@go-to-k/cdkd 0.229.5 → 0.229.7

package/dist/cli.js

@@ -1556,7 +1556,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.229.5";
+	return "0.229.7";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -9780,6 +9780,29 @@ var LambdaLayerVersionProvider = class {
 * intervals, eliminating the CC API intermediary overhead and reducing total
 * wait time.
 */
+/**
+* Map CloudFormation's `SSESpecification` shape to the DynamoDB SDK's.
+*
+* The CFn property names the enable flag `SSEEnabled`, but the SDK
+* `CreateTableCommandInput.SSESpecification` field is `Enabled`. Passing the
+* CFn shape verbatim makes the SDK silently ignore the unknown `SSEEnabled`
+* key, so the table is created with AWS-owned (default) encryption instead of
+* the requested AWS-managed / customer-managed KMS encryption — a silent
+* security downgrade with no error. `SSEType` and `KMSMasterKeyId` keep the
+* same names across CFn and the SDK.
+*
+* Returns `undefined` for an absent / non-object value so the caller omits the
+* field entirely. Exported for unit testing.
+*/
+function mapSSESpecification(raw) {
+	if (raw === null || typeof raw !== "object") return;
+	const cfn = raw;
+	const out = {};
+	if (cfn.SSEEnabled !== void 0) out.Enabled = cfn.SSEEnabled === true || cfn.SSEEnabled === "true";
+	if (typeof cfn.SSEType === "string") out.SSEType = cfn.SSEType;
+	if (typeof cfn.KMSMasterKeyId === "string") out.KMSMasterKeyId = cfn.KMSMasterKeyId;
+	return out;
+}
 var DynamoDBTableProvider = class {
 	dynamoDBClient;
 	logger = getLogger().child("DynamoDBTableProvider");
@@ -9843,7 +9866,8 @@ var DynamoDBTableProvider = class {
 			};
 			if (properties["GlobalSecondaryIndexes"]) createParams.GlobalSecondaryIndexes = properties["GlobalSecondaryIndexes"];
 			if (properties["LocalSecondaryIndexes"]) createParams.LocalSecondaryIndexes = properties["LocalSecondaryIndexes"];
-			if (properties["SSESpecification"]) createParams.SSESpecification = properties["SSESpecification"];
+			const sse = mapSSESpecification(properties["SSESpecification"]);
+			if (sse && Object.keys(sse).length > 0) createParams.SSESpecification = sse;
 			if (properties["Tags"]) createParams.Tags = properties["Tags"];
 			if (properties["DeletionProtectionEnabled"] !== void 0) createParams.DeletionProtectionEnabled = properties["DeletionProtectionEnabled"];
 			if (properties["TableClass"]) createParams.TableClass = properties["TableClass"];
@@ -9924,6 +9948,17 @@ var DynamoDBTableProvider = class {
 					this.logger.debug(`Updated WarmThroughput on DynamoDB table ${physicalId}`);
 				}
 			}
+			if (JSON.stringify(properties["SSESpecification"]) !== JSON.stringify(previousProperties["SSESpecification"])) {
+				const sseUpdate = mapSSESpecification(properties["SSESpecification"]);
+				if (sseUpdate && Object.keys(sseUpdate).length > 0) {
+					await this.dynamoDBClient.send(new UpdateTableCommand({
+						TableName: physicalId,
+						SSESpecification: sseUpdate
+					}));
+					await this.waitForTableActiveAfterUpdate(physicalId);
+					this.logger.debug(`Updated SSESpecification on DynamoDB table ${physicalId}`);
+				}
+			}
 			if (JSON.stringify(properties["GlobalSecondaryIndexes"]) !== JSON.stringify(previousProperties["GlobalSecondaryIndexes"])) await this.applyGsiUpdates(physicalId, resourceType, logicalId, previousProperties["GlobalSecondaryIndexes"], properties["GlobalSecondaryIndexes"], properties["AttributeDefinitions"]);
 			if (JSON.stringify(properties["PointInTimeRecoverySpecification"]) !== JSON.stringify(previousProperties["PointInTimeRecoverySpecification"])) await this.applyPointInTimeRecovery(physicalId, properties["PointInTimeRecoverySpecification"], previousProperties["PointInTimeRecoverySpecification"]);
 			if (JSON.stringify(properties["TimeToLiveSpecification"]) !== JSON.stringify(previousProperties["TimeToLiveSpecification"])) await this.applyTimeToLive(physicalId, properties["TimeToLiveSpecification"], previousProperties["TimeToLiveSpecification"]);
@@ -55032,7 +55067,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.229.5");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.229.7");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());