@go-to-k/cdkd 0.278.43 → 0.278.45

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-1qwryuQH.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-BmTgBkZO.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-DIkqTnMR.js";
+import { t as ASGProvider } from "./asg-provider-QfA3xnx8.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -8001,7 +8001,7 @@ var SNSTopicProvider = class {
 	* attributes (`{Protocol}SuccessFeedbackRoleArn` etc.) back to the CFn
 	* array shape `[{Protocol, SuccessFeedbackRoleArn?, SuccessFeedbackSampleRate?,
 	* FailureFeedbackRoleArn?}]`. Walks the known protocol prefix list
-	* (`HTTP` / `HTTPS` / `SQS` / `Lambda` / `Firehose` / `Application`); a
+	* (`HTTP` / `SQS` / `Lambda` / `Firehose` / `Application`); a
 	* protocol is included in the result iff at least one of its three
 	* sub-attributes is set on the topic. Entries are sorted by canonical
 	* PascalCase `Protocol` for stable positional compare (AWS does not
@@ -8166,11 +8166,26 @@ const SNS_DELIVERY_STATUS_PROTOCOLS = [
 	"Application",
 	"Firehose",
 	"HTTP",
-	"HTTPS",
 	"Lambda",
 	"SQS"
 ];
 /**
+* The template-side `Protocol` spellings `normalizeDeliveryStatusProtocol`
+* accepts, for the fail-fast error message. This is deliberately NOT
+* `SNS_DELIVERY_STATUS_PROTOCOLS` (the AWS attribute prefixes): the canonical
+* CFn / CDK spelling of the HTTP-family protocol is `http/s`, which is not a
+* prefix, and `https` is accepted only as a tolerated legacy alias. Listing
+* the prefixes would tell a user to write `HTTP`, which is not what the CFn
+* schema's allowed-value list nor `sns.LoggingProtocol` says.
+*/
+const SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS = [
+	"application",
+	"firehose",
+	"http/s",
+	"lambda",
+	"sqs"
+];
+/**
 * The per-protocol attribute suffixes an inline `DeliveryStatusLogging`
 * entry maps to (`<Protocol><Suffix>` flat attribute names on the topic).
 */
@@ -8195,10 +8210,33 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * side (cdkd state — refusing a value an older binary recorded would make
 * the stack permanently undeployable, and an entry whose protocol cannot
 * be canonicalized maps to no attribute names anyway).
+*
+* Two entries whose `Protocol` values canonicalize to the SAME prefix
+* (`http/s` + `https`, say) collapse onto one set of attribute names. The
+* collapse is a PER-FIELD merge, not a per-entry overwrite: a later entry
+* overwrites only the sub-fields it declares, because the loop below skips
+* an absent field (`value == null`) rather than clearing it. So
+* `[{http/s, RoleArn: A, SampleRate: 10}, {https, RoleArn: B}]` yields
+* `RoleArn: B` AND `SampleRate: 10`. The warning says exactly that.
+* The case became reachable only with issue #1529, which folded the whole
+* HTTP family onto the single `HTTP` prefix — before it, the `https` arm
+* produced `HTTPS*` names AWS rejected outright, so no such template ever
+* deployed.
+*
+* The collision WARNS rather than throws because this function's `'throw'`
+* side is also fed by the rollback executor's `update()` replay of a cdkd
+* STATE record, where the user has no template-side remedy. NOTE the three
+* pre-existing throws below (unsupported protocol, non-array container,
+* non-object entry) sit on that same side and are NOT covered by that
+* reasoning — a state record carrying one of those is permanently
+* unreplayable. That is a real but latent gap, tracked as issue #1538;
+* #1529 deliberately did not widen its scope to change the create path's
+* validation contract.
 */
 function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 	const map = /* @__PURE__ */ new Map();
 	if (logging == null) return map;
+	const seenProtocols = /* @__PURE__ */ new Set();
 	if (!Array.isArray(logging)) {
 		if (onMalformed === "skip") return map;
 		throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
@@ -8216,6 +8254,8 @@ function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 			if (normalized === void 0) continue;
 			protocol = normalized;
 		}
+		if (onMalformed === "throw" && seenProtocols.has(protocol)) getLogger().child("SNSTopicProvider").warn(`SNS topic ${logicalId}: DeliveryStatusLogging declares more than one entry for the "${protocol}" attribute prefix (${JSON.stringify(config["Protocol"])} canonicalizes to it). AWS has one attribute set per prefix, so these are merged per field — a later entry overwrites only the sub-fields it declares, and a field it omits keeps the earlier entry's value. Declare a single entry per protocol.`);
+		seenProtocols.add(protocol);
 		for (const suffix of SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES) {
 			const value = config[suffix];
 			if (value == null) continue;
@@ -8251,21 +8291,39 @@ function deliveryStatusRemovalResetValue(attributeName) {
 * `InvalidParameter: Invalid parameter: AttributeName` message; failing
 * fast in cdkd lets us name the offending value.
 *
-* Case map (lowercase canonical → PascalCase prefix):
+* The whole HTTP family collapses onto the single `HTTP` prefix, which is
+* the ONLY HTTP-family prefix AWS accepts (issue #1529, live-verified
+* 2026-08-11 against CloudFormation + `SetTopicAttributes`):
+*
+* - A CFn template carrying the canonical `Protocol: http/s` produces
+*   `HTTPSuccessFeedbackRoleArn` / `HTTPFailureFeedbackRoleArn` /
+*   `HTTPSuccessFeedbackSampleRate` on the live topic. `http/s` is what
+*   `sns.LoggingProtocol.HTTP` and the CFn schema's allowed-value list both
+*   spell, so it is the spelling most real templates carry — and it used to
+*   throw `unsupported DeliveryStatusLogging protocol "http/s"`.
+* - `HTTPS*` attribute names do NOT exist: `SetTopicAttributes` rejects
+*   `HTTPSSuccessFeedbackRoleArn` with `InvalidParameter: Invalid parameter:
+*   AttributeName`. Mapping `https` to a `HTTPS` prefix (the pre-#1529
+*   behavior) therefore produced a hard AWS failure on write and a
+*   permanently-absent attribute on read.
+*
+* Case map (lowercase input → PascalCase prefix):
 *   application → Application
 *   firehose    → Firehose
-*   http        → HTTP
-*   https       → HTTPS
+*   http/s      → HTTP   (the canonical CFn / CDK L2 spelling)
+*   http        → HTTP   (tolerated alias)
+*   https       → HTTP   (tolerated alias; NOT a distinct prefix)
 *   lambda      → Lambda
-*   sqs        → SQS
+*   sqs         → SQS
 */
 function normalizeDeliveryStatusProtocol(input) {
 	if (typeof input !== "string") return void 0;
 	switch (input.toLowerCase()) {
 		case "application": return "Application";
 		case "firehose": return "Firehose";
-		case "http": return "HTTP";
-		case "https": return "HTTPS";
+		case "http/s":
+		case "http":
+		case "https": return "HTTP";
 		case "lambda": return "Lambda";
 		case "sqs": return "SQS";
 		default: return;
@@ -8279,7 +8337,7 @@ function normalizeDeliveryStatusProtocol(input) {
 */
 function normalizeDeliveryStatusProtocolOrThrow(input, logicalId) {
 	const normalized = normalizeDeliveryStatusProtocol(input);
-	if (normalized === void 0) throw new Error(`SNS topic ${logicalId}: unsupported DeliveryStatusLogging protocol ${JSON.stringify(input)}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOLS.join(", ")} (case-insensitive).`);
+	if (normalized === void 0) throw new Error(`SNS topic ${logicalId}: unsupported DeliveryStatusLogging protocol ${JSON.stringify(input)}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS.join(", ")} (case-insensitive).`);
 	return normalized;
 }
 /**
@@ -32105,6 +32163,24 @@ var ElastiCacheProvider = class {
 //#endregion
 //#region src/provisioning/providers/servicediscovery-provider.ts
 /**
+* Reset targets for a REMOVED `Properties.DnsProperties.SOA.TTL` (issue
+* #1160, servicediscovery batch). The Update*Namespace change objects MERGE
+* (an absent field keeps the live value), so the provider must send the
+* reset explicitly to mirror CloudFormation — and the default TTL is
+* PER KIND, not shared:
+*  - PublicDnsNamespace: 60. Live CFn A/B 2026-08-11 (removing the SOA
+*    block reset the customized 300 back to 60) + raw-SDK create-default
+*    probe (a namespace created without Properties reports TTL 60).
+*  - PrivateDnsNamespace: 15. Raw-SDK create-default probe 2026-08-11 (a
+*    namespace created without Properties reports TTL 15 — matching the
+*    PR #201-era live observation recorded on the create path below) +
+*    live CFn A/B 2026-08-11 on the private kind itself.
+* Removing `Description` clears it entirely on every kind (the `''`
+* sentinel; live A/B'd on all three kinds).
+*/
+const PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL = 60;
+const PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL = 15;
+/**
 * AWS Service Discovery Provider
 *
 * Implements resource provisioning for:
@@ -32242,13 +32318,20 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	*
 	* Empty-string Description is intentionally allowed through (`!== undefined`
 	* gate, not truthy) so `cdkd drift --revert` can clear a console-side ADD.
+	*
+	* Removal resets (issue #1160): the change object MERGES (absent = "no
+	* change"), so a Description / SOA.TTL REMOVED from the template must be
+	* reset explicitly — Description via the `''` clear sentinel, TTL to the
+	* kind's Cloud Map default ({@link PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL}) —
+	* the CFn-parity shape, live A/B'd 2026-08-11 on the private kind itself.
 	*/
 	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating private DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
-		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
-		const soaProperties = this.extractSoaTtlProperties(properties);
+		const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
+		if (description !== void 0) namespaceChange.Description = description;
+		const soaProperties = this.resolveSoaTtlChange(properties, previousProperties, PRIVATE_DNS_NAMESPACE_DEFAULT_SOA_TTL);
 		if (soaProperties) namespaceChange.Properties = soaProperties;
 		try {
 			if (Object.keys(namespaceChange).length > 0) {
@@ -32335,13 +32418,19 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* Empty-string Description is intentionally allowed through
 	* (`!== undefined` gate, not truthy) so `cdkd drift --revert` can clear a
 	* console-side ADD.
+	*
+	* Removal reset (issue #1160): `HttpNamespaceChange` MERGES conceptually
+	* (skipping the call keeps the live value), so a Description REMOVED from
+	* the template must be cleared explicitly via the `''` sentinel — the
+	* CFn-parity shape, live A/B'd 2026-08-11 on this exact kind.
 	*/
 	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating HTTP namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
+		const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
 		try {
-			if (properties["Description"] !== void 0) {
-				const namespaceChange = { Description: properties["Description"] };
+			if (description !== void 0) {
+				const namespaceChange = { Description: description };
 				const operationId = (await client.send(new UpdateHttpNamespaceCommand({
 					Id: physicalId,
 					Namespace: namespaceChange
@@ -32410,13 +32499,20 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 	* `Properties.DnsProperties.SOA.TTL`. `Name` is createOnly — replacement
 	* is routed through DELETE+CREATE upstream. Tags ride on the separate
 	* `TagResource` / `UntagResource` APIs (see {@link syncNamespaceTags}).
+	*
+	* Removal resets (issue #1160): the change object MERGES (absent = "no
+	* change"), so a Description / SOA.TTL REMOVED from the template must be
+	* reset explicitly — Description via the `''` clear sentinel, TTL to the
+	* kind's Cloud Map default ({@link PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL}) —
+	* the CFn-parity shape, live A/B'd 2026-08-11 on this exact kind.
 	*/
 	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating public DNS namespace ${logicalId}: ${physicalId}`);
 		const client = this.getClient();
 		const namespaceChange = {};
-		if (properties["Description"] !== void 0) namespaceChange.Description = properties["Description"];
-		const soaProperties = this.extractSoaTtlProperties(properties);
+		const description = clearOnUpdateRemoval(properties["Description"], previousProperties["Description"], "");
+		if (description !== void 0) namespaceChange.Description = description;
+		const soaProperties = this.resolveSoaTtlChange(properties, previousProperties, PUBLIC_DNS_NAMESPACE_DEFAULT_SOA_TTL);
 		if (soaProperties) namespaceChange.Properties = soaProperties;
 		try {
 			if (Object.keys(namespaceChange).length > 0) {
@@ -32595,6 +32691,20 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		return soa?.TTL !== void 0 ? { DnsProperties: { SOA: { TTL: Number(soa.TTL) } } } : void 0;
 	}
 	/**
+	* Resolve the SOA-TTL entry for an Update*Namespace change object,
+	* including the REMOVAL reset (issue #1160): a TTL present in the desired
+	* template passes through; a TTL absent from the desired template but
+	* present in the previous one is reset to the Cloud Map default
+	* the caller-supplied per-kind default (the CFn-parity shape — the change
+	* object merges, so skipping it would silently keep the customized TTL).
+	* Never-present stays absent (no change entry).
+	*/
+	resolveSoaTtlChange(properties, previousProperties, defaultTtl) {
+		const desired = this.extractSoaTtlProperties(properties);
+		if (desired) return desired;
+		if (this.extractSoaTtlProperties(previousProperties)) return { DnsProperties: { SOA: { TTL: defaultTtl } } };
+	}
+	/**
 	* Resolve a namespace's ARN — authoritative via `GetNamespace`, with a
 	* deterministic STS-based construction as fallback so a transient read
 	* failure right after create does not fail the whole resource.
@@ -67352,7 +67462,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.43");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.45");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;