@go-to-k/cdkd 0.267.12 → 0.267.14

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, $t as NestedStackChildDirectDestroyError, A as slowCcOperationTimeoutMs, At as CFN_TEMPLATE_BODY_LIMIT, B as applyRoleArnIfSet, Bt as AwsClients, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as expectedOwnerParam, G as DagBuilder, Gt as CdkdError, H as describeTypeWithThrottleRetry, Ht as resetAwsClients, I as WAFv2WebACLProvider, It as AssemblyReader, J as S3StateBackend, Jt as LocalInvokeBuildError$1, K as TemplateParser, L as normalizeAwsTagsToCfn, Lt as processStackMessages, M as isTerminationProtectionPropagationError, Mt as MIGRATE_TMP_PREFIX, N as IntrinsicFunctionResolver, Nt as findLargeInlineResources, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as uploadCfnTemplate, Q as stringifyValue, Qt as MissingCdkCliError, R as resolveExplicitPhysicalId, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as setAwsClients, V as DiffCalculator, Vt as getAwsClients, W as isRetryableTransientError, X as shouldRetainResource, Xt as LocalStartServiceError, Y as rebuildClientForBucketRegion, Yt as LocalMigrateError, Z as AssetPublisher, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as StackTerminationProtectionError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dn as withErrorHandling, dt as buildDockerImage, en as PartialFailureError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as StackHasActiveImportsError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_URL_LIMIT, k as CloudControlProvider, kt as warnDeprecatedNoPrefixCliFlag, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as ResourceTimeoutError, nt as loadPublishableAssetManifest, o as planFailedOps, ot as ensureAssetStorage, p as extractDeploymentEventError, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ResourceUpdateNotSupportedError, rt as rewriteTemplateAssetReferences, s as planRollback, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as ProvisioningError, tt as createAssetRedirectResolver, u as withResourceDeadline, un as normalizeAwsError, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch, zt as resolveBucketRegion } from "./deploy-engine-CqnKG1Ta.js";
+import { $ as WorkGraph, $t as NestedStackChildDirectDestroyError, A as slowCcOperationTimeoutMs, At as CFN_TEMPLATE_BODY_LIMIT, B as applyRoleArnIfSet, Bt as AwsClients, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as expectedOwnerParam, G as DagBuilder, Gt as CdkdError, H as describeTypeWithThrottleRetry, Ht as resetAwsClients, I as WAFv2WebACLProvider, It as AssemblyReader, J as S3StateBackend, Jt as LocalInvokeBuildError$1, K as TemplateParser, L as normalizeAwsTagsToCfn, Lt as processStackMessages, M as isTerminationProtectionPropagationError, Mt as MIGRATE_TMP_PREFIX, N as IntrinsicFunctionResolver, Nt as findLargeInlineResources, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as uploadCfnTemplate, Q as stringifyValue, Qt as MissingCdkCliError, R as resolveExplicitPhysicalId, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as setAwsClients, V as DiffCalculator, Vt as getAwsClients, W as isRetryableTransientError, X as shouldRetainResource, Xt as LocalStartServiceError, Y as rebuildClientForBucketRegion, Yt as LocalMigrateError, Z as AssetPublisher, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as StackTerminationProtectionError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dn as withErrorHandling, dt as buildDockerImage, en as PartialFailureError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as StackHasActiveImportsError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_URL_LIMIT, k as CloudControlProvider, kt as warnDeprecatedNoPrefixCliFlag, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as ResourceTimeoutError, nt as loadPublishableAssetManifest, o as planFailedOps, ot as ensureAssetStorage, p as extractDeploymentEventError, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ResourceUpdateNotSupportedError, rt as rewriteTemplateAssetReferences, s as planRollback, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as ProvisioningError, tt as createAssetRedirectResolver, u as withResourceDeadline, un as normalizeAwsError, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch, zt as resolveBucketRegion } from "./deploy-engine-BbcBkfds.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-BSt-wWnn.js";
+import { t as ASGProvider } from "./asg-provider-dQRoK5OE.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -9055,17 +9055,18 @@ var LambdaUrlProvider = class {
 			wasReplaced: false,
 			attributes: {}
 		};
-		const authType = properties["AuthType"] || "NONE";
-		const cors = properties["Cors"];
 		const updateParams = {
 			FunctionName: physicalId,
-			AuthType: authType
-		};
-		if (properties["InvokeMode"] !== void 0) updateParams.InvokeMode = properties["InvokeMode"];
-		if (cors) {
-			const builtCors = this.buildCorsConfig(cors);
-			if (Object.keys(builtCors).length > 0) updateParams.Cors = builtCors;
-		}
+			AuthType: properties["AuthType"] || "NONE"
+		};
+		const invokeMode = clearOnUpdateRemoval(properties["InvokeMode"], previousProperties["InvokeMode"], "BUFFERED");
+		if (invokeMode !== void 0) updateParams.InvokeMode = invokeMode;
+		const newCorsRaw = properties["Cors"];
+		const prevCorsRaw = previousProperties["Cors"];
+		const newCorsBuilt = newCorsRaw ? this.buildCorsConfig(newCorsRaw) : void 0;
+		const prevCorsBuilt = prevCorsRaw ? this.buildCorsConfig(prevCorsRaw) : void 0;
+		const corsParam = clearOnUpdateRemoval(newCorsBuilt && Object.keys(newCorsBuilt).length > 0 ? newCorsBuilt : void 0, prevCorsBuilt && Object.keys(prevCorsBuilt).length > 0 ? prevCorsBuilt : void 0, {});
+		if (corsParam !== void 0) updateParams.Cors = corsParam;
 		const response = await this.lambdaClient.send(new UpdateFunctionUrlConfigCommand(updateParams));
 		return {
 			physicalId,
@@ -9189,10 +9190,13 @@ var LambdaUrlProvider = class {
 	* (`AllowOrigins: []`, `AllowMethods: []`, `AllowHeaders: []`,
 	* `ExposeHeaders: []`) are intentionally dropped here — emitting them
 	* to AWS would configure CORS with empty allowlists instead of
-	* leaving CORS unset. The caller (`update()` / `create()`) treats an
-	* empty `Cors` object as "no CORS configured" and omits it from the
-	* SDK input. `MaxAge` uses `!== undefined` so the valid AWS input
-	* `MaxAge: 0` (= "do not cache preflight responses") is preserved.
+	* leaving CORS unset. `update()` normalizes an empty build to "no CORS"
+	* on both comparison sides (issue #1160 — an empty `Cors` object is the
+	* live-probed CLEAR shape there, sent only on a real removal); `create()`
+	* passes the build through as-is (template values, never placeholders,
+	* and `Cors: {}` on create means "no CORS" per the same probe). `MaxAge`
+	* uses `!== undefined` so the valid AWS input `MaxAge: 0` (= "do not
+	* cache preflight responses") is preserved.
 	*/
 	buildCorsConfig(cors) {
 		const config = {};
@@ -39391,21 +39395,83 @@ var DLMLifecyclePolicyProvider = class {
 	* Map the CFn property shape to the SDK input shape (shared by create and
 	* update — every field name is PascalCase-identical). `Tags` and
 	* `DefaultPolicy` are intentionally NOT included: create wires them
-	* separately (update has neither parameter).
+	* separately (update has neither parameter). `!= null` (not
+	* `!== undefined`) so an explicit-null template value is treated as
+	* absent instead of being passed to the SDK as `null` — matches
+	* `buildRemovalResets`' null normalization.
 	*/
 	toSdkFields(properties) {
 		return {
-			...properties["ExecutionRoleArn"] !== void 0 && { ExecutionRoleArn: properties["ExecutionRoleArn"] },
-			...properties["Description"] !== void 0 && { Description: properties["Description"] },
-			...properties["State"] !== void 0 && { State: properties["State"] },
-			...properties["PolicyDetails"] !== void 0 && { PolicyDetails: properties["PolicyDetails"] },
-			...properties["CreateInterval"] !== void 0 && { CreateInterval: properties["CreateInterval"] },
-			...properties["RetainInterval"] !== void 0 && { RetainInterval: properties["RetainInterval"] },
-			...properties["CopyTags"] !== void 0 && { CopyTags: properties["CopyTags"] },
-			...properties["ExtendDeletion"] !== void 0 && { ExtendDeletion: properties["ExtendDeletion"] },
-			...properties["CrossRegionCopyTargets"] !== void 0 && { CrossRegionCopyTargets: properties["CrossRegionCopyTargets"] },
-			...properties["Exclusions"] !== void 0 && { Exclusions: properties["Exclusions"] }
-		};
+			...properties["ExecutionRoleArn"] != null && { ExecutionRoleArn: properties["ExecutionRoleArn"] },
+			...properties["Description"] != null && { Description: properties["Description"] },
+			...properties["State"] != null && { State: properties["State"] },
+			...properties["PolicyDetails"] != null && { PolicyDetails: properties["PolicyDetails"] },
+			...properties["CreateInterval"] != null && { CreateInterval: properties["CreateInterval"] },
+			...properties["RetainInterval"] != null && { RetainInterval: properties["RetainInterval"] },
+			...properties["CopyTags"] != null && { CopyTags: properties["CopyTags"] },
+			...properties["ExtendDeletion"] != null && { ExtendDeletion: properties["ExtendDeletion"] },
+			...properties["CrossRegionCopyTargets"] != null && { CrossRegionCopyTargets: properties["CrossRegionCopyTargets"] },
+			...properties["Exclusions"] != null && { Exclusions: properties["Exclusions"] }
+		};
+	}
+	/**
+	* Removal resets for the default-policy shorthand fields (issue #1160).
+	*
+	* UpdateLifecyclePolicy uses merge semantics (live-probed 2026-07-27: an
+	* update carrying only PolicyId retains every live value), while CFn
+	* resets a property removed from the template to its default. Each
+	* shorthand field is routed through `clearOnUpdateRemoval` with its
+	* documented default — all live-probed as accepted AND applied (the
+	* service create-defaults match: a create omitting them reads back
+	* 1 / 7 / false / false):
+	*   CreateInterval -> 1, RetainInterval -> 7, CopyTags -> false,
+	*   ExtendDeletion -> false, CrossRegionCopyTargets -> [].
+	*   Exclusions -> the per-DefaultPolicy explicit-empty shape:
+	*     VOLUME   -> { ExcludeBootVolumes: false, ExcludeVolumeTypes: [],
+	*                   ExcludeTags: [] }
+	*     INSTANCE -> { ExcludeTags: [] } (the volume-only sub-fields are
+	*                  rejected on IMAGE_MANAGEMENT policies — live-probed
+	*                  "ExcludeBootVolumes cannot be enabled for the
+	*                  following policy type {IMAGE_MANAGEMENT}")
+	*   (A KEPT-but-partial Exclusions object needs no handling: the API
+	*   replaces the whole object — live-probed, a kept object with
+	*   ExcludeTags dropped reads back ExcludeTags: [] — so pass-through is
+	*   already CFn parity at the sub-field level.)
+	* These fields only exist on default policies, so the resets can only
+	* fire there (a standard policy never had them in previousProperties).
+	* Deferred with rationale:
+	*   Description — UpdateLifecyclePolicy rejects '' (live-probed
+	*     InvalidRequestException: "The following parameter(s) are invalid:
+	*     Description") and documents no clear sentinel, so there is no
+	*     wire shape that resets it; pass-through (keep live value) is the
+	*     only expressible behavior.
+	*   State / ExecutionRoleArn / PolicyDetails — required-on-create
+	*     fields with no CFn default; removal is not a meaningful template
+	*     operation for them.
+	*/
+	buildRemovalResets(properties, previousProperties) {
+		const resets = {};
+		const createInterval = clearOnUpdateRemoval(properties["CreateInterval"] != null ? Number(properties["CreateInterval"]) : void 0, previousProperties["CreateInterval"] != null ? Number(previousProperties["CreateInterval"]) : void 0, 1);
+		if (createInterval !== void 0) resets.CreateInterval = createInterval;
+		const retainInterval = clearOnUpdateRemoval(properties["RetainInterval"] != null ? Number(properties["RetainInterval"]) : void 0, previousProperties["RetainInterval"] != null ? Number(previousProperties["RetainInterval"]) : void 0, 7);
+		if (retainInterval !== void 0) resets.RetainInterval = retainInterval;
+		const copyTags = clearOnUpdateRemoval(properties["CopyTags"] ?? void 0, previousProperties["CopyTags"] ?? void 0, false);
+		if (copyTags !== void 0) resets.CopyTags = copyTags;
+		const extendDeletion = clearOnUpdateRemoval(properties["ExtendDeletion"] ?? void 0, previousProperties["ExtendDeletion"] ?? void 0, false);
+		if (extendDeletion !== void 0) resets.ExtendDeletion = extendDeletion;
+		const crossRegionCopyTargets = clearOnUpdateRemoval(properties["CrossRegionCopyTargets"] ?? void 0, previousProperties["CrossRegionCopyTargets"] ?? void 0, []);
+		if (crossRegionCopyTargets !== void 0) resets.CrossRegionCopyTargets = crossRegionCopyTargets;
+		const defaultPolicy = properties["DefaultPolicy"] ?? previousProperties["DefaultPolicy"];
+		const exclusionsClear = defaultPolicy === "VOLUME" ? {
+			ExcludeBootVolumes: false,
+			ExcludeVolumeTypes: [],
+			ExcludeTags: []
+		} : defaultPolicy === "INSTANCE" ? { ExcludeTags: [] } : void 0;
+		if (exclusionsClear !== void 0) {
+			const exclusions = clearOnUpdateRemoval(properties["Exclusions"] ?? void 0, previousProperties["Exclusions"] ?? void 0, exclusionsClear);
+			if (exclusions !== void 0) resets.Exclusions = exclusions;
+		}
+		return resets;
 	}
 	/** Fetch the policy ARN (`Fn::GetAtt Arn`) for a policy id. */
 	async fetchPolicyArn(policyId) {
@@ -39444,7 +39510,8 @@ var DLMLifecyclePolicyProvider = class {
 		try {
 			await this.getClient().send(new UpdateLifecyclePolicyCommand({
 				PolicyId: physicalId,
-				...this.toSdkFields(properties)
+				...this.toSdkFields(properties),
+				...this.buildRemovalResets(properties, previousProperties)
 			}));
 			const newTags = this.cfnTagsToMap(properties["Tags"]) ?? {};
 			const oldTags = this.cfnTagsToMap(previousProperties["Tags"]) ?? {};
@@ -62014,7 +62081,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.267.12");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.267.14");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;