@go-to-k/cdkd 0.278.44 → 0.278.45

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-CsxvH0hP.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-BmTgBkZO.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-kBhbMF94.js";
+import { t as ASGProvider } from "./asg-provider-QfA3xnx8.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -8001,7 +8001,7 @@ var SNSTopicProvider = class {
 	* attributes (`{Protocol}SuccessFeedbackRoleArn` etc.) back to the CFn
 	* array shape `[{Protocol, SuccessFeedbackRoleArn?, SuccessFeedbackSampleRate?,
 	* FailureFeedbackRoleArn?}]`. Walks the known protocol prefix list
-	* (`HTTP` / `HTTPS` / `SQS` / `Lambda` / `Firehose` / `Application`); a
+	* (`HTTP` / `SQS` / `Lambda` / `Firehose` / `Application`); a
 	* protocol is included in the result iff at least one of its three
 	* sub-attributes is set on the topic. Entries are sorted by canonical
 	* PascalCase `Protocol` for stable positional compare (AWS does not
@@ -8166,11 +8166,26 @@ const SNS_DELIVERY_STATUS_PROTOCOLS = [
 	"Application",
 	"Firehose",
 	"HTTP",
-	"HTTPS",
 	"Lambda",
 	"SQS"
 ];
 /**
+* The template-side `Protocol` spellings `normalizeDeliveryStatusProtocol`
+* accepts, for the fail-fast error message. This is deliberately NOT
+* `SNS_DELIVERY_STATUS_PROTOCOLS` (the AWS attribute prefixes): the canonical
+* CFn / CDK spelling of the HTTP-family protocol is `http/s`, which is not a
+* prefix, and `https` is accepted only as a tolerated legacy alias. Listing
+* the prefixes would tell a user to write `HTTP`, which is not what the CFn
+* schema's allowed-value list nor `sns.LoggingProtocol` says.
+*/
+const SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS = [
+	"application",
+	"firehose",
+	"http/s",
+	"lambda",
+	"sqs"
+];
+/**
 * The per-protocol attribute suffixes an inline `DeliveryStatusLogging`
 * entry maps to (`<Protocol><Suffix>` flat attribute names on the topic).
 */
@@ -8195,10 +8210,33 @@ const SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES = [
 * side (cdkd state — refusing a value an older binary recorded would make
 * the stack permanently undeployable, and an entry whose protocol cannot
 * be canonicalized maps to no attribute names anyway).
+*
+* Two entries whose `Protocol` values canonicalize to the SAME prefix
+* (`http/s` + `https`, say) collapse onto one set of attribute names. The
+* collapse is a PER-FIELD merge, not a per-entry overwrite: a later entry
+* overwrites only the sub-fields it declares, because the loop below skips
+* an absent field (`value == null`) rather than clearing it. So
+* `[{http/s, RoleArn: A, SampleRate: 10}, {https, RoleArn: B}]` yields
+* `RoleArn: B` AND `SampleRate: 10`. The warning says exactly that.
+* The case became reachable only with issue #1529, which folded the whole
+* HTTP family onto the single `HTTP` prefix — before it, the `https` arm
+* produced `HTTPS*` names AWS rejected outright, so no such template ever
+* deployed.
+*
+* The collision WARNS rather than throws because this function's `'throw'`
+* side is also fed by the rollback executor's `update()` replay of a cdkd
+* STATE record, where the user has no template-side remedy. NOTE the three
+* pre-existing throws below (unsupported protocol, non-array container,
+* non-object entry) sit on that same side and are NOT covered by that
+* reasoning — a state record carrying one of those is permanently
+* unreplayable. That is a real but latent gap, tracked as issue #1538;
+* #1529 deliberately did not widen its scope to change the create path's
+* validation contract.
 */
 function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 	const map = /* @__PURE__ */ new Map();
 	if (logging == null) return map;
+	const seenProtocols = /* @__PURE__ */ new Set();
 	if (!Array.isArray(logging)) {
 		if (onMalformed === "skip") return map;
 		throw new Error(`SNS topic ${logicalId}: DeliveryStatusLogging must be an array of {Protocol, ...} objects, got ${JSON.stringify(logging)}`);
@@ -8216,6 +8254,8 @@ function buildDeliveryStatusAttributeMap(logging, logicalId, onMalformed) {
 			if (normalized === void 0) continue;
 			protocol = normalized;
 		}
+		if (onMalformed === "throw" && seenProtocols.has(protocol)) getLogger().child("SNSTopicProvider").warn(`SNS topic ${logicalId}: DeliveryStatusLogging declares more than one entry for the "${protocol}" attribute prefix (${JSON.stringify(config["Protocol"])} canonicalizes to it). AWS has one attribute set per prefix, so these are merged per field — a later entry overwrites only the sub-fields it declares, and a field it omits keeps the earlier entry's value. Declare a single entry per protocol.`);
+		seenProtocols.add(protocol);
 		for (const suffix of SNS_DELIVERY_STATUS_ATTRIBUTE_SUFFIXES) {
 			const value = config[suffix];
 			if (value == null) continue;
@@ -8251,21 +8291,39 @@ function deliveryStatusRemovalResetValue(attributeName) {
 * `InvalidParameter: Invalid parameter: AttributeName` message; failing
 * fast in cdkd lets us name the offending value.
 *
-* Case map (lowercase canonical → PascalCase prefix):
+* The whole HTTP family collapses onto the single `HTTP` prefix, which is
+* the ONLY HTTP-family prefix AWS accepts (issue #1529, live-verified
+* 2026-08-11 against CloudFormation + `SetTopicAttributes`):
+*
+* - A CFn template carrying the canonical `Protocol: http/s` produces
+*   `HTTPSuccessFeedbackRoleArn` / `HTTPFailureFeedbackRoleArn` /
+*   `HTTPSuccessFeedbackSampleRate` on the live topic. `http/s` is what
+*   `sns.LoggingProtocol.HTTP` and the CFn schema's allowed-value list both
+*   spell, so it is the spelling most real templates carry — and it used to
+*   throw `unsupported DeliveryStatusLogging protocol "http/s"`.
+* - `HTTPS*` attribute names do NOT exist: `SetTopicAttributes` rejects
+*   `HTTPSSuccessFeedbackRoleArn` with `InvalidParameter: Invalid parameter:
+*   AttributeName`. Mapping `https` to a `HTTPS` prefix (the pre-#1529
+*   behavior) therefore produced a hard AWS failure on write and a
+*   permanently-absent attribute on read.
+*
+* Case map (lowercase input → PascalCase prefix):
 *   application → Application
 *   firehose    → Firehose
-*   http        → HTTP
-*   https       → HTTPS
+*   http/s      → HTTP   (the canonical CFn / CDK L2 spelling)
+*   http        → HTTP   (tolerated alias)
+*   https       → HTTP   (tolerated alias; NOT a distinct prefix)
 *   lambda      → Lambda
-*   sqs        → SQS
+*   sqs         → SQS
 */
 function normalizeDeliveryStatusProtocol(input) {
 	if (typeof input !== "string") return void 0;
 	switch (input.toLowerCase()) {
 		case "application": return "Application";
 		case "firehose": return "Firehose";
-		case "http": return "HTTP";
-		case "https": return "HTTPS";
+		case "http/s":
+		case "http":
+		case "https": return "HTTP";
 		case "lambda": return "Lambda";
 		case "sqs": return "SQS";
 		default: return;
@@ -8279,7 +8337,7 @@ function normalizeDeliveryStatusProtocol(input) {
 */
 function normalizeDeliveryStatusProtocolOrThrow(input, logicalId) {
 	const normalized = normalizeDeliveryStatusProtocol(input);
-	if (normalized === void 0) throw new Error(`SNS topic ${logicalId}: unsupported DeliveryStatusLogging protocol ${JSON.stringify(input)}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOLS.join(", ")} (case-insensitive).`);
+	if (normalized === void 0) throw new Error(`SNS topic ${logicalId}: unsupported DeliveryStatusLogging protocol ${JSON.stringify(input)}. Expected one of ${SNS_DELIVERY_STATUS_PROTOCOL_SPELLINGS.join(", ")} (case-insensitive).`);
 	return normalized;
 }
 /**
@@ -67404,7 +67462,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.44");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.278.45");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;