@go-to-k/cdkd 0.278.42 → 0.278.44

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-DxexHYwK.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CsxvH0hP.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-mwqciloR.js";
+import { t as ASGProvider } from "./asg-provider-kBhbMF94.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -32105,6 +32105,24 @@ var ElastiCacheProvider = class {
 //#endregion
 //#region src/provisioning/providers/servicediscovery-provider.ts
 /**
+* Reset targets for a REMOVED `Properties.DnsProperties.SOA.TTL` (issue
+* #1160, servicediscovery batch). The Update*Namespace change objects MERGE
+* (an absent field keeps the live value), so the provider must send the
+* reset explicitly to mirror CloudFormation — and the default TTL is
+* PER KIND, not shared:
+*  - PublicDnsNamespace: 60. Live CFn A/B 2026-08-11 (removing the SOA
+*    block reset the customized 300 back to 60) + raw-SDK create-default
+*    probe (a namespace created without Properties reports TTL 60).
+*  - PrivateDnsNamespace: 15. Raw-SDK create-default probe 2026-08-11 (a
+*    namespace created without Properties reports TTL 15 — matching the
+*    PR #201-era live observation recorded on the create path below) +
+*    live CFn A/B 2026-08-11 on the private kind itself.
+* Removing `Description` clears it entirely on every kind (the `''`
+* sentinel; live A/B'd on all three kinds).
+*/
+const PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL = 60;
+const PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL = 15;
+/**
 * AWS Service Discovery Provider
 *
 * Implements resource provisioning for:
@@ -32242,13 +32260,20 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	*
 	* Empty-string Description is intentionally allowed through (`!== undefined`
 	* gate, not truthy) so `cdkd drift --revert` can clear a console-side ADD.
+	*
+	* Removal resets (issue #1160): the change object MERGES (absent = "no
+	* change"), so a Description / SOA.TTL REMOVED from the template must be
+	* reset explicitly — Description via the `''` clear sentinel, TTL to the
+	* kind's Cloud Map default ({@link PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL}) —
+	* the CFn-parity shape, live A/B'd 2026-08-11 on the private kind itself.
 	*/
 	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating private DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
-		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
-		const soaProperties = this.extractSoaTtlProperties(properties);
+		const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
+		if (description !== void 0) namespaceChange.Description = description;
+		const soaProperties = this.resolveSoaTtlChange(properties, previousProperties, PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL);
 		if (soaProperties) namespaceChange.Properties = soaProperties;
 		try {
 			if (Object.keys(namespaceChange).length > 0) {
@@ -32335,13 +32360,19 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* Empty-string Description is intentionally allowed through
 	* (`!== undefined` gate, not truthy) so `cdkd drift --revert` can clear a
 	* console-side ADD.
+	*
+	* Removal reset (issue #1160): `HttpNamespaceChange` MERGES conceptually
+	* (skipping the call keeps the live value), so a Description REMOVED from
+	* the template must be cleared explicitly via the `''` sentinel — the
+	* CFn-parity shape, live A/B'd 2026-08-11 on this exact kind.
 	*/
 	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating HTTP namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
+		const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
 		try {
-			if (properties["Description"] !== void 0) {
-				const namespaceChange = { Description: properties["Description"] };
+			if (description !== void 0) {
+				const namespaceChange = { Description: description };
 				const operationId = (await client.send(new UpdateHttpNamespaceCommand({
 					Id: physicalId,
 					Namespace: namespaceChange
@@ -32410,13 +32441,20 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* `Properties.DnsProperties.SOA.TTL`. `Name` is createOnly — replacement
 	* is routed through DELETE+CREATE upstream. Tags ride on the separate
 	* `TagResource` / `UntagResource` APIs (see {@link syncNamespaceTags}).
+	*
+	* Removal resets (issue #1160): the change object MERGES (absent = "no
+	* change"), so a Description / SOA.TTL REMOVED from the template must be
+	* reset explicitly — Description via the `''` clear sentinel, TTL to the
+	* kind's Cloud Map default ({@link PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL}) —
+	* the CFn-parity shape, live A/B'd 2026-08-11 on this exact kind.
 	*/
 	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating public DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
-		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
-		const soaProperties = this.extractSoaTtlProperties(properties);
+		const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
+		if (description !== void 0) namespaceChange.Description = description;
+		const soaProperties = this.resolveSoaTtlChange(properties, previousProperties, PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL);
 		if (soaProperties) namespaceChange.Properties = soaProperties;
 		try {
 			if (Object.keys(namespaceChange).length > 0) {
@@ -32595,6 +32633,20 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		return soa?.TTL !== void 0 ? { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } } : void 0;
 	}
 	/**
+	* Resolve the SOA-TTL entry for an Update*Namespace change object,
+	* including the REMOVAL reset (issue #1160): a TTL present in the desired
+	* template passes through; a TTL absent from the desired template but
+	* present in the previous one is reset to the Cloud Map default
+	* the caller-supplied per-kind default (the CFn-parity shape — the change
+	* object merges, so skipping it would silently keep the customized TTL).
+	* Never-present stays absent (no change entry).
+	*/
+	resolveSoaTtlChange(properties, previousProperties, defaultTtl) {
+		const desired = this.extractSoaTtlProperties(properties);
+		if (desired) return desired;
+		if (this.extractSoaTtlProperties(previousProperties)) return { DnsProperties: { SOA: { TTL: defaultTtl } } };
+	}
+	/**
 	* Resolve a namespace's ARN — authoritative via `GetNamespace`, with a
 	* deterministic STS-based construction as fallback so a transient read
 	* failure right after create does not fail the whole resource.
@@ -37941,7 +37993,8 @@ var EFSProvider = class {
 		const newProvisioned = properties["ProvisionedThroughputInMibps"];
 		const oldThroughputMode = previousProperties["ThroughputMode"];
 		const oldProvisioned = previousProperties["ProvisionedThroughputInMibps"];
-		const throughputModeChanged = newThroughputMode !== void 0 && newThroughputMode !== oldThroughputMode;
+		const effectiveThroughputMode = newThroughputMode === void 0 && newProvisioned === void 0 && oldThroughputMode === "provisioned" ? "bursting" : newThroughputMode;
+		const throughputModeChanged = effectiveThroughputMode !== void 0 && effectiveThroughputMode !== oldThroughputMode;
 		const provisionedChanged = newProvisioned !== void 0 && newProvisioned !== oldProvisioned;
 		const changed = (key) => JSON.stringify(properties[key]) !== JSON.stringify(previousProperties[key]);
 		const lifecycleChanged = changed("LifecyclePolicies");
@@ -37960,7 +38013,7 @@ var EFSProvider = class {
 			if (throughputModeChanged || provisionedChanged) {
 				await this.getClient().send(new UpdateFileSystemCommand({
 					FileSystemId: physicalId,
-					...throughputModeChanged && { ThroughputMode: newThroughputMode },
+					...throughputModeChanged && { ThroughputMode: effectiveThroughputMode },
 					...provisionedChanged && { ProvisionedThroughputInMibps: newProvisioned }
 				}));
 				await this.waitForFileSystemAvailable(physicalId, logicalId, resourceType);
@@ -67351,7 +67404,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.42");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.44");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;