@go-to-k/cdkd 0.265.3 → 0.267.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as createAssetRedirectResolver, $t as ResourceTimeoutError, A as CloudControlProvider, At as MIGRATE_TMP_PREFIX, B as assertRegionMatch, Bt as setAwsClients, C as green, Ct as resolveSkipPrefix, D as collectInlinePolicyNamesManagedBySiblings, Dt as warnDeprecatedNoPrefixCliFlag, E as IAMRoleProvider, Et as resolveUseCdkBootstrapAssets, F as cfnRefValueFromPhysicalId, G as LockManager, Gt as LocalInvokeBuildError$1, H as DiffCalculator, Ht as CdkdError, I as refStateLookupFromResource, It as resolveBucketRegion, J as shouldRetainResource, K as S3StateBackend, Kt as LocalMigrateError, L as WAFv2WebACLProvider, Lt as AwsClients, M as disableInstanceApiTermination, Mt as uploadCfnTemplate, N as isTerminationProtectionPropagationError, Nt as expectedOwnerParam, O as ProviderRegistry, Ot as CFN_TEMPLATE_BODY_LIMIT, P as IntrinsicFunctionResolver, Pt as AssemblyReader, Q as buildAssetRedirectMap, Qt as ProvisioningError, R as normalizeAwsTagsToCfn, Rt as getAwsClients, S as gray, St as resolveCaptureObservedState, T as yellow, Tt as resolveStateBucketWithDefaultAndSource, U as DagBuilder, V as applyRoleArnIfSet, W as TemplateParser, X as stringifyValue, Xt as NestedStackChildDirectDestroyError, Y as AssetPublisher, Yt as MissingCdkCliError, Z as WorkGraph, Zt as PartialFailureError, _ as isStatefulRecreateTargetSync, _t as synthesisStatusMessage, a as DeploymentEventsStore, at as getBootstrapMarkerKey, b as bold, bt as resolveApp, c as replayFailedOperations, cn as withErrorHandling, ct as validateContainerRepoName, d as withRetry, dt as getDockerCmd, en as ResourceUpdateNotSupportedError, et as loadPublishableAssetManifest, f as isRetryableTransientError, ft as runDockerForeground, g as MULTI_REGION_RECREATE_BLOCKED_TYPES, gt as Synthesizer, h as extractDeploymentEventError, ht as getDockerImageBySourceHash, i as DeploymentEventsReader, it as ensureAssetStorage, j as slowCcOperationTimeoutMs, jt as findLargeInlineResources, k as findActionableSilentDrops, kt as CFN_TEMPLATE_URL_LIMIT, l as replayRollback, lt as buildDockerImage, m as computeImplicitDeleteEdges, mt as AssetManifestLoader, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as StackTerminationProtectionError, nt as AssetModeResolver, o as planFailedOps, ot as parseBootstrapMarker, p as IMPLICIT_DELETE_DEPENDENCIES, pt as runDockerStreaming, q as rebuildClientForBucketRegion, qt as LocalStartServiceError, r as DeployEngine, rt as BOOTSTRAP_MARKER_PREFIX, s as planRollback, sn as normalizeAwsError, st as validateAssetBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as StackHasActiveImportsError, tt as rewriteTemplateAssetReferences, u as withResourceDeadline, ut as formatDockerLoginError, v as renderStatefulReason, vt as getDefaultStateBucketName, w as red, wt as resolveStateBucketWithDefault, x as cyan, xt as resolveAutoAssetStorage, y as formatResourceLine, yt as getLegacyStateBucketName, z as resolveExplicitPhysicalId, zt as resetAwsClients } from "./deploy-engine-CyxJwyBN.js";
+import { $ as createAssetRedirectResolver, $t as ProvisioningError, A as CloudControlProvider, At as MIGRATE_TMP_PREFIX, B as assertRegionMatch, Bt as resetAwsClients, C as green, Ct as resolveSkipPrefix, D as collectInlinePolicyNamesManagedBySiblings, Dt as warnDeprecatedNoPrefixCliFlag, E as IAMRoleProvider, Et as resolveUseCdkBootstrapAssets, F as cfnRefValueFromPhysicalId, Ft as processStackMessages, G as LockManager, H as DiffCalculator, I as refStateLookupFromResource, J as shouldRetainResource, Jt as LocalStartServiceError, K as S3StateBackend, Kt as LocalInvokeBuildError$1, L as WAFv2WebACLProvider, Lt as resolveBucketRegion, M as disableInstanceApiTermination, Mt as uploadCfnTemplate, N as isTerminationProtectionPropagationError, Nt as expectedOwnerParam, O as ProviderRegistry, Ot as CFN_TEMPLATE_BODY_LIMIT, P as IntrinsicFunctionResolver, Pt as AssemblyReader, Q as buildAssetRedirectMap, Qt as PartialFailureError, R as normalizeAwsTagsToCfn, Rt as AwsClients, S as gray, St as resolveCaptureObservedState, T as yellow, Tt as resolveStateBucketWithDefaultAndSource, U as DagBuilder, Ut as CdkdError, V as applyRoleArnIfSet, Vt as setAwsClients, W as TemplateParser, X as stringifyValue, Xt as MissingCdkCliError, Y as AssetPublisher, Z as WorkGraph, Zt as NestedStackChildDirectDestroyError, _ as isStatefulRecreateTargetSync, _t as synthesisStatusMessage, a as DeploymentEventsStore, at as getBootstrapMarkerKey, b as bold, bt as resolveApp, c as replayFailedOperations, cn as normalizeAwsError, ct as validateContainerRepoName, d as withRetry, dt as getDockerCmd, en as ResourceTimeoutError, et as loadPublishableAssetManifest, f as isRetryableTransientError, ft as runDockerForeground, g as MULTI_REGION_RECREATE_BLOCKED_TYPES, gt as Synthesizer, h as extractDeploymentEventError, ht as getDockerImageBySourceHash, i as DeploymentEventsReader, it as ensureAssetStorage, j as slowCcOperationTimeoutMs, jt as findLargeInlineResources, k as findActionableSilentDrops, kt as CFN_TEMPLATE_URL_LIMIT, l as replayRollback, ln as withErrorHandling, lt as buildDockerImage, m as computeImplicitDeleteEdges, mt as AssetManifestLoader, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as StackHasActiveImportsError, nt as AssetModeResolver, o as planFailedOps, ot as parseBootstrapMarker, p as IMPLICIT_DELETE_DEPENDENCIES, pt as runDockerStreaming, q as rebuildClientForBucketRegion, qt as LocalMigrateError, r as DeployEngine, rn as StackTerminationProtectionError, rt as BOOTSTRAP_MARKER_PREFIX, s as planRollback, st as validateAssetBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as ResourceUpdateNotSupportedError, tt as rewriteTemplateAssetReferences, u as withResourceDeadline, ut as formatDockerLoginError, v as renderStatefulReason, vt as getDefaultStateBucketName, w as red, wt as resolveStateBucketWithDefault, x as cyan, xt as resolveAutoAssetStorage, y as formatResourceLine, yt as getLegacyStateBucketName, z as resolveExplicitPhysicalId, zt as getAwsClients } from "./deploy-engine-BXgD8s_k.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-C3MDoBIO.js";
+import { r as clearOnUpdateRemoval, t as ASGProvider } from "./asg-provider-CBMy7ibk.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -516,6 +516,15 @@ const useCdkBootstrapAssetsOption = new Option("--use-cdk-bootstrap-assets", "Pu
 * Output cannot be resolved (default: warn and store no value).
 */
 const strictGetattOption = new Option("--strict-getatt", "Fail the deploy on ANY Fn::GetAtt that falls back to the physical ID because cdkd cannot construct the attribute (default: warn and use the physical ID, hard-failing only when the fallback is knowably wrong — an *Arn attribute with a non-ARN value or a *Url attribute with a non-http(s) value). Also fails the deploy when a stack Output cannot be resolved (default: warn and store no value).").default(false);
+/**
+* CDK annotation-message behavior flags (issue #1230, CDK CLI parity).
+* Shared by `cdkd synth` and `cdkd deploy` — the two commands that fail on
+* `Annotations.addError` (issue #1228). `--strict` additionally fails when
+* any WARNING annotation exists (`Found warnings (--strict mode)`);
+* `--ignore-errors` displays every message but never fails the run. When
+* both are passed, strict wins (matches the CDK CLI's failAt resolution).
+*/
+const annotationMessageOptions = [new Option("--strict", "Do not proceed with stacks carrying warning annotations").default(false), new Option("--ignore-errors", "Ignore error annotations from stack synthesis, which will likely produce an invalid deployment").default(false)];
 const deployOptions = [
 	new Option("--concurrency <number>", "Maximum concurrent resource operations").default(10).argParser((value) => parseInt(value, 10)),
 	new Option("--stack-concurrency <number>", "Maximum concurrent stack deployments").default(4).argParser((value) => parseInt(value, 10)),
@@ -1229,6 +1238,10 @@ async function synthCommand(options) {
 		...Object.keys(context).length > 0 && { context }
 	};
 	const { stacks, assemblyDir } = await synthesizer.synthesize(synthOptions);
+	processStackMessages(stacks, logger, {
+		strict: options.strict === true,
+		ignoreErrors: options.ignoreErrors === true
+	});
 	if (stacks.length === 1) {
 		const template = stacks[0].template;
 		process.stdout.write(toYaml(template));
@@ -1257,7 +1270,8 @@ function createSynthCommand() {
 	[
 		...commonOptions,
 		...appOptions,
-		...contextOptions
+		...contextOptions,
+		...annotationMessageOptions
 	].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
@@ -8054,20 +8068,20 @@ var LambdaFunctionProvider = class {
 					Role: properties["Role"],
 					Handler: properties["Handler"],
 					Runtime: properties["Runtime"],
-					Timeout: this.clearOnUpdateRemoval(properties["Timeout"], previousProperties["Timeout"], 3),
-					MemorySize: this.clearOnUpdateRemoval(properties["MemorySize"], previousProperties["MemorySize"], 128),
-					Description: this.clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], ""),
-					Environment: this.clearOnUpdateRemoval(this.normalizeEnvironmentForUpdate(properties["Environment"]), previousProperties["Environment"], { Variables: {} }),
-					Layers: this.clearOnUpdateRemoval(properties["Layers"], previousProperties["Layers"], []),
-					TracingConfig: this.clearOnUpdateRemoval(properties["TracingConfig"], previousProperties["TracingConfig"], { Mode: "PassThrough" }),
-					EphemeralStorage: this.clearOnUpdateRemoval(properties["EphemeralStorage"], previousProperties["EphemeralStorage"], { Size: 512 }),
+					Timeout: clearOnUpdateRemoval(properties["Timeout"], previousProperties["Timeout"], 3),
+					MemorySize: clearOnUpdateRemoval(properties["MemorySize"], previousProperties["MemorySize"], 128),
+					Description: clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], ""),
+					Environment: clearOnUpdateRemoval(this.normalizeEnvironmentForUpdate(properties["Environment"]), previousProperties["Environment"], { Variables: {} }),
+					Layers: clearOnUpdateRemoval(properties["Layers"], previousProperties["Layers"], []),
+					TracingConfig: clearOnUpdateRemoval(properties["TracingConfig"], previousProperties["TracingConfig"], { Mode: "PassThrough" }),
+					EphemeralStorage: clearOnUpdateRemoval(properties["EphemeralStorage"], previousProperties["EphemeralStorage"], { Size: 512 }),
 					VpcConfig: this.buildVpcConfigForUpdate(properties["VpcConfig"], previousProperties["VpcConfig"]),
-					DeadLetterConfig: this.clearOnUpdateRemoval(properties["DeadLetterConfig"], previousProperties["DeadLetterConfig"], { TargetArn: "" }),
-					KMSKeyArn: this.clearOnUpdateRemoval(properties["KmsKeyArn"], previousProperties["KmsKeyArn"], ""),
-					FileSystemConfigs: this.clearOnUpdateRemoval(properties["FileSystemConfigs"], previousProperties["FileSystemConfigs"], []),
-					ImageConfig: this.clearOnUpdateRemoval(properties["ImageConfig"], previousProperties["ImageConfig"], {}),
-					SnapStart: this.clearOnUpdateRemoval(properties["SnapStart"], previousProperties["SnapStart"], { ApplyOn: "None" }),
-					LoggingConfig: this.clearOnUpdateRemoval(properties["LoggingConfig"], previousProperties["LoggingConfig"], { LogFormat: "Text" })
+					DeadLetterConfig: clearOnUpdateRemoval(properties["DeadLetterConfig"], previousProperties["DeadLetterConfig"], { TargetArn: "" }),
+					KMSKeyArn: clearOnUpdateRemoval(properties["KmsKeyArn"], previousProperties["KmsKeyArn"], ""),
+					FileSystemConfigs: clearOnUpdateRemoval(properties["FileSystemConfigs"], previousProperties["FileSystemConfigs"], []),
+					ImageConfig: clearOnUpdateRemoval(properties["ImageConfig"], previousProperties["ImageConfig"], {}),
+					SnapStart: clearOnUpdateRemoval(properties["SnapStart"], previousProperties["SnapStart"], { ApplyOn: "None" }),
+					LoggingConfig: clearOnUpdateRemoval(properties["LoggingConfig"], previousProperties["LoggingConfig"], { LogFormat: "Text" })
 				};
 				await this.lambdaClient.send(new UpdateFunctionConfigurationCommand(configParams));
 				this.logger.debug(`Updated configuration for Lambda function ${physicalId}`);
@@ -8210,24 +8224,6 @@ var LambdaFunctionProvider = class {
 		};
 	}
 	/**
-	* Build an UpdateFunctionConfiguration field value that clears on removal.
-	*
-	* `UpdateFunctionConfiguration` treats an absent field as "no change", so
-	* passing `undefined` for a field the user just dropped from the template
-	* leaves the old value live on AWS — the update reports success while the
-	* field silently persists. For every optional config field we send its
-	* CFn-default / explicit reset value (e.g. Timeout `3`, MemorySize `128`,
-	* Environment `{Variables:{}}`, Layers `[]`, TracingConfig
-	* `{Mode:'PassThrough'}`, EphemeralStorage `{Size:512}`, DeadLetterConfig
-	* `{TargetArn:''}`, KMSKeyArn `''`, FileSystemConfigs `[]`, ImageConfig `{}`,
-	* SnapStart `{ApplyOn:'None'}`, LoggingConfig `{LogFormat:'Text'}`) when the
-	* field was present before and is now absent. Mirrors `buildVpcConfigForUpdate`.
-	*/
-	clearOnUpdateRemoval(newValue, previousValue, clearValue) {
-		if (newValue !== void 0) return newValue;
-		if (previousValue !== void 0) return clearValue;
-	}
-	/**
 	* Normalize a template `Environment` block for UpdateFunctionConfiguration.
 	*
 	* `Environment: {}` (present, but no `Variables` key — a hand-written L1 /
@@ -21947,14 +21943,14 @@ var ECSProvider = class {
 		if (!isEcsController && (loadBalancersChanged || serviceRegistriesChanged)) throw new ProvisioningError(`AWS::ECS::Service '${logicalId}' changes LoadBalancers/ServiceRegistries under the '${deploymentControllerType}' deployment controller, which applies them via a new CodeDeploy deployment / task set rather than UpdateService. cdkd does not support updating these under a non-ECS controller; recreate the service or manage the blue/green deployment out-of-band.`, resourceType, logicalId, physicalId);
 		const loadBalancersInput = isEcsController && loadBalancersChanged ? this.convertLoadBalancers(properties["LoadBalancers"]) ?? [] : void 0;
 		const serviceRegistriesInput = isEcsController && serviceRegistriesChanged ? this.convertServiceRegistries(properties["ServiceRegistries"]) ?? [] : void 0;
-		const capacityProviderStrategyInput = this.clearOnUpdateRemoval(this.convertCapacityProviderStrategy(properties["CapacityProviderStrategy"]), previousProperties["CapacityProviderStrategy"], []);
-		const placementConstraintsInput = this.clearOnUpdateRemoval(this.convertPlacementConstraints(properties["PlacementConstraints"]), previousProperties["PlacementConstraints"], []);
-		const placementStrategyInput = this.clearOnUpdateRemoval(this.convertPlacementStrategies(properties["PlacementStrategies"] ?? properties["PlacementStrategy"]), previousProperties["PlacementStrategies"] ?? previousProperties["PlacementStrategy"], []);
-		const platformVersionInput = this.clearOnUpdateRemoval(properties["PlatformVersion"], previousProperties["PlatformVersion"], "LATEST");
-		const healthCheckGracePeriodSecondsInput = this.clearOnUpdateRemoval(properties["HealthCheckGracePeriodSeconds"], previousProperties["HealthCheckGracePeriodSeconds"], 0);
-		const enableECSManagedTagsInput = this.clearOnUpdateRemoval(properties["EnableECSManagedTags"], previousProperties["EnableECSManagedTags"], false);
-		const propagateTagsInput = this.clearOnUpdateRemoval(properties["PropagateTags"], previousProperties["PropagateTags"], "NONE");
-		const enableExecuteCommandInput = this.clearOnUpdateRemoval(properties["EnableExecuteCommand"], previousProperties["EnableExecuteCommand"], false);
+		const capacityProviderStrategyInput = clearOnUpdateRemoval(this.convertCapacityProviderStrategy(properties["CapacityProviderStrategy"]), previousProperties["CapacityProviderStrategy"], []);
+		const placementConstraintsInput = clearOnUpdateRemoval(this.convertPlacementConstraints(properties["PlacementConstraints"]), previousProperties["PlacementConstraints"], []);
+		const placementStrategyInput = clearOnUpdateRemoval(this.convertPlacementStrategies(properties["PlacementStrategies"] ?? properties["PlacementStrategy"]), previousProperties["PlacementStrategies"] ?? previousProperties["PlacementStrategy"], []);
+		const platformVersionInput = clearOnUpdateRemoval(properties["PlatformVersion"], previousProperties["PlatformVersion"], "LATEST");
+		const healthCheckGracePeriodSecondsInput = clearOnUpdateRemoval(properties["HealthCheckGracePeriodSeconds"], previousProperties["HealthCheckGracePeriodSeconds"], 0);
+		const enableECSManagedTagsInput = clearOnUpdateRemoval(properties["EnableECSManagedTags"], previousProperties["EnableECSManagedTags"], false);
+		const propagateTagsInput = clearOnUpdateRemoval(properties["PropagateTags"], previousProperties["PropagateTags"], "NONE");
+		const enableExecuteCommandInput = clearOnUpdateRemoval(properties["EnableExecuteCommand"], previousProperties["EnableExecuteCommand"], false);
 		try {
 			const service = (await client.send(new UpdateServiceCommand({
 				cluster: properties["Cluster"],
@@ -21988,20 +21984,6 @@ var ECSProvider = class {
 			throw new ProvisioningError(`Failed to update ECS service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	/**
-	* Resolve an optional UpdateService field so that a property REMOVED from the
-	* template is reset to its CloudFormation default instead of silently
-	* retaining the old live value (issue #1160 — the absent-field removal
-	* silent-drop bug class; reference fix `LambdaFunctionProvider`, #1157).
-	*
-	* Returns `newValue` when present, the `clearValue` when the field was
-	* present before and is now absent (removal), and `undefined` when it was
-	* never present (so a genuinely-absent field stays absent = no change).
-	*/
-	clearOnUpdateRemoval(newValue, previousValue, clearValue) {
-		if (newValue !== void 0) return newValue;
-		if (previousValue !== void 0) return clearValue;
-	}
 	async deleteService(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting ECS service ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
@@ -23976,16 +23958,16 @@ var RDSProvider = class {
 			await this.getClient().send(new ModifyDBClusterCommand({
 				DBClusterIdentifier: physicalId,
 				EngineVersion: properties["EngineVersion"],
-				DeletionProtection: this.clearOnUpdateRemoval(properties["DeletionProtection"], previousProperties["DeletionProtection"], false),
-				BackupRetentionPeriod: this.clearOnUpdateRemoval(properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0, previousProperties["BackupRetentionPeriod"] != null ? Number(previousProperties["BackupRetentionPeriod"]) : void 0, 1),
+				DeletionProtection: clearOnUpdateRemoval(properties["DeletionProtection"], previousProperties["DeletionProtection"], false),
+				BackupRetentionPeriod: clearOnUpdateRemoval(properties["BackupRetentionPeriod"] != null ? Number(properties["BackupRetentionPeriod"]) : void 0, previousProperties["BackupRetentionPeriod"] != null ? Number(previousProperties["BackupRetentionPeriod"]) : void 0, 1),
 				...sendVpcSgIds && { VpcSecurityGroupIds: vpcSgIds },
 				MasterUserPassword: properties["MasterUserPassword"],
 				Port: properties["Port"] != null ? Number(properties["Port"]) : void 0,
 				...properties["ManageMasterUserPassword"] !== void 0 && { ManageMasterUserPassword: properties["ManageMasterUserPassword"] },
 				...masterUserSecret?.KmsKeyId !== void 0 && { MasterUserSecretKmsKeyId: masterUserSecret.KmsKeyId },
 				...properties["MonitoringRoleArn"] !== void 0 && { MonitoringRoleArn: properties["MonitoringRoleArn"] },
-				MonitoringInterval: this.clearOnUpdateRemoval(properties["MonitoringInterval"] != null ? Number(properties["MonitoringInterval"]) : void 0, previousProperties["MonitoringInterval"] != null ? Number(previousProperties["MonitoringInterval"]) : void 0, 0),
-				EnableIAMDatabaseAuthentication: this.clearOnUpdateRemoval(properties["EnableIAMDatabaseAuthentication"], previousProperties["EnableIAMDatabaseAuthentication"], false),
+				MonitoringInterval: clearOnUpdateRemoval(properties["MonitoringInterval"] != null ? Number(properties["MonitoringInterval"]) : void 0, previousProperties["MonitoringInterval"] != null ? Number(previousProperties["MonitoringInterval"]) : void 0, 0),
+				EnableIAMDatabaseAuthentication: clearOnUpdateRemoval(properties["EnableIAMDatabaseAuthentication"], previousProperties["EnableIAMDatabaseAuthentication"], false),
 				...hasServerlessV2 && { ServerlessV2ScalingConfiguration: {
 					MinCapacity: serverlessV2Config.MinCapacity,
 					MaxCapacity: serverlessV2Config.MaxCapacity
@@ -24011,21 +23993,6 @@ var RDSProvider = class {
 			throw new ProvisioningError(`Failed to update DBCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
-	/**
-	* Resolve an optional ModifyDBCluster / ModifyDBInstance field so that a
-	* property REMOVED from the template is reset to its CloudFormation
-	* default instead of silently retaining the old live value (issue #1160 —
-	* the absent-field removal silent-drop bug class; reference fix
-	* `LambdaFunctionProvider`, #1157).
-	*
-	* Returns `newValue` when present, the `clearValue` when the field was
-	* present before and is now absent (removal), and `undefined` when it was
-	* never present (so a genuinely-absent field stays absent = no change).
-	*/
-	clearOnUpdateRemoval(newValue, previousValue, clearValue) {
-		if (newValue !== void 0) return newValue;
-		if (previousValue !== void 0) return clearValue;
-	}
 	async deleteDBCluster(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting DBCluster ${logicalId}: ${physicalId}`);
 		try {
@@ -24117,7 +24084,7 @@ var RDSProvider = class {
 				PubliclyAccessible: properties["PubliclyAccessible"],
 				ApplyImmediately: true,
 				...properties["AllocatedStorage"] !== void 0 && { AllocatedStorage: Number(properties["AllocatedStorage"]) },
-				DeletionProtection: this.clearOnUpdateRemoval(properties["DeletionProtection"], previousProperties["DeletionProtection"], false),
+				DeletionProtection: clearOnUpdateRemoval(properties["DeletionProtection"], previousProperties["DeletionProtection"], false),
 				...newEngineVersion !== void 0 && {
 					EngineVersion: newEngineVersion,
 					...allowMajorVersionUpgrade && { AllowMajorVersionUpgrade: true }
@@ -24128,8 +24095,8 @@ var RDSProvider = class {
 				...masterUserSecret?.KmsKeyId !== void 0 && { MasterUserSecretKmsKeyId: masterUserSecret.KmsKeyId },
 				...properties["ManageMasterUserPassword"] !== void 0 && { ManageMasterUserPassword: properties["ManageMasterUserPassword"] },
 				...properties["MonitoringRoleArn"] !== void 0 && { MonitoringRoleArn: properties["MonitoringRoleArn"] },
-				MonitoringInterval: this.clearOnUpdateRemoval(properties["MonitoringInterval"] != null ? Number(properties["MonitoringInterval"]) : void 0, previousProperties["MonitoringInterval"] != null ? Number(previousProperties["MonitoringInterval"]) : void 0, 0),
-				EnableIAMDatabaseAuthentication: this.clearOnUpdateRemoval(properties["EnableIAMDatabaseAuthentication"], previousProperties["EnableIAMDatabaseAuthentication"], false)
+				MonitoringInterval: clearOnUpdateRemoval(properties["MonitoringInterval"] != null ? Number(properties["MonitoringInterval"]) : void 0, previousProperties["MonitoringInterval"] != null ? Number(previousProperties["MonitoringInterval"]) : void 0, 0),
+				EnableIAMDatabaseAuthentication: clearOnUpdateRemoval(properties["EnableIAMDatabaseAuthentication"], previousProperties["EnableIAMDatabaseAuthentication"], false)
 			}));
 			this.logger.debug(`Successfully updated DBInstance ${logicalId}`);
 			const described = await this.describeDBInstance(physicalId);
@@ -42432,6 +42399,10 @@ async function deployCommand(stacks, options) {
 			};
 			for (const stack of [...targetStacks]) addDependencies(stack.stackName);
 		}
+		processStackMessages(targetStacks, logger, {
+			strict: options.strict === true,
+			ignoreErrors: options.ignoreErrors === true
+		});
 		await synthesizer.expandMacrosForStacks(targetStacks, synthOptions);
 		const { STSClient, GetCallerIdentityCommand } = await import("@aws-sdk/client-sts");
 		const stsClient = new STSClient({ region: options.region || process.env["AWS_REGION"] || "us-east-1" });
@@ -42693,7 +42664,8 @@ function createDeployCommand() {
 		...stateOptions,
 		...stackOptions,
 		...deployOptions,
-		...contextOptions
+		...contextOptions,
+		...annotationMessageOptions
 	].forEach((opt) => cmd.addOption(opt));
 	cmd.addOption(deprecatedRegionOption);
 	return cmd;
@@ -61968,7 +61940,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.265.3");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.267.0");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;