@go-to-k/cdkd 0.284.59 → 0.284.61

package/dist/index.js

@@ -1,4 +1,4 @@
-import { An as Synthesizer, Dr as formatError, Er as SynthesisError, Jt as TemplateParser, Or as isCdkdError, Qn as AssemblyReader, Tr as StateError, Ut as DiffCalculator, W as IAMRoleProvider, Yt as LockManager, Zt as S3StateBackend, ar as setAwsClients, br as ProvisioningError, cr as ConfigError, er as clearBucketRegionCache, gr as LockError, ir as resetAwsClients, kr as normalizeAwsError, nr as AwsClients, or as AssetError, q as ProviderRegistry, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as getAwsClients, rt as CloudControlProvider, sr as CdkdError, tr as resolveBucketRegion, ur as DependencyError } from "./deploy-engine-B6cbj8-j.js";
+import { Ar as isCdkdError, Dr as StateError, Jt as TemplateParser, Mn as Synthesizer, Or as SynthesisError, Sr as ProvisioningError, Ut as DiffCalculator, W as IAMRoleProvider, Yt as LockManager, Zt as S3StateBackend, ar as getAwsClients, cr as AssetError, er as AssemblyReader, fr as DependencyError, ir as AwsClients, jr as normalizeAwsError, kr as formatError, lr as CdkdError, nr as clearBucketRegionCache, or as resetAwsClients, q as ProviderRegistry, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as resolveBucketRegion, rt as CloudControlProvider, sr as setAwsClients, ur as ConfigError, vr as LockError } from "./deploy-engine-0d-g0TT4.js";
 import { n as getLogger, r as setLogger, t as ConsoleLogger } from "./logger-zRrlbaQt.js";
 
 export { AssemblyReader, AssetError, AssetPublisher, AwsClients, CdkdError, CloudControlProvider, ConfigError, ConsoleLogger, DagBuilder, DependencyError, DeployEngine, DiffCalculator, IAMRoleProvider, LockError, LockManager, ProviderRegistry, ProvisioningError, S3StateBackend, StateError, SynthesisError, Synthesizer, TemplateParser, clearBucketRegionCache, formatError, getAwsClients, getLogger, isCdkdError, normalizeAwsError, resetAwsClients, resolveBucketRegion, setAwsClients, setLogger };

package/dist/{program-D2zqjYCT.js → program-CrJMVg4e.js}

@@ -1,7 +1,7 @@
-import { $ as endCommandInterruptScope, $n as processStackMessages, $t as exportNamesCarriedFrom, A as renderStatefulReason, An as Synthesizer, Ar as withErrorHandling, At as isSingleDynamicReferenceToken, B as exportAliasCollisionScrubWarning, Bn as resolveUseCdkBootstrapAssets, Bt as s3BucketRegionalDomainName, C as isFinalSnapshotError, Cn as formatDockerLoginError, Cr as StackHasActiveImportsError, Ct as requireConfigString, D as extractDeploymentEventError, Dn as runDockerStreaming, Dt as createSecretMasker, E as makeCanonicalizePropertiesFn, En as runDockerForeground, Et as TEMPLATE_SOURCED_RULES, F as green, Fn as resolveAutoAssetStorage, Ft as classifyReplaySecretRegion, G as collectInlinePolicyNamesManagedBySiblings, Gn as MIGRATE_TMP_PREFIX, Gt as describeTypeWithThrottleRetry, H as secretBearingStateKeyWarning, Hn as warnDeprecatedNoPrefixCliFlag, Ht as applyRoleArnIfSet, I as red, In as resolveCaptureObservedState, It as producerRegionsFromState, J as findActionableSilentDrops, Jn as expectedOwnerParam, Jt as TemplateParser, K as clearOnUpdateRemoval, Kn as findLargeInlineResources, Kt as withRetry, L as yellow, Ln as resolveSkipPrefix, Lt as s3BucketArn, M as bold, Mn as getDefaultStateBucketName, Mr as isRetryableTransientError, Mt as maskSecretsInText, N as cyan, Nn as getLegacyStateBucketName, Nr as isThrottlingError, Nt as redactSecretsForState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as AssetManifestLoader, Ot as dynamicReferenceTokens, P as gray, Pn as resolveApp, Pr as markNonRetryable, Pt as scrubResourceRecord, Q as beginCommandInterruptScope, Qn as AssemblyReader, Qt as rebuildClientForBucketRegion, R as collectDeclaredOutputNames, Rn as resolveStateBucketWithDefault, Rt as s3BucketDomainName, S as createPreDeleteFinalSnapshot, Sn as dockerSpawnEnvWithSensitive, Sr as ResourceUpdateNotSupportedError, St as requireConfigObject, T as unsupportedFinalSnapshotError, Tn as partitionSensitiveEnv, Tt as STATE_SOURCED_READBACK_RULES, U as stateKeySecretExposure, Un as CFN_TEMPLATE_BODY_LIMIT, Ut as DiffCalculator, V as isExportAliasCollision, Vn as stateBucketExistenceConfirmed, Vt as s3BucketWebsiteUrl, W as IAMRoleProvider, Wn as CFN_TEMPLATE_URL_LIMIT, Wt as INTRINSIC_KEYS, X as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as canonicalizeRegion, Xt as displaySafe, Y as findSilentDropProperties, Yn as PARTITION_TABLE, Yt as LockManager, Z as DEFAULT_STATE_PREFIX, Zn as derivePartitionAndUrlSuffix, Zt as S3StateBackend, _ as computeImplicitDeleteEdges, _n as readBootstrapMarkerBody, _r as MissingCdkCliError, _t as configBooleanRefusal, a as DeploymentEventsStore, an as WorkGraph, ar as setAwsClients, at as disableInstanceApiTermination, b as buildFinalSnapshotIdentifier, bn as buildDenyExternalAccessPolicy, br as ProvisioningError, bt as replayWarn, c as replayFailedOperations, cn as loadPublishableAssetManifest, ct as carriesDynamicReference, d as updatePartialReason, dn as stripControlChars, dr as DeployCancelledError, dt as refStateLookupFromResource, en as importableOutputKeys, et as interruptWatchListenerCount, f as UNSPECIFIED_SKIP_REASON, fn as AssetModeResolver, fr as DynamicReferenceRegionAmbiguousError, ft as WAFv2WebACLProvider, g as IMPLICIT_DELETE_DEPENDENCIES, gn as parseBootstrapMarker, gt as coerceCfnBoolean, h as maskingRetryLogger, hn as getBootstrapMarkerKey, hr as LocalStartServiceError, ht as assertRegionMatch, i as DeploymentEventsReader, in as stringifyValue, ir as resetAwsClients, it as slowCcOperationTimeoutMs, j as formatResourceLine, jn as synthesisStatusMessage, jr as isMarkedNonRetryable, jt as maskSecretsInError, k as isStatefulRecreateTargetSync, kn as getDockerImageBySourceHash, kr as normalizeAwsError, kt as errorCauseChain, l as replayRollback, ln as rewriteTemplateAssetReferences, lr as CrossAccountSecretRefusalError, lt as cfnRefValueFromPhysicalId, m as withResourceDeadline, mn as ensureAssetStorage, mr as LocalMigrateError, mt as resolveExplicitPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as shouldRetainResource, nr as AwsClients, nt as startInterruptWatch, o as planFailedOps, on as buildAssetRedirectMap, ot as isTerminationProtectionPropagationError, p as deleteSkipReason, pn as BOOTSTRAP_MARKER_PREFIX, pr as LocalInvokeBuildError$1, pt as normalizeAwsTagsToCfn, q as ProviderRegistry, qn as uploadCfnTemplate, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as getAwsClients, rt as CloudControlProvider, s as planRollback, sn as createAssetRedirectResolver, sr as CdkdError, st as IntrinsicFunctionResolver, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as importableOutputs, tr as resolveBucketRegion, tt as isInterruptedWaitError, u as updatePartialMessage, un as escapeRegExp, ut as getAccountInfo, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as validateAssetBucketName, vr as NestedStackChildDirectDestroyError, vt as configStringRefusal, w as refusesFinalSnapshot, wn as getDockerCmd, wr as StackTerminationProtectionError, wt as STATE_SOURCED_CROSS_GENERATION_RULES, x as ccRoutedFinalSnapshotError, xn as buildDockerImage, xr as ResourceTimeoutError, xt as requireConfigArray, y as PRE_DELETE_SNAPSHOT_TYPES, yn as validateContainerRepoName, yr as PartialFailureError, yt as readConfigString, z as collectPublishedOutputNames, zn as resolveStateBucketWithDefaultAndSource, zt as s3BucketDualStackDomainName } from "./deploy-engine-B6cbj8-j.js";
+import { $ as endCommandInterruptScope, $n as derivePartitionAndUrlSuffix, $t as exportNamesCarriedFrom, A as renderStatefulReason, An as AssetManifestLoader, At as isSingleDynamicReferenceToken, B as exportAliasCollisionScrubWarning, Bn as resolveStateBucketWithDefault, Bt as s3BucketRegionalDomainName, C as isFinalSnapshotError, Cn as buildDockerImage, Cr as ResourceTimeoutError, Ct as requireConfigString, D as extractDeploymentEventError, Dn as partitionSensitiveEnv, Dt as createSecretMasker, E as makeCanonicalizePropertiesFn, En as getDockerCmd, Er as StackTerminationProtectionError, Et as TEMPLATE_SOURCED_RULES, F as green, Fn as getLegacyStateBucketName, Fr as isThrottlingError, Ft as classifyReplaySecretRegion, G as collectInlinePolicyNamesManagedBySiblings, Gn as CFN_TEMPLATE_BODY_LIMIT, Gt as describeTypeWithThrottleRetry, H as secretBearingStateKeyWarning, Hn as resolveUseCdkBootstrapAssets, Ht as applyRoleArnIfSet, I as red, In as resolveApp, Ir as markNonRetryable, It as producerRegionsFromState, J as findActionableSilentDrops, Jn as findLargeInlineResources, Jt as TemplateParser, K as clearOnUpdateRemoval, Kn as CFN_TEMPLATE_URL_LIMIT, Kt as withRetry, L as yellow, Ln as resolveAutoAssetStorage, Lt as s3BucketArn, M as bold, Mn as Synthesizer, Mr as withErrorHandling, Mt as maskSecretsInText, N as cyan, Nn as synthesisStatusMessage, Nr as isMarkedNonRetryable, Nt as redactSecretsForState, O as MULTI_REGION_RECREATE_BLOCKED_TYPES, On as runDockerForeground, Ot as dynamicReferenceTokens, P as gray, Pn as getDefaultStateBucketName, Pr as isRetryableTransientError, Pt as scrubResourceRecord, Q as beginCommandInterruptScope, Qn as canonicalizeRegion, Qt as rebuildClientForBucketRegion, R as collectDeclaredOutputNames, Rn as resolveCaptureObservedState, Rt as s3BucketDomainName, S as createPreDeleteFinalSnapshot, Sn as buildDenyExternalAccessPolicy, Sr as ProvisioningError, St as requireConfigObject, T as unsupportedFinalSnapshotError, Tn as formatDockerLoginError, Tr as StackHasActiveImportsError, Tt as STATE_SOURCED_READBACK_RULES, U as stateKeySecretExposure, Un as stateBucketExistenceConfirmed, Ut as DiffCalculator, V as isExportAliasCollision, Vn as resolveStateBucketWithDefaultAndSource, Vt as s3BucketWebsiteUrl, W as IAMRoleProvider, Wn as warnDeprecatedNoPrefixCliFlag, Wt as INTRINSIC_KEYS, X as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as expectedOwnerParam, Xt as displaySafe, Y as findSilentDropProperties, Yn as uploadCfnTemplate, Yt as LockManager, Z as DEFAULT_STATE_PREFIX, Zn as PARTITION_TABLE, Zt as S3StateBackend, _ as computeImplicitDeleteEdges, _n as isCrossRegionRedirect, _r as LocalStartServiceError, _t as configBooleanRefusal, a as DeploymentEventsStore, an as WorkGraph, ar as getAwsClients, at as disableInstanceApiTermination, b as buildFinalSnapshotIdentifier, bn as validateAssetBucketName, br as NestedStackChildDirectDestroyError, bt as replayWarn, c as replayFailedOperations, cn as loadPublishableAssetManifest, ct as carriesDynamicReference, d as updatePartialReason, dn as stripControlChars, dr as CrossAccountSecretRefusalError, dt as refStateLookupFromResource, en as importableOutputKeys, er as AssemblyReader, et as interruptWatchListenerCount, f as UNSPECIFIED_SKIP_REASON, fn as AssetModeResolver, ft as WAFv2WebACLProvider, g as IMPLICIT_DELETE_DEPENDENCIES, gn as getBootstrapMarkerKey, gr as LocalMigrateError, gt as coerceCfnBoolean, h as maskingRetryLogger, hn as ensureAssetStorage, hr as LocalInvokeBuildError$1, ht as assertRegionMatch, i as DeploymentEventsReader, in as stringifyValue, ir as AwsClients, it as slowCcOperationTimeoutMs, j as formatResourceLine, jn as getDockerImageBySourceHash, jr as normalizeAwsError, jt as maskSecretsInError, k as isStatefulRecreateTargetSync, kn as runDockerStreaming, kt as errorCauseChain, l as replayRollback, ln as rewriteTemplateAssetReferences, lr as CdkdError, lt as cfnRefValueFromPhysicalId, m as withResourceDeadline, mn as assertAssetBucketRegion, mr as DynamicReferenceRegionAmbiguousError, mt as resolveExplicitPhysicalId, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as shouldRetainResource, nt as startInterruptWatch, o as planFailedOps, on as buildAssetRedirectMap, or as resetAwsClients, ot as isTerminationProtectionPropagationError, p as deleteSkipReason, pn as BOOTSTRAP_MARKER_PREFIX, pr as DeployCancelledError, pt as normalizeAwsTagsToCfn, q as ProviderRegistry, qn as MIGRATE_TMP_PREFIX, qt as DagBuilder, r as DeployEngine, rn as AssetPublisher, rr as resolveBucketRegion, rt as CloudControlProvider, s as planRollback, sn as createAssetRedirectResolver, sr as setAwsClients, st as IntrinsicFunctionResolver, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as importableOutputs, tr as processStackMessages, tt as isInterruptedWaitError, u as updatePartialMessage, un as escapeRegExp, ut as getAccountInfo, v as ATOMIC_FINAL_SNAPSHOT_TYPES, vn as parseBootstrapMarker, vt as configStringRefusal, w as refusesFinalSnapshot, wn as dockerSpawnEnvWithSensitive, wr as ResourceUpdateNotSupportedError, wt as STATE_SOURCED_CROSS_GENERATION_RULES, x as ccRoutedFinalSnapshotError, xn as validateContainerRepoName, xr as PartialFailureError, xt as requireConfigArray, y as PRE_DELETE_SNAPSHOT_TYPES, yn as readBootstrapMarkerBody, yr as MissingCdkCliError, yt as readConfigString, z as collectPublishedOutputNames, zn as resolveSkipPrefix, zt as s3BucketDualStackDomainName } from "./deploy-engine-0d-g0TT4.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as getCurrentStackName, h as withStackName, i as runStackBuffered, m as withSkipPrefix, n as getLogger, o as PATTERN_B_NAME_OPTIONS, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-zRrlbaQt.js";
-import { t as getCdkdVersion } from "./version-Biow6J38.js";
-import { t as ASGProvider } from "./asg-provider-BkbyCmqe.js";
+import { t as getCdkdVersion } from "./version-iXYxz3AH.js";
+import { t as ASGProvider } from "./asg-provider-DTolzTHQ.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -1229,7 +1229,7 @@ async function scanStateReferences(stateBackend, names) {
 * (skip, info line) when the bucket does not exist — the idempotency
 * mirror of `ensureAssetStorage`.
 */
-async function emptyAndDeleteBucket(s3Client, bucket, accountId, label, logger) {
+async function emptyAndDeleteBucket(s3Client, bucket, accountId, label, logger, expectedRegion) {
 	try {
 		await s3Client.send(new HeadBucketCommand({
 			Bucket: bucket,
@@ -1242,6 +1242,7 @@ async function emptyAndDeleteBucket(s3Client, bucket, accountId, label, logger)
 			return false;
 		}
 		if (err.$metadata?.httpStatusCode === 403) throw new CdkdError(`${label} '${bucket}' exists but is not owned by account ${accountId} (or access is denied). Refusing to delete it.`, "ASSET_STORAGE_FOREIGN_BUCKET", error);
+		if (expectedRegion !== void 0 && isCrossRegionRedirect(error)) await assertAssetBucketRegion(s3Client, bucket, expectedRegion, accountId, error);
 		throw normalizeAwsError(error, {
 			bucket,
 			operation: "HeadBucket"
@@ -1499,7 +1500,7 @@ async function bootstrapDestroyCommand(options) {
 			return;
 		}
 		if (marker) {
-			await emptyAndDeleteBucket(awsClients.s3, marker.assetBucket, accountId, "Asset bucket", logger);
+			await emptyAndDeleteBucket(awsClients.s3, marker.assetBucket, accountId, "Asset bucket", logger, region);
 			await deleteContainerRepo(marker.containerRepo, region, options.profile, logger);
 			await stateBackend.deleteRawObjects([resolvedMarkerKey]);
 			logger.info(`✓ Deleted bootstrap marker (${resolvedMarkerKey})`);
@@ -1510,7 +1511,7 @@ async function bootstrapDestroyCommand(options) {
 		if (options.includeStateBucket) {
 			const rebuiltStateBucketClient = await rebuildClientForBucketRegion(awsClients.s3, bucketName, { ...options.profile && { profile: options.profile } });
 			try {
-				await emptyAndDeleteBucket(rebuiltStateBucketClient ?? awsClients.s3, bucketName, accountId, "State bucket", logger);
+				await emptyAndDeleteBucket(rebuiltStateBucketClient ?? awsClients.s3, bucketName, accountId, "State bucket", logger, void 0);
 			} finally {
 				rebuiltStateBucketClient?.destroy();
 			}
@@ -34029,6 +34030,86 @@ const DEPLOYMENT_CONFIG_PRESERVE_KEYS_CAMEL = /* @__PURE__ */ new Set(["hookDeta
 */
 const SERVICE_CONNECT_PRESERVE_KEYS = /* @__PURE__ */ new Set(["Options"]);
 /**
+* SHARED RATIONALE for both `CIRCUIT_BREAKER_*_DEFAULT` constants below —
+* WHERE THE VALUES COME FROM, and when they may be sent (issue #1861).
+*
+* They are the values CloudFormation was MEASURED to produce when a template
+* that previously DECLARED the member stops declaring it (us-east-1,
+* 2026-08-13, same service, `Rollback` flipped in the same call so the update
+* demonstrably applied and service identity captured on both sides so a
+* replacement could not be mistaken for a reset): `resetOnHealthyTask` false
+* -> `true`, `thresholdConfiguration` {COUNT, 7} -> {BOUNDED_PERCENT, 50}.
+* They match the SDK's documented defaults for both members, and the SDK
+* documents those unconditionally — they do not vary by scheduling strategy or
+* deployment type (see the strategy note in `updateService`'s comment block).
+*
+* They are used ONLY as `clearOnUpdateRemoval`'s clear value, i.e. only on a
+* previous-present / current-absent REMOVAL. They must NEVER be sent for a
+* member the template never declared — a third measurement in the same
+* session set both members OUT OF BAND on a service whose template never
+* declared them, then ran a CloudFormation update that flipped `Rollback`
+* INSIDE the block: the out-of-band `false` / {COUNT, 9} BOTH survived. That
+* arm is what excludes the competing reading "CFn re-serializes the struct
+* whenever its declared content changed" and makes this a genuine removal.
+*/
+/**
+* `DeploymentCircuitBreaker.ResetOnHealthyTask`'s AWS default. A primitive, so
+* it needs no copy-on-use treatment — unlike its object-valued sibling below.
+* Provenance and the send-only-on-removal rule: see the shared note above.
+*/
+const CIRCUIT_BREAKER_RESET_ON_HEALTHY_TASK_DEFAULT = true;
+/**
+* `DeploymentCircuitBreaker.ThresholdConfiguration`'s AWS default. Provenance
+* and the send-only-on-removal rule: see the shared note above.
+*
+* FROZEN, and spread into a fresh object at the use site rather than handed
+* over by reference. `ECSProvider` is a singleton serving concurrent
+* resources, so a module-level object reaching the SDK input directly would be
+* one shared mutable value across every in-flight `UpdateService` — a
+* middleware or a future normalization step mutating it would corrupt every
+* other caller. The two halves guard different failures and BOTH are pinned by
+* unit arms: the copy means no caller can ever reach this object, and the
+* freeze means a caller that somehow does fails LOUDLY instead of silently
+* poisoning every later update.
+*
+* @internal EXPORTED for tests only (issue #1861). Every production consumer
+* is in this file. The export exists because the freeze is otherwise
+* UNOBSERVABLE from a test: the resolver hands out a copy by design, so the
+* payload a test can reach is never this object, and dropping `Object.freeze`
+* left the whole suite green. Asserting it through a source grep was the
+* alternative and is the weaker fence this repo has retired elsewhere.
+*/
+const CIRCUIT_BREAKER_THRESHOLD_CONFIGURATION_DEFAULT = Object.freeze({
+	type: "BOUNDED_PERCENT",
+	value: 50
+});
+/**
+* A plain object — something a CFn config block can legitimately be. Arrays
+* and non-objects are excluded on purpose: `typeof [] === 'object'` and every
+* non-empty string is truthy, so a truthiness check would wave a malformed
+* template through into a spread.
+*
+* Deliberately a module-local copy rather than an export added to
+* `src/provisioning/config-shape.ts`, whose private `isPlainObject` is
+* byte-identical: this lane may not widen a shared module's API.
+*
+* No "promote it if a third copy appears" trigger, because that already fired
+* long before this PR and adding it here would read as a new one. Grepped for
+* a standalone helper whose body is exactly this predicate: NINE across nine
+* files under six different names — `config-shape.ts`, `wafv2-provider.ts`,
+* `s3-bucket-provider.ts` (`isPlainObject`), `emr-configuration.ts`,
+* `lambda-microvm-image-provider.ts` (`isRecord`),
+* `apigateway-provider.ts` (`isPlainObjectBlock`), `drift.ts`
+* (`isPlainRecord`), `lambda-vpc-deps.ts` (`isObject`), and this one — plus
+* further INLINE copies (`route53-provider.ts` x2,
+* `custom-resource-provider.ts`, `diff-recursive.ts`,
+* `intrinsic-function-resolver.ts`). Consolidating them touches files across
+* several lanes and is a separate lane's job, not this PR's.
+*/
+function isPlainCfnObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
 * Derive the cluster name from a long-format ECS Service ARN
 * (`arn:<partition>:ecs:<region>:<account>:service/<clusterName>/<serviceName>`)
 * so `DescribeServices` can be scoped to the right cluster (issue #1170).
@@ -34466,6 +34547,7 @@ var ECSProvider = class {
 		const vpcLatticeConfigurationsInput = JSON.stringify(previousProperties["VpcLatticeConfigurations"] ?? null) !== JSON.stringify(properties["VpcLatticeConfigurations"] ?? null) ? clearOnUpdateRemoval(this.convertVpcLatticeConfigurations(properties["VpcLatticeConfigurations"]), previousProperties["VpcLatticeConfigurations"], []) : void 0;
 		const monitoringInput = JSON.stringify(previousProperties["Monitoring"] ?? null) !== JSON.stringify(properties["Monitoring"] ?? null) && properties["Monitoring"] != null ? this.convertMonitoringConfiguration(properties["Monitoring"]) : void 0;
 		const forceNewDeploymentInput = this.resolveForceNewDeployment(properties, previousProperties);
+		const deploymentConfigurationInput = this.resolveDeploymentConfiguration(properties, previousProperties);
 		try {
 			const service = (await client.send(new UpdateServiceCommand({
 				cluster: properties["Cluster"],
@@ -34474,7 +34556,7 @@ var ECSProvider = class {
 				desiredCount: properties["DesiredCount"],
 				networkConfiguration: this.convertNetworkConfiguration(properties["NetworkConfiguration"]),
 				capacityProviderStrategy: capacityProviderStrategyInput,
-				deploymentConfiguration: this.convertDeploymentConfiguration(properties["DeploymentConfiguration"]),
+				deploymentConfiguration: deploymentConfigurationInput,
 				placementConstraints: placementConstraintsInput,
 				placementStrategy: placementStrategyInput,
 				platformVersion: platformVersionInput,
@@ -35186,6 +35268,93 @@ var ECSProvider = class {
 		return pascalToCamelCaseKeys(config, DEPLOYMENT_CONFIG_PRESERVE_KEYS);
 	}
 	/**
+	* UPDATE-path `DeploymentConfiguration` resolver: the verbatim conversion
+	* above, plus the ONE member-level removal reset real AWS measurement found
+	* in this property tree (issue #1861).
+	*
+	* The rule this keys on is previous-present / current-absent — exactly the
+	* semantic `clearOnUpdateRemoval` implements for TOP-LEVEL properties, which
+	* is why this reuses that helper rather than re-spelling the predicate. What
+	* is new is only the DEPTH: the member lives inside a nested struct the
+	* template STILL DECLARES.
+	*
+	* Scope is deliberately narrow, and each boundary is measured rather than
+	* reasoned about (us-east-1, 2026-08-13; the full A/B table is in the long
+	* comment inside `updateService`):
+	*   - Only `DeploymentCircuitBreaker`'s two OPTIONAL members
+	*     (`ResetOnHealthyTask`, `ThresholdConfiguration`). Its REQUIRED sibling
+	*     `Rollback` reads as REPLACED, so one block holds members with
+	*     different semantics and no row generalizes to its neighbours.
+	*   - NOT the depth-1 siblings `LinearConfiguration` / `CanaryConfiguration`
+	*     / `LifecycleHooks[].TimeoutConfiguration`: those are already PARITY
+	*     because the ECS API ITSELF replaces the struct and default-fills the
+	*     omitted member, so adding a reset there would be the divergence.
+	*   - NOT the whole-struct cases. Removing the whole `DeploymentConfiguration`
+	*     resets nothing under either engine, and the parent
+	*     `DeploymentCircuitBreaker` disappearing entirely was never measured —
+	*     so BOTH sides must still declare the block for a member omission to
+	*     read as a removal.
+	*   - NOT "always send the defaults": a member the template NEVER declared
+	*     is left alone by CloudFormation even when the block around it changes,
+	*     and `clearOnUpdateRemoval` returning `undefined` for that case is what
+	*     keeps cdkd from clobbering an out-of-band value CFn preserves.
+	*   - NOT scoped by scheduling strategy, and that is a deliberate omission
+	*     rather than an unconsidered one. The A/B ran on a ROLLING / REPLICA /
+	*     Fargate service and DAEMON was never exercised, so the question is
+	*     fair — and DAEMON is genuinely REACHABLE here, because the SDK states
+	*     that CODE_DEPLOY / EXTERNAL controllers do not support DAEMON, so a
+	*     DAEMON service necessarily runs the ECS rolling-update type and can
+	*     carry a circuit breaker. What makes the omission safe is narrower and
+	*     PER-FIELD: the SDK documents these TWO members' defaults with no
+	*     strategy dimension. It is not a general property of this block —
+	*     `minimumHealthyPercent`'s default IS strategy-dependent (100% replica
+	*     vs 0% DAEMON), and stays correct only because cdkd passes it through
+	*     rather than defaulting it.
+	*
+	* The previous side stays RAW CFn PascalCase on purpose: `clearOnUpdateRemoval`
+	* only inspects it for PRESENCE, the same shortcut the top-level call sites
+	* in `updateService` take.
+	*
+	* SCOPE OF THAT PRESENCE TEST — state it as what it literally is, because
+	* the obvious reading is stronger than the truth. It means "the previous
+	* BAG carried this member", NOT "the previous TEMPLATE declared it". Those
+	* coincide on the deploy path, where `previousProperties` is the last
+	* deployed template. They do NOT at `drift --revert`
+	* (`src/cli/commands/drift.ts`, the `provider.update(...)` call that passes
+	* `outcome.awsProperties`), where the previous bag is an AWS READBACK: a
+	* member the template never declared but AWS reports is present there, so a
+	* desired side that omits it reads as a removal and gets the default sent.
+	* The window is narrow — the revert path's own desired bag is built from
+	* `observedProperties`, which normally carries the member too, and its
+	* `preserveUntemplated` arm recurses via `mergeUntemplatedValue` and keeps
+	* AWS-only members — but it is real when an `observedProperties` snapshot
+	* predates AWS reporting the member. This is NOT specific to this resolver:
+	* every `clearOnUpdateRemoval` site in the codebase — 78 across 14 provider
+	* files before this PR, 80 with this resolver's two — carries the same
+	* exposure, so fixing it belongs to that shared contract, not here. It is
+	* written down and unit-pinned so the next member copied onto this pattern
+	* does not inherit the premise unchecked.
+	*/
+	resolveDeploymentConfiguration(properties, previousProperties) {
+		const desired = this.convertDeploymentConfiguration(properties["DeploymentConfiguration"]);
+		const desiredBreaker = desired?.deploymentCircuitBreaker;
+		if (!desired || !isPlainCfnObject(desiredBreaker)) return desired;
+		const previousDeploymentConfiguration = previousProperties["DeploymentConfiguration"];
+		const previousBreaker = isPlainCfnObject(previousDeploymentConfiguration) ? previousDeploymentConfiguration["DeploymentCircuitBreaker"] : void 0;
+		if (!isPlainCfnObject(previousBreaker)) return desired;
+		const resetOnHealthyTask = clearOnUpdateRemoval(desiredBreaker.resetOnHealthyTask, previousBreaker["ResetOnHealthyTask"], CIRCUIT_BREAKER_RESET_ON_HEALTHY_TASK_DEFAULT);
+		const thresholdConfiguration = clearOnUpdateRemoval(desiredBreaker.thresholdConfiguration, previousBreaker["ThresholdConfiguration"], { ...CIRCUIT_BREAKER_THRESHOLD_CONFIGURATION_DEFAULT });
+		if (resetOnHealthyTask === desiredBreaker.resetOnHealthyTask && thresholdConfiguration === desiredBreaker.thresholdConfiguration) return desired;
+		return {
+			...desired,
+			deploymentCircuitBreaker: {
+				...desiredBreaker,
+				...resetOnHealthyTask !== void 0 ? { resetOnHealthyTask } : {},
+				...thresholdConfiguration !== void 0 ? { thresholdConfiguration } : {}
+			}
+		};
+	}
+	/**
 	* Convert the CFn PascalCase `CapacityProviderStrategy` array to the ECS SDK
 	* camelCase input shape (issue #1165). Each element `{CapacityProvider,
 	* Weight, Base}` is a pure first-letter case flip to `{capacityProvider,
@@ -87704,4 +87873,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-D2zqjYCT.js.map
+//# sourceMappingURL=program-CrJMVg4e.js.map