@go-to-k/cdkd 0.280.18 → 0.280.19

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-mvkiu-7h.js";
+import { $ as requireConfigString, $t as processStackMessages, A as red, At as runDockerStreaming, B as isTerminationProtectionPropagationError, Bt as resolveSkipPrefix, C as isStatefulRecreateTargetSync, Ct as parseBootstrapMarker, D as cyan, Dn as normalizeAwsError, Dt as formatDockerLoginError, E as bold, Et as buildDockerImage, F as ProviderRegistry, Ft as getDefaultStateBucketName, G as normalizeAwsTagsToCfn, Gt as warnDeprecatedNoPrefixCliFlag, H as cfnRefValueFromPhysicalId, Ht as resolveStateBucketWithDefaultAndSource, I as findActionableSilentDrops, It as getLegacyStateBucketName, J as configStringRefusal, Jt as MIGRATE_TMP_PREFIX, K as resolveExplicitPhysicalId, Kt as CFN_TEMPLATE_BODY_LIMIT, L as CloudControlProvider, Lt as resolveApp, M as IAMRoleProvider, Mt as getDockerImageBySourceHash, N as collectInlinePolicyNamesManagedBySiblings, Nt as Synthesizer, O as gray, On as withErrorHandling, Ot as getDockerCmd, P as clearOnUpdateRemoval, Pt as synthesisStatusMessage, Q as requireConfigObject, Qt as AssemblyReader, R as slowCcOperationTimeoutMs, Rt as resolveAutoAssetStorage, S as MULTI_REGION_RECREATE_BLOCKED_TYPES, Sn as StackTerminationProtectionError, St as getBootstrapMarkerKey, T as formatResourceLine, Tt as validateContainerRepoName, U as refStateLookupFromResource, Ut as resolveUseCdkBootstrapAssets, V as IntrinsicFunctionResolver, Vt as resolveStateBucketWithDefault, W as WAFv2WebACLProvider, Wt as stateBucketExistenceConfirmed, X as replayWarn, Xt as uploadCfnTemplate, Y as readConfigString, Yt as findLargeInlineResources, Z as requireConfigArray, Zt as expectedOwnerParam, _ as createPreDeleteFinalSnapshot, _n as PartialFailureError, _t as loadPublishableAssetManifest, a as DeploymentEventsStore, an as setAwsClients, at as isThrottlingError, b as unsupportedFinalSnapshotError, bn as ResourceUpdateNotSupportedError, bt as BOOTSTRAP_MARKER_PREFIX, c as replayFailedOperations, ct as LockManager, d as IMPLICIT_DELETE_DEPENDENCIES, dn as LocalInvokeBuildError$1, dt as shouldRetainResource, et as applyRoleArnIfSet, f as computeImplicitDeleteEdges, fn as LocalMigrateError, ft as AssetPublisher, g as ccRoutedFinalSnapshotError, gn as NestedStackChildDirectDestroyError, gt as createAssetRedirectResolver, h as buildFinalSnapshotIdentifier, hn as MissingCdkCliError, ht as buildAssetRedirectMap, i as DeploymentEventsReader, in as resetAwsClients, it as isRetryableTransientError, j as yellow, jt as AssetManifestLoader, k as green, kt as runDockerForeground, l as replayRollback, lt as S3StateBackend, m as PRE_DELETE_SNAPSHOT_TYPES, mt as WorkGraph, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as AwsClients, nt as describeTypeWithThrottleRetry, o as planFailedOps, ot as DagBuilder, p as ATOMIC_FINAL_SNAPSHOT_TYPES, pn as LocalStartServiceError, pt as stringifyValue, q as assertRegionMatch, qt as CFN_TEMPLATE_URL_LIMIT, r as DeployEngine, rn as getAwsClients, rt as withRetry, s as planRollback, sn as CdkdError, st as TemplateParser, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as resolveBucketRegion, tt as DiffCalculator, u as withResourceDeadline, un as DeployCancelledError, ut as rebuildClientForBucketRegion, v as isFinalSnapshotError, vn as ProvisioningError, vt as rewriteTemplateAssetReferences, w as renderStatefulReason, wt as validateAssetBucketName, x as extractDeploymentEventError, xn as StackHasActiveImportsError, xt as ensureAssetStorage, y as refusesFinalSnapshot, yn as ResourceTimeoutError, yt as AssetModeResolver, z as disableInstanceApiTermination, zt as resolveCaptureObservedState } from "./deploy-engine-r4N9-tZD.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-C6cQkX3h.js";
+import { t as ASGProvider } from "./asg-provider-B62D31jG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -27873,6 +27873,78 @@ const TARGET_GROUP_ATTRIBUTE_DEFAULTS = {
 	"proxy_protocol_v2.enabled": "false"
 };
 /**
+* Documented AWS defaults for the BOOLEAN / ENUM-valued LoadBalancer and
+* Listener attributes, used to reset a removed `LoadBalancerAttributes` /
+* `ListenerAttributes` entry.
+*
+* Unlike ModifyTargetGroupAttributes — which rejects an empty `Value` for
+* EVERY key — these two APIs accept `Value: ''` for the numeric and
+* free-form string attributes and REJECT it only where the value is
+* validated against a fixed set. Live A/B 2026-08-11 (issue #1609 item 1),
+* via the `alb` integ's removal phase:
+*
+*   idle_timeout.timeout_seconds  -> `Value: ''` ACCEPTED (numeric)
+*   deletion_protection.enabled   -> "The value of 'deletion_protection.enabled'
+*                                     must be 'true' or 'false', but was ''"
+*   routing.http.response.server.enabled (Listener)
+*                                 -> same rejection, same shape
+*
+* A rejection fails the whole Modify* call, so ONE removed boolean took the
+* entire deploy down (and then the rollback with it). Hence: send the
+* documented default for the validated keys, and keep the empty string for
+* everything else — which is both these APIs' own "clear the override"
+* signal and the behaviour every non-boolean key already relied on.
+*
+* That fallback is the deliberate DIVERGENCE from
+* TARGET_GROUP_ATTRIBUTE_DEFAULTS, whose unknown-key arm warns and retains:
+* there the empty string is never valid, here it is valid for the majority
+* of keys, so falling back to it preserves working behaviour instead of
+* silently retaining a value the template asked to drop.
+*
+* A key is listed ONLY when ONE unconditional default is established for it —
+* documented in the SDK model, or (for
+* `routing.http.response.server.enabled`, which the model leaves unstated)
+* proven by the `alb` integ's live removal readback. Two exclusion classes
+* matter, and both are the difference between failing loudly and writing a
+* wrong value silently:
+*
+* - **Default depends on the LOAD BALANCER** — `load_balancing.cross_zone.enabled`
+*   is always-on and unconfigurable for an ALB but defaults to false on an
+*   NLB / GWLB, and `ipv6.deny_all_igw_traffic` is "false for internet-facing
+*   load balancers and true for internal load balancers". cdkd knows neither
+*   the type nor the scheme at diff time, so a hardcoded entry would send the
+*   WRONG value for half of all load balancers — and since it is a valid
+*   boolean, AWS accepts it. For `ipv6.deny_all_igw_traffic` that means
+*   silently un-blocking internet-gateway access on an INTERNAL load balancer.
+* - **No documented default at all** — `dns_record.client_routing_policy`
+*   enumerates its possible values but states no default.
+*
+* Both classes keep the empty-string behaviour they have always had, so a
+* removal there fails loudly (for a validated key) instead of guessing.
+*
+* Source: the `@aws-sdk/client-elastic-load-balancing-v2` model docs for
+* `ModifyLoadBalancerAttributes` / `ModifyListenerAttributes`, checked per key;
+* `routing.http.response.server.enabled`'s default is additionally LIVE-proven
+* by the `alb` integ's removal readback rather than taken from the docs.
+*/
+const LOAD_BALANCER_ATTRIBUTE_DEFAULTS = {
+	"deletion_protection.enabled": "false",
+	"access_logs.s3.enabled": "false",
+	"connection_logs.s3.enabled": "false",
+	"health_check_logs.s3.enabled": "false",
+	"routing.http.desync_mitigation_mode": "defensive",
+	"routing.http.drop_invalid_header_fields.enabled": "false",
+	"routing.http.preserve_host_header.enabled": "false",
+	"routing.http.x_amzn_tls_version_and_cipher_suite.enabled": "false",
+	"routing.http.xff_client_port.enabled": "false",
+	"routing.http.xff_header_processing.mode": "append",
+	"routing.http2.enabled": "true",
+	"waf.fail_open.enabled": "false",
+	"zonal_shift.config.enabled": "false"
+};
+/** @see LOAD_BALANCER_ATTRIBUTE_DEFAULTS — same rule, Listener key table. */
+const LISTENER_ATTRIBUTE_DEFAULTS = { "routing.http.response.server.enabled": "true" };
+/**
 * AWS ELBv2 Provider
 *
 * Implements resource provisioning for ELBv2 resources:
@@ -28085,7 +28157,7 @@ var ELBv2Provider = class {
 			return out;
 		};
 		if (JSON.stringify(stripHandled(properties)) !== JSON.stringify(stripHandled(previousProperties))) throw new ResourceUpdateNotSupportedError("AWS::ElasticLoadBalancingV2::LoadBalancer", logicalId, "ELBv2 LoadBalancer Name / Type / Scheme are immutable on AWS — none of the ELBv2 Modify* / Set* APIs accept these fields; they are fixed at creation. cdkd handles LoadBalancerAttributes / Subnets / SubnetMappings / SecurityGroups / IpAddressType / Tags in-place; for Name / Type / Scheme re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.");
-		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]));
+		const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["LoadBalancerAttributes"]), this.normalizeAttributes(previousProperties["LoadBalancerAttributes"]), this.attributeRemovalResolver(LOAD_BALANCER_ATTRIBUTE_DEFAULTS));
 		if (submittedAttrs.length > 0) {
 			await this.getClient().send(new ModifyLoadBalancerAttributesCommand({
 				LoadBalancerArn: physicalId,
@@ -28309,10 +28381,13 @@ var ELBv2Provider = class {
 				UnhealthyThresholdCount: properties["UnhealthyThresholdCount"] !== void 0 ? Number(properties["UnhealthyThresholdCount"]) : void 0,
 				...matcher && { Matcher: matcher }
 			}));
-			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key) => {
-				const fallback = TARGET_GROUP_ATTRIBUTE_DEFAULTS[key];
-				if (fallback === void 0) this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
-				return fallback;
+			const tgAttrDiff = this.diffAttributes(this.normalizeAttributes(properties["TargetGroupAttributes"]), this.normalizeAttributes(previousProperties["TargetGroupAttributes"]), (key, currentValue) => {
+				const fallback = Object.hasOwn(TARGET_GROUP_ATTRIBUTE_DEFAULTS, key) ? TARGET_GROUP_ATTRIBUTE_DEFAULTS[key] : void 0;
+				if (fallback === void 0) {
+					this.logger.warn(`TargetGroup attribute ${key} was removed from the template but has no documented default cdkd can reset it to — the live value is retained. Set the attribute explicitly to change it.`);
+					return;
+				}
+				return currentValue === fallback ? void 0 : fallback;
 			});
 			if (tgAttrDiff.length > 0) {
 				await this.getClient().send(new ModifyTargetGroupAttributesCommand({
@@ -28444,7 +28519,7 @@ var ELBv2Provider = class {
 				...alpnPolicy && alpnPolicy.length > 0 && { AlpnPolicy: alpnPolicy },
 				...mutualAuth !== void 0 && { MutualAuthentication: mutualAuth }
 			}));
-			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]));
+			const submittedAttrs = this.diffAttributes(this.normalizeAttributes(properties["ListenerAttributes"]), this.normalizeAttributes(previousProperties["ListenerAttributes"]), this.attributeRemovalResolver(LISTENER_ATTRIBUTE_DEFAULTS));
 			if (submittedAttrs.length > 0) {
 				await withRetry(() => this.getClient().send(new ModifyListenerAttributesCommand({
 					ListenerArn: physicalId,
@@ -28522,14 +28597,28 @@ var ELBv2Provider = class {
 	/**
 	* Key-diff two normalized `{Key, Value}` attribute lists into the payload
 	* for a Modify*Attributes call: changed values from `newAttrs` win, and
-	* keys present only in `oldAttrs` are pushed back through `removalValue` —
-	* by default the empty string, which ModifyLoadBalancerAttributes /
-	* ModifyListenerAttributes accept as "clear the override". A resolver
-	* returning `undefined` SKIPS the entry (the resolver owns any warn).
-	* An empty return means nothing changed and the call should be skipped.
-	* Shared by the LoadBalancer / TargetGroup / Listener update paths.
-	*/
-	diffAttributes(newAttrs, oldAttrs, removalValue = () => "") {
+	* keys present only in `oldAttrs` are pushed back through `removalValue`.
+	* A resolver returning `undefined` SKIPS the entry (the resolver owns any
+	* warn). An empty return means nothing changed and the call should be
+	* skipped. Shared by the LoadBalancer / TargetGroup / Listener update
+	* paths — and all three pass their OWN resolver, because the three APIs
+	* disagree about what resets an attribute:
+	*
+	* - LoadBalancer / Listener: the empty string clears a numeric or
+	*   free-form-string override, but a BOOLEAN / ENUM key rejects it and
+	*   fails the whole call, so those take a documented default
+	*   (`LOAD_BALANCER_ATTRIBUTE_DEFAULTS` / `LISTENER_ATTRIBUTE_DEFAULTS`).
+	* - TargetGroup: the empty string is rejected for EVERY key, so the
+	*   documented default is the only reset and an unknown key warns and
+	*   retains (`TARGET_GROUP_ATTRIBUTE_DEFAULTS`).
+	*
+	* All three behaviours were live-verified 2026-08-11. `removalValue` is
+	* REQUIRED rather than defaulted: there is no reset value that is correct
+	* for all three APIs, so a caller that forgets to pass one should fail to
+	* compile instead of silently inheriting the empty string that two of the
+	* three reject.
+	*/
+	diffAttributes(newAttrs, oldAttrs, removalValue) {
 		const newAttrMap = new Map(newAttrs.map((a) => [a.Key, a.Value]));
 		const oldAttrMap = new Map(oldAttrs.map((a) => [a.Key, a.Value]));
 		const submitted = [];
@@ -28537,8 +28626,8 @@ var ELBv2Provider = class {
 			Key: k,
 			Value: v
 		});
-		for (const [k] of oldAttrMap) if (!newAttrMap.has(k)) {
-			const value = removalValue(k);
+		for (const [k, currentValue] of oldAttrMap) if (!newAttrMap.has(k)) {
+			const value = removalValue(k, currentValue);
 			if (value !== void 0) submitted.push({
 				Key: k,
 				Value: value
@@ -28547,6 +28636,40 @@ var ELBv2Provider = class {
 		return submitted;
 	}
 	/**
+	* Build the `removalValue` resolver for the LoadBalancer / Listener attribute
+	* arms: reset a removed key to its documented default, or to `''` (which
+	* those two APIs accept as "clear the override") when no default is known.
+	*
+	* **A key already AT its default is SKIPPED, and that is a safety property,
+	* not an optimization.** The previous side is not always a template: `cdkd
+	* drift --revert` calls `update(..., newProperties, outcome.awsProperties)`
+	* (`src/cli/commands/drift.ts`), so `oldAttrs` can be the FULL
+	* `readCurrentState` snapshot — every attribute AWS reports, including the
+	* ~18 the user never templated. Against a state record with no
+	* `observedProperties` the desired side is the template's one or two keys,
+	* so every untemplated key looks REMOVED and would be "reset".
+	*
+	* Writing a documented default there would silently disable deletion
+	* protection, access / connection logs, HTTP/2, WAF fail-open and zonal
+	* shift on a live load balancer. Before the defaults table existed this was
+	* accidentally safe — `''` fails validation, so the whole revert aborted and
+	* changed nothing — so introducing the table without this guard would have
+	* converted a loud refusal into a silent destructive write.
+	*
+	* The skip is exact rather than heuristic: a key the user never templated is
+	* BY DEFINITION sitting at its default, so it is skipped; a key the template
+	* really did set is set to a NON-default value (otherwise templating it
+	* would be a no-op), so its reset still fires. A template that set a key to
+	* exactly its default and then dropped it is skipped too — correctly, since
+	* there is nothing to change.
+	*/
+	attributeRemovalResolver(defaults) {
+		return (key, currentValue) => {
+			const fallback = Object.hasOwn(defaults, key) ? defaults[key] : "";
+			return currentValue === fallback ? void 0 : fallback;
+		};
+	}
+	/**
 	* Normalize a CFn `Targets` value (an array of `{ Id, Port?,
 	* AvailabilityZone? }` objects) into the SDK's `TargetDescription[]` shape.
 	* Entries missing an `Id` are dropped (Id is the only required member);
@@ -69797,7 +69920,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.18");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.280.19");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;