@go-to-k/cdkd 0.280.0 → 0.280.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-DRLo8PHT.js";
+import { $ as DiffCalculator, $t as resolveBucketRegion, A as red, At as getDockerImageBySourceHash, B as isTerminationProtectionPropagationError, Bt as resolveStateBucketWithDefaultAndSource, C as isStatefulRecreateTargetSync, Ct as validateContainerRepoName, D as cyan, Dt as runDockerForeground, E as bold, En as withErrorHandling, Et as getDockerCmd, F as ProviderRegistry, Ft as resolveApp, G as normalizeAwsTagsToCfn, Gt as CFN_TEMPLATE_URL_LIMIT, H as cfnRefValueFromPhysicalId, Ht as stateBucketExistenceConfirmed, I as findActionableSilentDrops, It as resolveAutoAssetStorage, J as readConfigString, Jt as uploadCfnTemplate, K as resolveExplicitPhysicalId, Kt as MIGRATE_TMP_PREFIX, L as CloudControlProvider, Lt as resolveCaptureObservedState, M as IAMRoleProvider, Mt as synthesisStatusMessage, N as collectInlinePolicyNamesManagedBySiblings, Nt as getDefaultStateBucketName, O as gray, Ot as runDockerStreaming, P as clearOnUpdateRemoval, Pt as getLegacyStateBucketName, Q as applyRoleArnIfSet, R as slowCcOperationTimeoutMs, Rt as resolveSkipPrefix, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, St as validateAssetBucketName, T as formatResourceLine, Tn as normalizeAwsError, Tt as formatDockerLoginError, U as refStateLookupFromResource, Ut as warnDeprecatedNoPrefixCliFlag, V as IntrinsicFunctionResolver, Vt as resolveUseCdkBootstrapAssets, W as WAFv2WebACLProvider, Wt as CFN_TEMPLATE_BODY_LIMIT, X as requireConfigArray, Xt as AssemblyReader, Y as replayWarn, Yt as expectedOwnerParam, Z as requireConfigString, Zt as processStackMessages, _ as createPreDeleteFinalSnapshot, _n as ResourceTimeoutError, _t as AssetModeResolver, a as DeploymentEventsStore, an as CdkdError, at as TemplateParser, b as unsupportedFinalSnapshotError, bn as StackTerminationProtectionError, bt as getBootstrapMarkerKey, c as replayFailedOperations, cn as DeployCancelledError, ct as rebuildClientForBucketRegion, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalStartServiceError, dt as stringifyValue, en as AwsClients, et as describeTypeWithThrottleRetry, f as computeImplicitDeleteEdges, ft as WorkGraph, g as ccRoutedFinalSnapshotError, gn as ProvisioningError, gt as rewriteTemplateAssetReferences, h as buildFinalSnapshotIdentifier, hn as PartialFailureError, ht as loadPublishableAssetManifest, i as DeploymentEventsReader, it as DagBuilder, j as yellow, jt as Synthesizer, k as green, kt as AssetManifestLoader, l as replayRollback, ln as LocalInvokeBuildError$1, lt as shouldRetainResource, m as PRE_DELETE_SNAPSHOT_TYPES, mn as NestedStackChildDirectDestroyError, mt as createAssetRedirectResolver, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as resetAwsClients, nt as isRetryableTransientError, o as planFailedOps, ot as LockManager, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as MissingCdkCliError, pt as buildAssetRedirectMap, q as assertRegionMatch, qt as findLargeInlineResources, r as DeployEngine, rn as setAwsClients, rt as isThrottlingError, s as planRollback, st as S3StateBackend, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as getAwsClients, tt as withRetry, u as withResourceDeadline, un as LocalMigrateError, ut as AssetPublisher, v as isFinalSnapshotError, vn as ResourceUpdateNotSupportedError, vt as BOOTSTRAP_MARKER_PREFIX, w as renderStatefulReason, wt as buildDockerImage, x as extractDeploymentEventError, xt as parseBootstrapMarker, y as refusesFinalSnapshot, yn as StackHasActiveImportsError, yt as ensureAssetStorage, z as disableInstanceApiTermination, zt as resolveStateBucketWithDefault } from "./deploy-engine-DK0y5OP8.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-XOMGgJrK.js";
+import { t as ASGProvider } from "./asg-provider-CwKNCS78.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4863,7 +4863,7 @@ function s3BucketDestinationPath(dest, destinationPath) {
 * exported from there because `resolveS3BucketDestination` is S3-specific
 * branch selection, not a shared shape guard — the two only share the wording.
 */
-function describeValue(value) {
+function describeValue$1(value) {
 	if (value === null) return "null";
 	if (Array.isArray(value)) return "an array";
 	if (typeof value === "string") return `a string ${JSON.stringify(value)}`;
@@ -5433,11 +5433,11 @@ var S3BucketProvider = class S3BucketProvider {
 			throw new Error(message);
 		};
 		if (dest === void 0 || dest === null) return;
-		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue(dest)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$1(dest)) return drop(`${destinationPath} must be an object (got ${describeValue$1(dest)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
 		const bag = isFlattenedDestination(dest) ? dest : dest["S3BucketDestination"];
-		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue(dest)}) — the destination would otherwise be dropped from the request with no error`);
-		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue(bag)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
-		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue(bag)}) — the request would be rejected by S3, or silently carry no destination`);
+		if (bag === void 0 || bag === null) return drop(`${destinationPath} carries neither a bucket (BucketArn / Bucket) nor a nested S3BucketDestination object (got ${describeValue$1(dest)}) — the destination would otherwise be dropped from the request with no error`);
+		if (!isPlainObject$1(bag)) return drop(`${nestedPath} must be an object (got ${describeValue$1(bag)}) — check for an unresolved intrinsic or a mis-nested template value; the destination would otherwise be dropped from the request with no error`);
+		if (!bag["BucketArn"] && !bag["Bucket"]) return drop(`${bag === dest ? destinationPath : nestedPath} has no destination bucket (BucketArn / Bucket) (got ${describeValue$1(bag)}) — the request would be rejected by S3, or silently carry no destination`);
 		return bag;
 	}
 	/**
@@ -43326,6 +43326,87 @@ const DEFAULT_EVENT_SELECTORS = Object.freeze([Object.freeze({
 	IncludeManagementEvents: true
 })]);
 /**
+* `undefined` for an absent / null / EMPTY optional string field.
+*
+* Module-scoped since issue #1565 so `create()` can use it too: an always-emit
+* placeholder can reach `create()` — `drift --accept` falls back to mutating
+* `properties` when `observedProperties` is absent, and the rollback executor
+* replays `previousState.properties` through `create()` on a reverse
+* replacement — and `CreateTrail` with `CloudWatchLogsLogGroupArn: ''` is an
+* UNPROBED shape that may 400 on ARN format. `''` there means "not
+* configured", which is exactly what omitting the field says.
+*
+* The update path is where the distinction between absent and `''` matters
+* (see {@link resolveCloudWatchLogsPair}); on create there is no previous
+* value to clear, so both collapse to "omit".
+*/
+function emptyToUndefined(v) {
+	if (v === void 0 || v === null || v === "") return void 0;
+	return v;
+}
+/**
+* Resolve the `CloudWatchLogsLogGroupArn` / `CloudWatchLogsRoleArn` pair for an
+* `UpdateTrail`, distinguishing an ABSENT desired side from an explicit `''`.
+*
+* The pair is all-or-nothing on AWS, so the two fields are decided TOGETHER —
+* the caller cannot build the half-configured request AWS rejects.
+*
+* - ABSENT (`undefined` / `null`) on BOTH sides -> send neither. The template
+*   never declared them, and the live CFn A/B (2026-08-10) measured a template
+*   removal as RETAINED, so sending nothing IS the parity behavior. `null`
+*   counts as absent because a JSON state round-trip can produce one where the
+*   template had nothing.
+* - BOTH `''` -> send both. `''` is the clear, which is what makes a
+*   `drift --revert` of a console-side enable actually revert (issue #1565).
+*   On an already-unwired trail that re-asserts a null field, which AWS accepts
+*   as the no-op it is, and it rides an `UpdateTrail` this method issues
+*   anyway. Deliberately NOT gated on "differs from the previous side": that
+*   gate would also stop forwarding an UNCHANGED populated pair, which
+*   `cloudtrail-provider-roundtrip.test.ts` pins as a wire-layer guarantee.
+* - BOTH populated -> send both verbatim.
+* - Anything else — a non-string value, or exactly ONE half populated -> send
+*   NEITHER, and report it. Both shapes are unusable rather than meaningful:
+*   coercing them would send `''` next to a real ARN (the request AWS rejects)
+*   or, worse, read a malformed `null` as a CLEAR and silently disable a live
+*   trail's CloudWatch Logs delivery — the
+*   `malformed-value-must-not-read-as-removal` class this same file already
+*   guards for `EventSelectors`. Leaving the pair alone is the non-destructive
+*   reading, and the caller warns so the divergence is loud.
+*
+* Only the DESIRED side decides, which keeps the guard-the-desired-side-only
+* rule intact.
+*/
+function resolveCloudWatchLogsPair(properties) {
+	const desiredGroup = properties["CloudWatchLogsLogGroupArn"];
+	const desiredRole = properties["CloudWatchLogsRoleArn"];
+	if (desiredGroup == null && desiredRole == null) return {
+		logGroupArn: void 0,
+		roleArn: void 0
+	};
+	if (typeof desiredGroup !== "string" || typeof desiredRole !== "string") return {
+		logGroupArn: void 0,
+		roleArn: void 0,
+		unusable: `CloudWatchLogsLogGroupArn / CloudWatchLogsRoleArn must both be strings (got ${describeValue(desiredGroup)} / ${describeValue(desiredRole)}) — check for an unresolved intrinsic or a half-written state record`
+	};
+	if (desiredGroup === "" !== (desiredRole === "")) return {
+		logGroupArn: void 0,
+		roleArn: void 0,
+		unusable: "CloudWatchLogsLogGroupArn / CloudWatchLogsRoleArn are all-or-nothing on AWS, but only one of them carries a value — sending the pair would be rejected"
+	};
+	return {
+		logGroupArn: desiredGroup,
+		roleArn: desiredRole
+	};
+}
+/** Human-readable type for a warning, without echoing user data. */
+function describeValue(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "nothing";
+	if (Array.isArray(value)) return "an array";
+	if (typeof value === "string") return value === "" ? "''" : "a string";
+	return `a ${typeof value}`;
+}
+/**
 * SDK Provider for AWS CloudTrail resources
 *
 * Supports:
@@ -43364,16 +43445,16 @@ var CloudTrailProvider = class {
 		const s3BucketName = properties["S3BucketName"];
 		if (!s3BucketName) throw new ProvisioningError(`S3BucketName is required for CloudTrail Trail ${logicalId}`, resourceType, logicalId);
 		const trailName = properties["TrailName"];
-		const s3KeyPrefix = properties["S3KeyPrefix"];
+		const s3KeyPrefix = emptyToUndefined(properties["S3KeyPrefix"]);
 		const isMultiRegionTrail = properties["IsMultiRegionTrail"];
 		const includeGlobalServiceEvents = properties["IncludeGlobalServiceEvents"];
 		const enableLogFileValidation = properties["EnableLogFileValidation"];
 		const isLogging = properties["IsLogging"];
 		const tags = properties["Tags"];
-		const cloudWatchLogsLogGroupArn = properties["CloudWatchLogsLogGroupArn"];
-		const cloudWatchLogsRoleArn = properties["CloudWatchLogsRoleArn"];
-		const kmsKeyId = properties["KMSKeyId"];
-		const snsTopicName = properties["SnsTopicName"];
+		const cloudWatchLogsLogGroupArn = emptyToUndefined(properties["CloudWatchLogsLogGroupArn"]);
+		const cloudWatchLogsRoleArn = emptyToUndefined(properties["CloudWatchLogsRoleArn"]);
+		const kmsKeyId = emptyToUndefined(properties["KMSKeyId"]);
+		const snsTopicName = emptyToUndefined(properties["SnsTopicName"]);
 		const isOrganizationTrail = properties["IsOrganizationTrail"];
 		const eventSelectors = properties["EventSelectors"];
 		const insightSelectors = properties["InsightSelectors"];
@@ -43425,19 +43506,17 @@ var CloudTrailProvider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating CloudTrail Trail ${logicalId}: ${physicalId}`);
-		const emptyToUndefined = (v) => {
-			if (v === void 0 || v === null || v === "") return void 0;
-			return v;
-		};
 		const s3BucketName = properties["S3BucketName"];
 		const s3KeyPrefix = clearOnUpdateRemoval(emptyToUndefined(properties["S3KeyPrefix"]), emptyToUndefined(previousProperties["S3KeyPrefix"]), "");
 		const isMultiRegionTrail = clearOnUpdateRemoval(properties["IsMultiRegionTrail"], previousProperties["IsMultiRegionTrail"], false);
 		const includeGlobalServiceEvents = isMultiRegionTrail === false ? clearOnUpdateRemoval(properties["IncludeGlobalServiceEvents"], previousProperties["IncludeGlobalServiceEvents"], false) : properties["IncludeGlobalServiceEvents"];
 		const enableLogFileValidation = clearOnUpdateRemoval(properties["EnableLogFileValidation"], previousProperties["EnableLogFileValidation"], false);
 		const isLogging = properties["IsLogging"];
-		const cloudWatchLogsLogGroupArn = emptyToUndefined(properties["CloudWatchLogsLogGroupArn"]);
-		const cloudWatchLogsRoleArn = emptyToUndefined(properties["CloudWatchLogsRoleArn"]);
-		const kmsKeyId = emptyToUndefined(properties["KMSKeyId"]);
+		const cwPair = resolveCloudWatchLogsPair(properties);
+		if (cwPair.unusable !== void 0) this.logger.warn(`CloudTrail Trail ${logicalId}: ${cwPair.unusable}. The trail's existing CloudWatch Logs wiring is left untouched for this update.`);
+		const cloudWatchLogsLogGroupArn = cwPair.logGroupArn;
+		const cloudWatchLogsRoleArn = cwPair.roleArn;
+		const kmsKeyId = clearOnUpdateRemoval(emptyToUndefined(properties["KMSKeyId"]), emptyToUndefined(previousProperties["KMSKeyId"]), "");
 		const snsTopicName = clearOnUpdateRemoval(emptyToUndefined(properties["SnsTopicName"]), emptyToUndefined(previousProperties["SnsTopicName"]), "");
 		const isOrganizationTrail = properties["IsOrganizationTrail"];
 		try {
@@ -43618,10 +43697,8 @@ var CloudTrailProvider = class {
 		result["IsMultiRegionTrail"] = trail.IsMultiRegionTrail ?? false;
 		result["IncludeGlobalServiceEvents"] = trail.IncludeGlobalServiceEvents ?? true;
 		result["EnableLogFileValidation"] = trail.LogFileValidationEnabled ?? false;
-		if (trail.CloudWatchLogsLogGroupArn && trail.CloudWatchLogsRoleArn) {
-			result["CloudWatchLogsLogGroupArn"] = trail.CloudWatchLogsLogGroupArn;
-			result["CloudWatchLogsRoleArn"] = trail.CloudWatchLogsRoleArn;
-		}
+		result["CloudWatchLogsLogGroupArn"] = trail.CloudWatchLogsLogGroupArn ?? "";
+		result["CloudWatchLogsRoleArn"] = trail.CloudWatchLogsRoleArn ?? "";
 		result["KMSKeyId"] = trail.KmsKeyId ?? "";
 		result["SnsTopicName"] = trail.SnsTopicName ?? "";
 		result["IsOrganizationTrail"] = trail.IsOrganizationTrail ?? false;
@@ -68288,7 +68365,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.2");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;