@go-to-k/cdkd 0.231.6 → 0.231.8

package/dist/cli.js

@@ -8,7 +8,7 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, ListUserTagsCommand, ListUsersCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, ListQueuesCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
-import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
+import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListSubscriptionsByTopicCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
 import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListFunctionsCommand, ListLayersCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
@@ -1445,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.231.6";
+	return "0.231.8";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -7021,6 +7021,10 @@ var SNSTopicProvider = class {
 						}));
 					}
 				}
+				if (Array.isArray(properties["Subscription"])) {
+					const subscriptions = properties["Subscription"];
+					for (const sub of subscriptions) await this.subscribeInline(topicArn, sub, logicalId);
+				}
 			} catch (innerError) {
 				try {
 					await this.snsClient.send(new DeleteTopicCommand({ TopicArn: topicArn }));
@@ -7123,6 +7127,7 @@ var SNSTopicProvider = class {
 				}));
 			}
 		}
+		if (JSON.stringify(properties["Subscription"]) !== JSON.stringify(previousProperties["Subscription"])) await this.reconcileInlineSubscriptions(physicalId, previousProperties["Subscription"] || [], properties["Subscription"] || [], logicalId);
 		const newTags = properties["Tags"];
 		const oldTags = previousProperties["Tags"];
 		if (JSON.stringify(newTags) !== JSON.stringify(oldTags)) {
@@ -7149,6 +7154,81 @@ var SNSTopicProvider = class {
 		};
 	}
 	/**
+	* Subscribe a single inline `Subscription` entry to the topic.
+	*
+	* Each entry carries at least `Protocol` + `Endpoint` (the two required CFn
+	* fields). Documented optional subscription attributes that are settable at
+	* subscribe time are passed through the `Subscribe` `Attributes` map
+	* (`RawMessageDelivery`, `FilterPolicy`, `FilterPolicyScope`, `RedrivePolicy`,
+	* `DeliveryPolicy`, `ReplayPolicy`, `SubscriptionRoleArn`). Object-valued
+	* attributes (policies) are JSON-stringified; everything else is stringified
+	* verbatim — AWS's `SubscribeCommand` accepts `Attributes` as a
+	* `Record<string,string>`.
+	*/
+	async subscribeInline(topicArn, sub, logicalId) {
+		const protocol = sub["Protocol"];
+		const endpoint = sub["Endpoint"];
+		if (typeof protocol !== "string" || typeof endpoint !== "string") throw new Error(`SNS topic ${logicalId}: inline Subscription entry requires string Protocol and Endpoint, got ${JSON.stringify(sub)}`);
+		const attributes = buildSubscriptionAttributes(sub);
+		const input = {
+			TopicArn: topicArn,
+			Protocol: protocol,
+			Endpoint: endpoint,
+			ReturnSubscriptionArn: true,
+			...Object.keys(attributes).length > 0 && { Attributes: attributes }
+		};
+		await this.snsClient.send(new SubscribeCommand(input));
+		this.logger.debug(`Subscribed ${protocol}:${endpoint} to topic ${topicArn} for ${logicalId}`);
+	}
+	/**
+	* Reconcile the inline `Subscription` list on an UPDATE: add entries present
+	* in the new list but not the old, and unsubscribe entries present in the
+	* old list but not the new. Identity is `(Protocol, Endpoint)`.
+	*
+	* Removals need the live `SubscriptionArn`, which the template does not
+	* carry — resolve it via `ListSubscriptionsByTopic` (paginated). A removed
+	* entry whose subscription is still `PendingConfirmation` (never confirmed)
+	* has no ARN to unsubscribe and is skipped with a debug log.
+	*
+	* KNOWN LIMITATION: identity is `(Protocol, Endpoint)` only, so an
+	* attribute-only change on an UNCHANGED endpoint (e.g. editing `FilterPolicy`
+	* / `RawMessageDelivery` while keeping the same protocol+endpoint) is neither
+	* an add nor a remove and is therefore NOT re-applied here — it would need a
+	* `SetSubscriptionAttributes` pass. CloudFormation updates those in place.
+	* The primary #980 silent-drop (create / add / remove / drift) is fixed; the
+	* attribute-only in-place update is a deliberately-scoped follow-up.
+	*/
+	async reconcileInlineSubscriptions(topicArn, oldSubs, newSubs, logicalId) {
+		const key = (protocol, endpoint) => `${String(protocol)}${String(endpoint)}`;
+		const oldKeys = new Set(oldSubs.map((s) => key(s["Protocol"], s["Endpoint"])));
+		const newKeys = new Set(newSubs.map((s) => key(s["Protocol"], s["Endpoint"])));
+		for (const sub of newSubs) if (!oldKeys.has(key(sub["Protocol"], sub["Endpoint"]))) await this.subscribeInline(topicArn, sub, logicalId);
+		const removed = oldSubs.filter((s) => !newKeys.has(key(s["Protocol"], s["Endpoint"])));
+		if (removed.length === 0) return;
+		const arnByKey = /* @__PURE__ */ new Map();
+		let nextToken;
+		do {
+			const resp = await this.snsClient.send(new ListSubscriptionsByTopicCommand({
+				TopicArn: topicArn,
+				...nextToken && { NextToken: nextToken }
+			}));
+			for (const s of resp.Subscriptions ?? []) {
+				if (!s.SubscriptionArn || s.SubscriptionArn === "PendingConfirmation") continue;
+				arnByKey.set(key(s.Protocol, s.Endpoint), s.SubscriptionArn);
+			}
+			nextToken = resp.NextToken;
+		} while (nextToken);
+		for (const sub of removed) {
+			const arn = arnByKey.get(key(sub["Protocol"], sub["Endpoint"]));
+			if (!arn) {
+				this.logger.debug(`No confirmed SubscriptionArn for ${String(sub["Protocol"])}:${String(sub["Endpoint"])} on topic ${topicArn} — skipping unsubscribe`);
+				continue;
+			}
+			await this.snsClient.send(new UnsubscribeCommand({ SubscriptionArn: arn }));
+			this.logger.debug(`Unsubscribed ${arn} from topic ${topicArn} for ${logicalId}`);
+		}
+	}
+	/**
 	* Delete an SNS topic
 	*/
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
@@ -7217,8 +7297,12 @@ var SNSTopicProvider = class {
 	* comparator would fire false drift on every clean run for any
 	* lowercase-`Protocol` template.
 	*
-	* `Subscription` is omitted because CDK manages it via separate
-	* `AWS::SNS::Subscription` resources, not as a Topic property.
+	* `Subscription` is reverse-mapped from `ListSubscriptionsByTopic` ONLY
+	* when the passed-in `properties` recorded an inline `Subscription` list
+	* (issue #980) — L1 `CfnTopic` / migrated CloudFormation. A Topic whose
+	* subscriptions are separate `AWS::SNS::Subscription` resources (CDK L2
+	* `addSubscription()`) has no inline list in state, so its subscriptions
+	* are not surfaced here (they belong to sibling resources).
 	*
 	* Returns `undefined` when the topic is gone (`NotFoundException`).
 	*/
@@ -7260,16 +7344,38 @@ var SNSTopicProvider = class {
 			if (err instanceof NotFoundException) return void 0;
 			throw err;
 		}
+		if (Array.isArray(properties?.["Subscription"])) {
+			const subs = [];
+			let nextToken;
+			do {
+				const resp = await this.snsClient.send(new ListSubscriptionsByTopicCommand({
+					TopicArn: physicalId,
+					...nextToken && { NextToken: nextToken }
+				}));
+				for (const s of resp.Subscriptions ?? []) {
+					if (!s.Protocol || !s.Endpoint) continue;
+					subs.push({
+						Protocol: s.Protocol,
+						Endpoint: s.Endpoint
+					});
+				}
+				nextToken = resp.NextToken;
+			} while (nextToken);
+			subs.sort((a, b) => `${String(a["Protocol"])} ${String(a["Endpoint"])}`.localeCompare(`${String(b["Protocol"])} ${String(b["Endpoint"])}`));
+			result["Subscription"] = subs;
+		}
 		return result;
 	}
 	/**
-	* Only `Subscription` remains drift-unknown — CDK manages topic
-	* subscriptions via separate `AWS::SNS::Subscription` resources, so the
-	* inline `Topic.Subscription` property is intentionally not surfaced.
-	* `DeliveryStatusLogging` is now reverse-mapped (see `readCurrentState`).
+	* No drift-unknown paths remain. `DeliveryStatusLogging` is reverse-mapped
+	* (see `readCurrentState`), and the inline `Subscription` list is now
+	* reverse-mapped too (issue #980) — but only when state actually recorded
+	* inline subscriptions, so a Topic whose subscriptions are managed as
+	* separate `AWS::SNS::Subscription` resources (CDK L2 `addSubscription()`)
+	* does not surface them here.
 	*/
 	getDriftUnknownPaths() {
-		return ["Subscription"];
+		return [];
 	}
 	/**
 	* Adopt an existing SNS topic into cdkd state.
@@ -7320,6 +7426,30 @@ var SNSTopicProvider = class {
 		return null;
 	}
 };
+const SNS_SUBSCRIPTION_ATTRIBUTE_KEYS = [
+	"RawMessageDelivery",
+	"FilterPolicy",
+	"FilterPolicyScope",
+	"RedrivePolicy",
+	"DeliveryPolicy",
+	"ReplayPolicy",
+	"SubscriptionRoleArn"
+];
+/**
+* Build the SNS `Subscribe` `Attributes` map from an inline `Subscription`
+* entry, skipping the required `Protocol` / `Endpoint` fields. Undefined /
+* null values are omitted; object values (policy documents) are
+* JSON-stringified; scalars are `String()`-coerced.
+*/
+function buildSubscriptionAttributes(sub) {
+	const attributes = {};
+	for (const key of SNS_SUBSCRIPTION_ATTRIBUTE_KEYS) {
+		const value = sub[key];
+		if (value === void 0 || value === null) continue;
+		attributes[key] = typeof value === "object" ? JSON.stringify(value) : String(value);
+	}
+	return attributes;
+}
 const SNS_DELIVERY_STATUS_PROTOCOLS = [
 	"Application",
 	"Firehose",
@@ -20131,9 +20261,9 @@ var StepFunctionsProvider = class {
 		this.logger.debug(`Updating Step Functions state machine ${logicalId}: ${physicalId}`);
 		try {
 			const definitionString = await this.buildDefinitionString(properties);
-			const encryptionConfiguration = mapEncryptionConfiguration(properties["EncryptionConfiguration"]);
-			const loggingConfiguration = mapLoggingConfiguration(properties["LoggingConfiguration"]);
-			const tracingConfiguration = mapTracingConfiguration(properties["TracingConfiguration"]);
+			const encryptionConfiguration = mapEncryptionConfiguration(properties["EncryptionConfiguration"]) ?? disabledEncryptionConfigurationOnRemoval(previousProperties["EncryptionConfiguration"], properties["EncryptionConfiguration"]);
+			const loggingConfiguration = mapLoggingConfiguration(properties["LoggingConfiguration"]) ?? disabledLoggingConfigurationOnRemoval(previousProperties["LoggingConfiguration"], properties["LoggingConfiguration"]);
+			const tracingConfiguration = mapTracingConfiguration(properties["TracingConfiguration"]) ?? disabledTracingConfigurationOnRemoval(previousProperties["TracingConfiguration"], properties["TracingConfiguration"]);
 			await this.getClient().send(new UpdateStateMachineCommand({
 				stateMachineArn: physicalId,
 				definition: definitionString,
@@ -20457,6 +20587,59 @@ function mapTracingConfiguration(value) {
 	if (cfg["Enabled"] === void 0) return void 0;
 	return { enabled: cfg["Enabled"] };
 }
+/**
+* Return the SDK disable payload for `EncryptionConfiguration` when it was
+* present+configured in the previous properties but is absent/placeholder in
+* the new ones; otherwise `undefined` (no clear needed). `AWS_OWNED_KEY` is
+* the AWS default, so this resets a customer-managed-key config back to default.
+*/
+function disabledEncryptionConfigurationOnRemoval(previous, next) {
+	if (!wasMeaningfullyConfigured(previous, "Type")) return void 0;
+	if (mapEncryptionConfiguration(next) !== void 0) return void 0;
+	return { type: "AWS_OWNED_KEY" };
+}
+/**
+* Return the SDK disable payload for `LoggingConfiguration` when it was
+* present+configured in the previous properties but is absent/placeholder in
+* the new ones; otherwise `undefined`. `level: OFF` disables logging;
+* `destinations: []` clears the log destinations (only required when level is
+* not OFF, so an empty list is accepted alongside OFF).
+*/
+function disabledLoggingConfigurationOnRemoval(previous, next) {
+	if (!wasMeaningfullyConfigured(previous, "Level")) return void 0;
+	if (mapLoggingConfiguration(next) !== void 0) return void 0;
+	return {
+		level: "OFF",
+		includeExecutionData: false,
+		destinations: []
+	};
+}
+/**
+* Return the SDK disable payload for `TracingConfiguration` when it was
+* present+enabled in the previous properties but is absent/placeholder in the
+* new ones; otherwise `undefined`. `enabled: false` turns X-Ray tracing off.
+*
+* Unlike logging/encryption, the "meaningful" signal here is `Enabled === true`
+* (a previous `{ Enabled: false }` is already the AWS default, so there is
+* nothing to clear).
+*/
+function disabledTracingConfigurationOnRemoval(previous, next) {
+	if (previous === null || typeof previous !== "object") return void 0;
+	if (previous["Enabled"] !== true) return void 0;
+	if (mapTracingConfiguration(next) !== void 0) return void 0;
+	return { enabled: false };
+}
+/**
+* True when `value` is an object that carries a defined `discriminatorKey`
+* field (`Level` for logging, `Type` for encryption) — i.e. it was a real,
+* non-placeholder config in the previous properties. The empty-placeholder
+* shape `{}` that `readCurrentState` emits has no discriminator, so it returns
+* false and no clear is emitted.
+*/
+function wasMeaningfullyConfigured(value, discriminatorKey) {
+	if (value === null || typeof value !== "object") return false;
+	return value[discriminatorKey] !== void 0;
+}
 
 //#endregion
 //#region src/provisioning/providers/ecs-provider.ts
@@ -55594,7 +55777,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.231.6");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.231.8");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());