({ KeyId: keyId, Tags: tagsToAdd }));
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on KMS Key ${keyId}`);
+    }
+  }
   // ─── AWS::KMS::Alias ───────────────────────────────────────────────
   async createAlias(logicalId, resourceType, properties) {
     this.logger.debug(`Creating KMS Alias ${logicalId}`);
@@ -32164,6 +33017,7 @@ import {
   DescribeStreamCommand,
   UpdateShardCountCommand,
   AddTagsToStreamCommand,
+  RemoveTagsFromStreamCommand,
   IncreaseStreamRetentionPeriodCommand,
   DecreaseStreamRetentionPeriodCommand,
   StartStreamEncryptionCommand,
@@ -32341,6 +33195,11 @@ var KinesisStreamProvider = class {
         }
         await this.waitForStreamActive(physicalId);
       }
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       const newEncryption = properties["StreamEncryption"];
       const oldEncryption = previousProperties["StreamEncryption"];
       if (JSON.stringify(newEncryption) !== JSON.stringify(oldEncryption)) {
@@ -32422,6 +33281,47 @@ var KinesisStreamProvider = class {
       );
     }
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via Kinesis's
+   * `AddTagsToStream` (map shape) / `RemoveTagsFromStream` (TagKeys list)
+   * APIs.
+   */
+  async applyTagDiff(streamName, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = {};
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd[k] = v;
+    }
+    const tagsToRemove = [];
+    for (const k of oldMap.keys()) {
+      if (!newMap.has(k))
+        tagsToRemove.push(k);
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsFromStreamCommand({ StreamName: streamName, TagKeys: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from Kinesis stream ${streamName}`);
+    }
+    if (Object.keys(tagsToAdd).length > 0) {
+      await this.getClient().send(
+        new AddTagsToStreamCommand({ StreamName: streamName, Tags: tagsToAdd })
+      );
+      this.logger.debug(
+        `Added/updated ${Object.keys(tagsToAdd).length} tag(s) on Kinesis stream ${streamName}`
+      );
+    }
+  }
   /**
    * Adopt an existing Kinesis stream into cdkd state.
    *
@@ -33782,6 +34682,8 @@ import {
   GetEventSelectorsCommand,
   ListTrailsCommand,
   ListTagsCommand as ListTagsCommand3,
+  AddTagsCommand as AddTagsCommand2,
+  RemoveTagsCommand as RemoveTagsCommand2,
   TrailNotFoundException
 } from "@aws-sdk/client-cloudtrail";
 var CloudTrailProvider = class {
@@ -33965,6 +34867,11 @@ var CloudTrailProvider = class {
           await this.getClient().send(new StartLoggingCommand({ Name: physicalId }));
         }
       }
+      await this.applyTagDiff(
+        physicalId,
+        previousProperties["Tags"],
+        properties["Tags"]
+      );
       this.logger.debug(`Successfully updated CloudTrail Trail ${logicalId}`);
       return { physicalId, wasReplaced: false };
     } catch (error) {
@@ -34013,6 +34920,46 @@ var CloudTrailProvider = class {
   getAttribute(_physicalId, _resourceType, attributeName) {
     return Promise.resolve(attributeName);
   }
+  /**
+   * Apply a diff between old and new CFn-shape Tags arrays via CloudTrail's
+   * `AddTags` / `RemoveTags` APIs. Note: CloudTrail's `RemoveTags` takes
+   * full `{Key, Value}` objects in `TagsList` (NOT just keys), unlike most
+   * other AWS services.
+   */
+  async applyTagDiff(trailArn, oldTagsRaw, newTagsRaw) {
+    const toMap = (tags) => {
+      const m = /* @__PURE__ */ new Map();
+      for (const t of tags ?? []) {
+        if (t.Key !== void 0 && t.Value !== void 0)
+          m.set(t.Key, t.Value);
+      }
+      return m;
+    };
+    const oldMap = toMap(oldTagsRaw);
+    const newMap = toMap(newTagsRaw);
+    const tagsToAdd = [];
+    for (const [k, v] of newMap) {
+      if (oldMap.get(k) !== v)
+        tagsToAdd.push({ Key: k, Value: v });
+    }
+    const tagsToRemove = [];
+    for (const [k, v] of oldMap) {
+      if (!newMap.has(k))
+        tagsToRemove.push({ Key: k, Value: v });
+    }
+    if (tagsToRemove.length > 0) {
+      await this.getClient().send(
+        new RemoveTagsCommand2({ ResourceId: trailArn, TagsList: tagsToRemove })
+      );
+      this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from CloudTrail Trail ${trailArn}`);
+    }
+    if (tagsToAdd.length > 0) {
+      await this.getClient().send(
+        new AddTagsCommand2({ ResourceId: trailArn, TagsList: tagsToAdd })
+      );
+      this.logger.debug(`Added/updated ${tagsToAdd.length} tag(s) on CloudTrail Trail ${trailArn}`);
+    }
+  }
   /**
    * Adopt an existing CloudTrail trail into cdkd state.
    *
@@ -35836,7 +36783,7 @@ import {
   SetRepositoryPolicyCommand,
   PutImageScanningConfigurationCommand,
   PutImageTagMutabilityCommand,
-  TagResourceCommand as TagResourceCommand7,
+  TagResourceCommand as TagResourceCommand15,
   ListTagsForResourceCommand as ListTagsForResourceCommand18,
   LifecyclePolicyNotFoundException,
   RepositoryNotFoundException
@@ -36002,7 +36949,7 @@ var ECRProvider = class {
         const repoArn = describeResponse.repositories?.[0]?.repositoryArn;
         if (repoArn && newTags) {
           await this.getClient().send(
-            new TagResourceCommand7({
+            new TagResourceCommand15({
               resourceArn: repoArn,
               tags: newTags
             })
@@ -38885,6 +39832,19 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
     }
   }
 }
+function buildRevertNewProperties(drifts, desiredProperties, awsProperties) {
+  const result = { ...awsProperties };
+  for (const d of drifts) {
+    const topLevelKey = d.path.split(".", 1)[0];
+    if (!topLevelKey)
+      continue;
+    if (topLevelKey in desiredProperties) {
+      result[topLevelKey] = desiredProperties[topLevelKey];
+    } else {
+    }
+  }
+  return result;
+}
 async function runRevert(reports, providerRegistry, stateConfig, awsClients, options) {
   const logger = getLogger();
   printRevertPlan(reports);
@@ -38927,13 +39887,18 @@ async function runRevert(reports, providerRegistry, stateConfig, awsClients, opt
         }
         const provider = providerRegistry.getProvider(outcome.resourceType);
         const desiredProperties = stateResource.observedProperties ?? stateResource.properties ?? {};
+        const newProperties = buildRevertNewProperties(
+          outcome.changes,
+          desiredProperties,
+          outcome.awsProperties
+        );
         try {
           await withRetry(
             () => provider.update(
               outcome.logicalId,
               stateResource.physicalId,
               outcome.resourceType,
-              desiredProperties,
+              newProperties,
               outcome.awsProperties
             ),
             outcome.logicalId,
@@ -42566,7 +43531,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.50.5");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.50.7");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());