@go-to-k/cdkd 0.278.38 → 0.278.39

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-DIvnBeMj.js";
+import { $ as describeTypeWithThrottleRetry, $t as AwsClients, A as red, At as Synthesizer, B as isTerminationProtectionPropagationError, Bt as resolveUseCdkBootstrapAssets, C as isStatefulRecreateTargetSync, Ct as buildDockerImage, D as cyan, Dt as runDockerStreaming, E as bold, Et as runDockerForeground, F as ProviderRegistry, Ft as resolveAutoAssetStorage, G as normalizeAwsTagsToCfn, Gt as MIGRATE_TMP_PREFIX, H as cfnRefValueFromPhysicalId, Ht as warnDeprecatedNoPrefixCliFlag, I as findActionableSilentDrops, It as resolveCaptureObservedState, J as readConfigString, Jt as expectedOwnerParam, K as resolveExplicitPhysicalId, Kt as findLargeInlineResources, L as CloudControlProvider, Lt as resolveSkipPrefix, M as IAMRoleProvider, Mt as getDefaultStateBucketName, N as collectInlinePolicyNamesManagedBySiblings, Nt as getLegacyStateBucketName, O as gray, Ot as AssetManifestLoader, P as clearOnUpdateRemoval, Pt as resolveApp, Q as DiffCalculator, Qt as resolveBucketRegion, R as slowCcOperationTimeoutMs, Rt as resolveStateBucketWithDefault, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateContainerRepoName, T as formatResourceLine, Tn as withErrorHandling, Tt as getDockerCmd, U as refStateLookupFromResource, Ut as CFN_TEMPLATE_BODY_LIMIT, V as IntrinsicFunctionResolver, Vt as stateBucketExistenceConfirmed, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_URL_LIMIT, X as requireConfigString, Xt as processStackMessages, Y as requireConfigArray, Yt as AssemblyReader, Z as applyRoleArnIfSet, _ as createPreDeleteFinalSnapshot, _n as ResourceUpdateNotSupportedError, _t as BOOTSTRAP_MARKER_PREFIX, a as DeploymentEventsStore, at as LockManager, b as unsupportedFinalSnapshotError, bt as parseBootstrapMarker, c as replayFailedOperations, cn as LocalInvokeBuildError$1, ct as shouldRetainResource, d as IMPLICIT_DELETE_DEPENDENCIES, dt as WorkGraph, en as getAwsClients, et as withRetry, f as computeImplicitDeleteEdges, fn as MissingCdkCliError, ft as buildAssetRedirectMap, g as ccRoutedFinalSnapshotError, gn as ResourceTimeoutError, gt as AssetModeResolver, h as buildFinalSnapshotIdentifier, hn as ProvisioningError, ht as rewriteTemplateAssetReferences, i as DeploymentEventsReader, in as CdkdError, it as TemplateParser, j as yellow, jt as synthesisStatusMessage, k as green, kt as getDockerImageBySourceHash, l as replayRollback, ln as LocalMigrateError, lt as AssetPublisher, m as PRE_DELETE_SNAPSHOT_TYPES, mn as PartialFailureError, mt as loadPublishableAssetManifest, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as setAwsClients, nt as isThrottlingError, o as planFailedOps, ot as S3StateBackend, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as NestedStackChildDirectDestroyError, pt as createAssetRedirectResolver, q as assertRegionMatch, qt as uploadCfnTemplate, r as DeployEngine, rt as DagBuilder, s as planRollback, sn as DeployCancelledError, st as rebuildClientForBucketRegion, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resetAwsClients, tt as isRetryableTransientError, u as withResourceDeadline, un as LocalStartServiceError, ut as stringifyValue, v as isFinalSnapshotError, vn as StackHasActiveImportsError, vt as ensureAssetStorage, w as renderStatefulReason, wn as normalizeAwsError, wt as formatDockerLoginError, x as extractDeploymentEventError, xt as validateAssetBucketName, y as refusesFinalSnapshot, yn as StackTerminationProtectionError, yt as getBootstrapMarkerKey, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefaultAndSource } from "./deploy-engine-BJVpWi-B.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CaulrRij.js";
+import { t as ASGProvider } from "./asg-provider-CJJC8plY.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -7600,27 +7600,12 @@ var SNSTopicProvider = class {
 						AttributeValue: dataProtectionPolicy
 					}));
 				}
-				if (properties["DeliveryStatusLogging"]) {
-					const loggingConfigs = properties["DeliveryStatusLogging"];
-					for (const config of loggingConfigs) {
-						const protocol = normalizeDeliveryStatusProtocolOrThrow(config["Protocol"], logicalId);
-						if (config["SuccessFeedbackRoleArn"]) await this.snsClient.send(new SetTopicAttributesCommand({
-							TopicArn: topicArn,
-							AttributeName: `${protocol}SuccessFeedbackRoleArn`,
-							AttributeValue: config["SuccessFeedbackRoleArn"]
-						}));
-						if (config["SuccessFeedbackSampleRate"]) await this.snsClient.send(new SetTopicAttributesCommand({
-							TopicArn: topicArn,
-							AttributeName: `${protocol}SuccessFeedbackSampleRate`,
-							AttributeValue: stringifyValue(config["SuccessFeedbackSampleRate"])
-						}));
-						if (config["FailureFeedbackRoleArn"]) await this.snsClient.send(new SetTopicAttributesCommand({
-							TopicArn: topicArn,
-							AttributeName: `${protocol}FailureFeedbackRoleArn`,
-							AttributeValue: config["FailureFeedbackRoleArn"]
-						}));
-					}
-				}
+				const deliveryStatusAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "throw");
+				for (const [attributeName, attributeValue] of deliveryStatusAttributes) await this.snsClient.send(new SetTopicAttributesCommand({
+					TopicArn: topicArn,
+					AttributeName: attributeName,
+					AttributeValue: attributeValue
+				}));
 				if (Array.isArray(properties["Subscription"])) {
 					const subscriptions = properties["Subscription"];
 					for (const sub of subscriptions) await this.subscribeInline(topicArn, sub, logicalId);
@@ -7727,24 +7712,24 @@ var SNSTopicProvider = class {
 			}
 		}
 		if (JSON.stringify(properties["DeliveryStatusLogging"]) !== JSON.stringify(previousProperties["DeliveryStatusLogging"])) {
-			const loggingConfigs = properties["DeliveryStatusLogging"] || [];
-			for (const config of loggingConfigs) {
-				const protocol = normalizeDeliveryStatusProtocolOrThrow(config["Protocol"], logicalId);
-				if (config["SuccessFeedbackRoleArn"]) await this.snsClient.send(new SetTopicAttributesCommand({
-					TopicArn: physicalId,
-					AttributeName: `${protocol}SuccessFeedbackRoleArn`,
-					AttributeValue: config["SuccessFeedbackRoleArn"]
-				}));
-				if (config["SuccessFeedbackSampleRate"]) await this.snsClient.send(new SetTopicAttributesCommand({
+			const desiredAttributes = buildDeliveryStatusAttributeMap(properties["DeliveryStatusLogging"], logicalId, "throw");
+			const previousAttributes = buildDeliveryStatusAttributeMap(previousProperties["DeliveryStatusLogging"], logicalId, "skip");
+			for (const [attributeName, attributeValue] of desiredAttributes) {
+				if (previousAttributes.get(attributeName) === attributeValue) continue;
+				await this.snsClient.send(new SetTopicAttributesCommand({
 					TopicArn: physicalId,
-					AttributeName: `${protocol}SuccessFeedbackSampleRate`,
-					AttributeValue: stringifyValue(config["SuccessFeedbackSampleRate"])
+					AttributeName: attributeName,
+					AttributeValue: attributeValue
 				}));
-				if (config["FailureFeedbackRoleArn"]) await this.snsClient.send(new SetTopicAttributesCommand({
+			}
+			for (const attributeName of previousAttributes.keys()) {
+				if (desiredAttributes.has(attributeName)) continue;
+				await this.snsClient.send(new SetTopicAttributesCommand({
 					TopicArn: physicalId,
-					AttributeName: `${protocol}FailureFeedbackRoleArn`,
-					AttributeValue: config["FailureFeedbackRoleArn"]
+					AttributeName: attributeName,
+					AttributeValue: deliveryStatusRemovalResetValue(attributeName)
 				}));
+				this.logger.debug(`Reset removed delivery status attribute ${attributeName} for topic ${physicalId}`);
 			}
 		}
 		if (JSON.stringify(properties["Subscription"]) !== JSON.stringify(previousProperties["Subscription"])) await this.reconcileInlineSubscriptions(physicalId, previousProperties["Subscription"] || [], properties["Subscription"] || [], logicalId);
@@ -8075,6 +8060,76 @@ const SNS_DELIVERY_STATUS_PROTOCOLS = [
 	"SQS"
 ];
 /**
+* The per-protocol attribute suffixes an inline `DeliveryStatusLogging`
+* entry maps to (`<Protocol><Suffix>` flat attribute names on the topic).
+*/
+const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
+	"SuccessFeedbackRoleArn",
+	"SuccessFeedbackSampleRate",
+	"FailureFeedbackRoleArn"
+];
+/**
+* Flatten a CFn `DeliveryStatusLogging` array into the AWS flat attribute
+* map (`{LambdaSuccessFeedbackRoleArn: '...', ...}`) that
+* `SetTopicAttributes` consumes one entry at a time.
+*
+* Field presence is `!= null`, NOT truthiness, so
+* `SuccessFeedbackSampleRate: 0` is sent as `'0'` instead of being
+* silently skipped (the pre-#1160 truthiness gates dropped a 0 sample
+* rate on create and update alike).
+*
+* `onMalformed` picks the failure mode for a malformed container / entry
+* / unknown protocol: `'throw'` for the DESIRED side (a template error
+* must fail fast, naming the offending value), `'skip'` for the PREVIOUS
+* side (cdkd state — refusing a value an older binary recorded would make
+* the stack permanently undeployable, and an entry whose protocol cannot
+* be canonicalized maps to no attribute names anyway).
+*/
+function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
+	const map = /* @__PURE__ */ new Map();
+	if (logging == null) return map;
+	if (!Array.isArray(logging)) {
+		if (onMalformed === "skip") return map;
+		throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
+	}
+	for (const entry of logging) {
+		if (entry == null || typeof entry !== "object" || Array.isArray(entry)) {
+			if (onMalformed === "skip") continue;
+			throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging entries must be {Protocol, ...} objects, got ${JSON.stringify(entry)}`);
+		}
+		const config = entry;
+		let protocol;
+		if (onMalformed === "throw") protocol = normalizeDeliveryStatusProtocolOrThrow(config["Protocol"], logicalId);
+		else {
+			const normalized = normalizeDeliveryStatusProtocol(config["Protocol"]);
+			if (normalized === void 0) continue;
+			protocol = normalized;
+		}
+		for (const suffix of SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES) {
+			const value = config[suffix];
+			if (value == null) continue;
+			map.set(`${protocol}${suffix}`, stringifyValue(value));
+		}
+	}
+	return map;
+}
+/**
+* The `SetTopicAttributes` value that resets a REMOVED per-protocol
+* delivery status attribute to its CloudFormation-removal state.
+*
+* Live CFn A/B (2026-08-10, issue #1160): removing `DeliveryStatusLogging`
+* from a template clears both RoleArn attributes (AWS accepts `''` as the
+* clear sentinel — the attribute disappears from `GetTopicAttributes`) and
+* explicitly resets `SuccessFeedbackSampleRate` to `'0'`. The `''`
+* sentinel is REJECTED for the sample rate ("value provided is not an
+* integer between 0-100"), so the numeric reset is the only wire shape
+* that clears it — the `'0'` attribute itself remains visible on the
+* topic afterwards, exactly as it does after a CloudFormation removal.
+*/
+function deliveryStatusRemovalResetValue(attributeName) {
+	return attributeName.endsWith("SuccessFeedbackSampleRate") ? "0" : "";
+}
+/**
 * Map a (possibly-mixed-case) protocol string from a CFn template to the
 * canonical PascalCase prefix AWS expects on `${Protocol}<Suffix>`
 * attribute names.
@@ -67163,7 +67218,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.38");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.39");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;