puls-dev 0.1.9 → 0.2.1

package/dist/providers/aws/s3.js

@@ -1,6 +1,6 @@
-import { readFileSync } from "node:fs";
+import fs from "node:fs";
 import { basename, extname } from "node:path";
-import { HeadBucketCommand, CreateBucketCommand, GetBucketPolicyCommand, PutBucketPolicyCommand, PutObjectCommand, } from "@aws-sdk/client-s3";
+import { HeadBucketCommand, CreateBucketCommand, GetBucketPolicyCommand, PutBucketPolicyCommand, PutObjectCommand, PutBucketWebsiteCommand, PutPublicAccessBlockCommand, } from "@aws-sdk/client-s3";
 import { BaseBuilder } from "../../core/resource.js";
 import { getS3Client } from "./api.js";
 import { Config } from "../../core/config.js";
@@ -10,6 +10,7 @@ export class S3BucketBuilder extends BaseBuilder {
     _allowedDistributions = [];
     _region;
     _uploadPath;
+    _websiteConfig;
     constructor(bucketName) {
         super(bucketName);
         this.bucketName = bucketName;
@@ -48,6 +49,10 @@ export class S3BucketBuilder extends BaseBuilder {
         this._uploadPath = filePath;
         return this;
     }
+    staticSite(indexDocument = "index.html", errorDocument = "error.html") {
+        this._websiteConfig = { index: indexDocument, error: errorDocument };
+        return this;
+    }
     async deploy() {
         const dryRun = this.isDryRunActive();
         const exists = await this.discoveryPromise;
@@ -87,6 +92,34 @@ export class S3BucketBuilder extends BaseBuilder {
                 await this.updateBucketPolicy(s3, newArns);
             }
         }
+        if (this._websiteConfig) {
+            if (dryRun) {
+                console.log(`   📝 [PLAN] Enable static site hosting: index=${this._websiteConfig.index}, error=${this._websiteConfig.error}`);
+                console.log(`   📝 [PLAN] Remove public access block from bucket`);
+                console.log(`   📝 [PLAN] Configure public read bucket policy`);
+            }
+            else {
+                await s3.send(new PutPublicAccessBlockCommand({
+                    Bucket: this.bucketName,
+                    PublicAccessBlockConfiguration: {
+                        BlockPublicAcls: false,
+                        IgnorePublicAcls: false,
+                        BlockPublicPolicy: false,
+                        RestrictPublicBuckets: false,
+                    },
+                }));
+                console.log(`   ✅ Public access block removed`);
+                await s3.send(new PutBucketWebsiteCommand({
+                    Bucket: this.bucketName,
+                    WebsiteConfiguration: {
+                        IndexDocument: { Suffix: this._websiteConfig.index },
+                        ErrorDocument: { Key: this._websiteConfig.error },
+                    },
+                }));
+                console.log(`   ✅ Configured static website hosting`);
+                await this.applyPublicReadPolicy(s3);
+            }
+        }
         if (this._uploadPath) {
             if (dryRun) {
                 console.log(`   📝 [PLAN] Upload ${basename(this._uploadPath)} → s3://${this.bucketName}/`);
@@ -100,7 +133,7 @@ export class S3BucketBuilder extends BaseBuilder {
     }
     async uploadFile(s3, filePath) {
         const key = basename(filePath);
-        const body = readFileSync(filePath);
+        const body = fs.readFileSync(filePath);
         const contentTypeMap = {
             ".json": "application/json",
             ".js": "application/javascript",
@@ -169,4 +202,33 @@ export class S3BucketBuilder extends BaseBuilder {
         for (const arn of newArns)
             console.log(`      └─ ${arn}`);
     }
+    async applyPublicReadPolicy(s3) {
+        let policy = { Version: "2012-10-17", Statement: [] };
+        try {
+            const existing = await s3.send(new GetBucketPolicyCommand({ Bucket: this.bucketName }));
+            if (existing.Policy)
+                policy = JSON.parse(existing.Policy);
+        }
+        catch (e) {
+            if (e.name !== "NoSuchBucketPolicy")
+                throw e;
+        }
+        let stmt = policy.Statement.find((s) => s.Sid === "PublicReadGetObject" ||
+            (s.Effect === "Allow" && s.Principal === "*" && s.Action === "s3:GetObject"));
+        if (!stmt) {
+            stmt = {
+                Sid: "PublicReadGetObject",
+                Effect: "Allow",
+                Principal: "*",
+                Action: "s3:GetObject",
+                Resource: `arn:aws:s3:::${this.bucketName}/*`,
+            };
+            policy.Statement.push(stmt);
+        }
+        await s3.send(new PutBucketPolicyCommand({
+            Bucket: this.bucketName,
+            Policy: JSON.stringify(policy),
+        }));
+        console.log(`   ✅ Public read policy statement applied`);
+    }
 }

package/dist/providers/aws/s3.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/providers/aws/s3.test.js

@@ -0,0 +1,172 @@
+import { test, describe, beforeEach, afterEach, mock } from 'node:test';
+import assert from 'node:assert';
+import fs from 'node:fs';
+import { S3Client } from '@aws-sdk/client-s3';
+import { S3BucketBuilder } from './s3.js';
+import { Config } from '../../core/config.js';
+describe('S3BucketBuilder Unit Tests', () => {
+    let originalSend;
+    let s3Calls = [];
+    let mockS3Responses = {};
+    beforeEach(() => {
+        Config.set({
+            dryRun: false,
+            providers: {
+                aws: { region: 'us-east-1' }
+            }
+        });
+        s3Calls = [];
+        mockS3Responses = {};
+        originalSend = S3Client.prototype.send;
+        // Zero-dependency override on prototype to intercept S3 commands
+        S3Client.prototype.send = async function (command) {
+            const commandName = command.constructor.name;
+            const input = command.input;
+            s3Calls.push({ commandName, input });
+            if (mockS3Responses[commandName]) {
+                const handler = mockS3Responses[commandName];
+                if (typeof handler === 'function') {
+                    return handler(input);
+                }
+                if (handler instanceof Error) {
+                    throw handler;
+                }
+                return handler;
+            }
+            return {};
+        };
+        mock.method(fs, 'readFileSync', () => {
+            return Buffer.from('hello from s3 site');
+        });
+    });
+    afterEach(() => {
+        S3Client.prototype.send = originalSend;
+        mock.restoreAll();
+    });
+    test('gracefully handles discovery when bucket does not exist', async () => {
+        const notFoundError = new Error('NoSuchBucket');
+        notFoundError.name = 'NotFound';
+        notFoundError.$metadata = { httpStatusCode: 404 };
+        mockS3Responses['HeadBucketCommand'] = notFoundError;
+        const builder = new S3BucketBuilder('my-bucket');
+        const discoveryResult = await builder.discoveryPromise;
+        assert.strictEqual(discoveryResult, false);
+        assert.strictEqual(s3Calls.length, 1);
+        assert.strictEqual(s3Calls[0].commandName, 'HeadBucketCommand');
+        assert.strictEqual(s3Calls[0].input.Bucket, 'my-bucket');
+    });
+    test('discovers bucket successfully when it exists', async () => {
+        mockS3Responses['HeadBucketCommand'] = {};
+        const builder = new S3BucketBuilder('my-bucket');
+        const discoveryResult = await builder.discoveryPromise;
+        assert.strictEqual(discoveryResult, true);
+        assert.strictEqual(s3Calls.length, 1);
+        assert.strictEqual(s3Calls[0].commandName, 'HeadBucketCommand');
+    });
+    test('performs clean dry-run planning without making write requests', async () => {
+        Config.set({
+            dryRun: true,
+            providers: { aws: { region: 'us-east-1' } }
+        });
+        const notFoundError = new Error('NoSuchBucket');
+        notFoundError.name = 'NotFound';
+        notFoundError.$metadata = { httpStatusCode: 404 };
+        mockS3Responses['HeadBucketCommand'] = notFoundError;
+        const builder = new S3BucketBuilder('my-bucket');
+        builder.versioning().upload('/path/to/index.html');
+        const result = await builder.deploy();
+        assert.ok(result);
+        assert.strictEqual(result.name, 'my-bucket');
+        // Asserts HeadBucket was called for discovery, but no CreateBucket or PutObject
+        assert.strictEqual(s3Calls.filter(c => c.commandName !== 'HeadBucketCommand').length, 0);
+    });
+    test('deploys new bucket when missing', async () => {
+        const notFoundError = new Error('NoSuchBucket');
+        notFoundError.name = 'NotFound';
+        notFoundError.$metadata = { httpStatusCode: 404 };
+        mockS3Responses['HeadBucketCommand'] = notFoundError;
+        mockS3Responses['CreateBucketCommand'] = {};
+        const builder = new S3BucketBuilder('my-bucket');
+        const result = await builder.deploy();
+        assert.ok(result);
+        assert.strictEqual(result.name, 'my-bucket');
+        const createCall = s3Calls.find(c => c.commandName === 'CreateBucketCommand');
+        assert.ok(createCall);
+        assert.strictEqual(createCall.input.Bucket, 'my-bucket');
+    });
+    test('deploys static site with public access unblocking, website configuration, and public read policy', async () => {
+        const notFoundError = new Error('NoSuchBucket');
+        notFoundError.name = 'NotFound';
+        notFoundError.$metadata = { httpStatusCode: 404 };
+        mockS3Responses['HeadBucketCommand'] = notFoundError;
+        mockS3Responses['CreateBucketCommand'] = {};
+        mockS3Responses['PutPublicAccessBlockCommand'] = {};
+        mockS3Responses['PutBucketWebsiteCommand'] = {};
+        mockS3Responses['GetBucketPolicyCommand'] = new Error('NoSuchBucketPolicy');
+        mockS3Responses['GetBucketPolicyCommand'].name = 'NoSuchBucketPolicy';
+        mockS3Responses['PutBucketPolicyCommand'] = {};
+        const builder = new S3BucketBuilder('my-web-bucket');
+        builder.staticSite('index.html', 'error.html');
+        const result = await builder.deploy();
+        assert.ok(result);
+        // Verify Public Access Block removal
+        const blockCall = s3Calls.find(c => c.commandName === 'PutPublicAccessBlockCommand');
+        assert.ok(blockCall);
+        assert.deepStrictEqual(blockCall.input.PublicAccessBlockConfiguration, {
+            BlockPublicAcls: false,
+            IgnorePublicAcls: false,
+            BlockPublicPolicy: false,
+            RestrictPublicBuckets: false,
+        });
+        // Verify website configurations
+        const websiteCall = s3Calls.find(c => c.commandName === 'PutBucketWebsiteCommand');
+        assert.ok(websiteCall);
+        assert.deepStrictEqual(websiteCall.input.WebsiteConfiguration, {
+            IndexDocument: { Suffix: 'index.html' },
+            ErrorDocument: { Key: 'error.html' },
+        });
+        // Verify public read bucket policy upload
+        const policyCall = s3Calls.find(c => c.commandName === 'PutBucketPolicyCommand');
+        assert.ok(policyCall);
+        const parsedPolicy = JSON.parse(policyCall.input.Policy);
+        const stmt = parsedPolicy.Statement.find((s) => s.Sid === 'PublicReadGetObject');
+        assert.ok(stmt);
+        assert.strictEqual(stmt.Effect, 'Allow');
+        assert.strictEqual(stmt.Principal, '*');
+        assert.strictEqual(stmt.Resource, 'arn:aws:s3:::my-web-bucket/*');
+    });
+    test('attaches OAC CloudFront policy integration correctly', async () => {
+        mockS3Responses['HeadBucketCommand'] = {};
+        mockS3Responses['GetBucketPolicyCommand'] = new Error('NoSuchBucketPolicy');
+        mockS3Responses['GetBucketPolicyCommand'].name = 'NoSuchBucketPolicy';
+        mockS3Responses['PutBucketPolicyCommand'] = {};
+        const mockCdn = {
+            name: 'my-cdn',
+            resolvedArn: 'arn:aws:cloudfront::123456789012:distribution/ED12345'
+        };
+        const builder = new S3BucketBuilder('my-bucket');
+        builder.allowFrom(mockCdn);
+        await builder.deploy();
+        const policyCall = s3Calls.find(c => c.commandName === 'PutBucketPolicyCommand');
+        assert.ok(policyCall);
+        const parsedPolicy = JSON.parse(policyCall.input.Policy);
+        const stmt = parsedPolicy.Statement.find((s) => s.Principal.Service === 'cloudfront.amazonaws.com');
+        assert.ok(stmt);
+        assert.strictEqual(stmt.Effect, 'Allow');
+        const sourceArns = stmt.Condition.StringEquals['AWS:SourceArn'];
+        assert.deepStrictEqual(sourceArns, ['arn:aws:cloudfront::123456789012:distribution/ED12345']);
+    });
+    test('uploads local file with mapped content type', async () => {
+        mockS3Responses['HeadBucketCommand'] = {};
+        mockS3Responses['PutObjectCommand'] = {};
+        const builder = new S3BucketBuilder('my-bucket');
+        builder.upload('/path/to/my-page.html');
+        await builder.deploy();
+        const uploadCall = s3Calls.find(c => c.commandName === 'PutObjectCommand');
+        assert.ok(uploadCall);
+        assert.strictEqual(uploadCall.input.Bucket, 'my-bucket');
+        assert.strictEqual(uploadCall.input.Key, 'my-page.html');
+        assert.strictEqual(uploadCall.input.ContentType, 'text/html');
+        assert.deepStrictEqual(uploadCall.input.Body, Buffer.from('hello from s3 site'));
+    });
+});

package/dist/providers/aws/sns.d.ts

@@ -0,0 +1,22 @@
+import { BaseBuilder } from "../../core/resource.js";
+import { Output } from "../../core/output.js";
+export declare class SNSTopicBuilder extends BaseBuilder {
+    readonly out: {
+        arn: Output<string>;
+    };
+    private _displayName?;
+    private _subscriptions;
+    resolvedArn: string | null;
+    resolvedDisplayName: string | null;
+    constructor(name: string);
+    displayName(name: string): this;
+    subscribe(protocol: "email" | "sms" | "lambda" | "sqs" | "https", endpoint: string): this;
+    private discoverTopic;
+    deploy(): Promise<{
+        name: string;
+        arn: string | null;
+    }>;
+    destroy(): Promise<{
+        destroyed: string;
+    }>;
+}

package/dist/providers/aws/sns.js

@@ -0,0 +1,146 @@
+import { CreateTopicCommand, DeleteTopicCommand, GetTopicAttributesCommand, ListTopicsCommand, SetTopicAttributesCommand, SubscribeCommand, UnsubscribeCommand, ListSubscriptionsByTopicCommand, } from "@aws-sdk/client-sns";
+import { BaseBuilder } from "../../core/resource.js";
+import { Output } from "../../core/output.js";
+import { getSNSClient } from "./api.js";
+export class SNSTopicBuilder extends BaseBuilder {
+    out = {
+        arn: new Output(),
+    };
+    _displayName;
+    _subscriptions = [];
+    resolvedArn = null;
+    resolvedDisplayName = null;
+    constructor(name) {
+        super(name);
+        this.discoveryPromise = this.discoverTopic(name);
+    }
+    displayName(name) {
+        this._displayName = name;
+        return this;
+    }
+    subscribe(protocol, endpoint) {
+        this._subscriptions.push({ protocol, endpoint });
+        return this;
+    }
+    async discoverTopic(name) {
+        const sns = getSNSClient();
+        try {
+            let nextToken;
+            do {
+                const result = await sns.send(new ListTopicsCommand({ NextToken: nextToken }));
+                const match = (result.Topics ?? []).find((t) => t.TopicArn?.split(":").pop() === name);
+                if (match) {
+                    this.resolvedArn = match.TopicArn ?? null;
+                    if (this.resolvedArn) {
+                        this.out.arn.resolve(this.resolvedArn);
+                        try {
+                            const attrsResult = await sns.send(new GetTopicAttributesCommand({ TopicArn: this.resolvedArn }));
+                            this.resolvedDisplayName = attrsResult.Attributes?.DisplayName ?? null;
+                        }
+                        catch (err) {
+                            // Ignore attribute fetch errors (e.g. permission or not found)
+                        }
+                    }
+                    return match;
+                }
+                nextToken = result.NextToken;
+            } while (nextToken);
+            return null;
+        }
+        catch (e) {
+            if (e.name === "CredentialsProviderError")
+                return null;
+            throw e;
+        }
+    }
+    async deploy() {
+        const dryRun = this.isDryRunActive();
+        const existing = await this.discoveryPromise;
+        const sns = getSNSClient();
+        console.log(`\n📢 Finalizing SNS Topic "${this.name}"...`);
+        if (dryRun) {
+            console.log(`   📝 [PLAN] ${existing ? "Update" : "Create"} SNS topic "${this.name}"`);
+            if (this._displayName) {
+                console.log(`      └─ Display Name: ${this._displayName}`);
+            }
+            for (const sub of this._subscriptions) {
+                console.log(`      └─ Subscribe: ${sub.protocol} to ${sub.endpoint}`);
+            }
+            this.resolvedArn = existing?.TopicArn ?? `arn:aws:sns:us-east-1:000000000000:DRYRUN-${this.name}`;
+            this.out.arn.resolve(this.resolvedArn);
+            return { name: this.name, arn: this.resolvedArn };
+        }
+        const topicAttrs = {};
+        if (this._displayName) {
+            topicAttrs.DisplayName = this._displayName;
+        }
+        if (!existing) {
+            const result = await sns.send(new CreateTopicCommand({
+                Name: this.name,
+                Attributes: topicAttrs,
+            }));
+            this.resolvedArn = result.TopicArn;
+            this.out.arn.resolve(this.resolvedArn);
+            console.log(`🚀 Created SNS Topic "${this.name}" (arn=${this.resolvedArn})`);
+        }
+        else {
+            this.resolvedArn = existing.TopicArn;
+            this.out.arn.resolve(this.resolvedArn);
+            if (this._displayName && this._displayName !== this.resolvedDisplayName) {
+                await sns.send(new SetTopicAttributesCommand({
+                    TopicArn: this.resolvedArn,
+                    AttributeName: "DisplayName",
+                    AttributeValue: this._displayName,
+                }));
+                console.log(`   ✅ Updated SNS topic display name to "${this._displayName}"`);
+            }
+            else {
+                console.log(`   ✅ SNS topic "${this.name}" already exists`);
+            }
+        }
+        // Sync subscriptions
+        const activeSubsResult = await sns.send(new ListSubscriptionsByTopicCommand({ TopicArn: this.resolvedArn }));
+        const activeSubs = activeSubsResult.Subscriptions ?? [];
+        // 1. Unsubscribe stale subscriptions
+        for (const sub of activeSubs) {
+            if (!sub.SubscriptionArn || sub.SubscriptionArn === "PendingConfirmation")
+                continue;
+            const isStillWanted = this._subscriptions.some((s) => s.protocol === sub.Protocol && s.endpoint === sub.Endpoint);
+            if (!isStillWanted) {
+                await sns.send(new UnsubscribeCommand({ SubscriptionArn: sub.SubscriptionArn }));
+                console.log(`   🧹 Unsubscribed stale subscription: ${sub.Protocol} to ${sub.Endpoint}`);
+            }
+        }
+        // 2. Subscribe new subscriptions
+        for (const target of this._subscriptions) {
+            const alreadyExists = activeSubs.some((sub) => sub.Protocol === target.protocol && sub.Endpoint === target.endpoint);
+            if (!alreadyExists) {
+                await sns.send(new SubscribeCommand({
+                    TopicArn: this.resolvedArn,
+                    Protocol: target.protocol,
+                    Endpoint: target.endpoint,
+                }));
+                console.log(`   ➕ Subscribed: ${target.protocol} to ${target.endpoint}`);
+            }
+        }
+        await this.deploySidecars();
+        return { name: this.name, arn: this.resolvedArn };
+    }
+    async destroy() {
+        const dryRun = this.isDryRunActive();
+        const existing = await this.discoveryPromise;
+        console.log(`\n🗑️  Destroying SNS Topic "${this.name}"...`);
+        if (!existing) {
+            console.log(`   ✅ Topic "${this.name}" does not exist - nothing to do`);
+            return { destroyed: this.name };
+        }
+        if (dryRun) {
+            console.log(`   📝 [PLAN] Delete SNS Topic "${this.name}"`);
+            return { destroyed: this.name };
+        }
+        const sns = getSNSClient();
+        await sns.send(new DeleteTopicCommand({ TopicArn: this.resolvedArn }));
+        console.log(`   ✅ Deleted SNS Topic "${this.name}"`);
+        return { destroyed: this.name };
+    }
+}

package/dist/providers/aws/sns.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/providers/aws/sns.test.js

@@ -0,0 +1,162 @@
+import { test, describe, beforeEach, afterEach } from "node:test";
+import assert from "node:assert";
+import { SNSClient } from "@aws-sdk/client-sns";
+import { SNSTopicBuilder } from "./sns.js";
+import { Config } from "../../core/config.js";
+describe("SNSTopicBuilder Unit Tests", () => {
+    let originalSnsSend;
+    let snsCalls = [];
+    let mockSnsResponses = {};
+    beforeEach(() => {
+        Config.set({
+            dryRun: false,
+            providers: {
+                aws: { region: "us-east-1" },
+            },
+        });
+        snsCalls = [];
+        mockSnsResponses = {};
+        originalSnsSend = SNSClient.prototype.send;
+        SNSClient.prototype.send = async function (command) {
+            const commandName = command.constructor.name;
+            const input = command.input;
+            snsCalls.push({ commandName, input });
+            if (mockSnsResponses[commandName]) {
+                const handler = mockSnsResponses[commandName];
+                if (typeof handler === "function")
+                    return handler(input);
+                if (handler instanceof Error)
+                    throw handler;
+                return handler;
+            }
+            return {};
+        };
+    });
+    afterEach(() => {
+        SNSClient.prototype.send = originalSnsSend;
+    });
+    test("gracefully handles discovery when topic does not exist", async () => {
+        mockSnsResponses["ListTopicsCommand"] = { Topics: [] };
+        const builder = new SNSTopicBuilder("my-topic");
+        const discoveryResult = await builder.discoveryPromise;
+        assert.strictEqual(discoveryResult, null);
+        assert.ok(snsCalls.some((c) => c.commandName === "ListTopicsCommand"));
+    });
+    test("discovers existing topic by matching name", async () => {
+        mockSnsResponses["ListTopicsCommand"] = {
+            Topics: [{ TopicArn: "arn:aws:sns:us-east-1:123456789012:my-topic" }],
+        };
+        mockSnsResponses["GetTopicAttributesCommand"] = {
+            Attributes: { DisplayName: "My Friendly Topic" },
+        };
+        const builder = new SNSTopicBuilder("my-topic");
+        const discoveryResult = await builder.discoveryPromise;
+        assert.ok(discoveryResult);
+        assert.strictEqual(builder.resolvedArn, "arn:aws:sns:us-east-1:123456789012:my-topic");
+        assert.strictEqual(builder.resolvedDisplayName, "My Friendly Topic");
+        const resolvedArn = await builder.out.arn.get();
+        assert.strictEqual(resolvedArn, "arn:aws:sns:us-east-1:123456789012:my-topic");
+    });
+    test("creates a new topic with display name and subscriptions", async () => {
+        mockSnsResponses["ListTopicsCommand"] = { Topics: [] };
+        mockSnsResponses["CreateTopicCommand"] = {
+            TopicArn: "arn:aws:sns:us-east-1:123456789012:my-topic",
+        };
+        mockSnsResponses["ListSubscriptionsByTopicCommand"] = { Subscriptions: [] };
+        const builder = new SNSTopicBuilder("my-topic")
+            .displayName("Cool Alert")
+            .subscribe("email", "ops@company.com")
+            .subscribe("sms", "+15555555555");
+        const deployResult = await builder.deploy();
+        assert.strictEqual(deployResult.arn, "arn:aws:sns:us-east-1:123456789012:my-topic");
+        assert.strictEqual(builder.resolvedArn, "arn:aws:sns:us-east-1:123456789012:my-topic");
+        const createCall = snsCalls.find((c) => c.commandName === "CreateTopicCommand");
+        assert.ok(createCall);
+        assert.deepStrictEqual(createCall.input, {
+            Name: "my-topic",
+            Attributes: { DisplayName: "Cool Alert" },
+        });
+        const subscribeCalls = snsCalls.filter((c) => c.commandName === "SubscribeCommand");
+        assert.strictEqual(subscribeCalls.length, 2);
+        assert.deepStrictEqual(subscribeCalls[0].input, {
+            TopicArn: "arn:aws:sns:us-east-1:123456789012:my-topic",
+            Protocol: "email",
+            Endpoint: "ops@company.com",
+        });
+        assert.deepStrictEqual(subscribeCalls[1].input, {
+            TopicArn: "arn:aws:sns:us-east-1:123456789012:my-topic",
+            Protocol: "sms",
+            Endpoint: "+15555555555",
+        });
+    });
+    test("syncs subscriptions correctly - unsubscribes stale and skips active", async () => {
+        mockSnsResponses["ListTopicsCommand"] = {
+            Topics: [{ TopicArn: "arn:aws:sns:us-east-1:123456789012:my-topic" }],
+        };
+        mockSnsResponses["GetTopicAttributesCommand"] = {
+            Attributes: { DisplayName: "Cool Alert" },
+        };
+        mockSnsResponses["ListSubscriptionsByTopicCommand"] = {
+            Subscriptions: [
+                {
+                    SubscriptionArn: "arn:aws:sns:us-east-1:123456789012:my-topic:sub1",
+                    Protocol: "email",
+                    Endpoint: "keep-me@company.com",
+                    TopicArn: "arn:aws:sns:us-east-1:123456789012:my-topic",
+                },
+                {
+                    SubscriptionArn: "arn:aws:sns:us-east-1:123456789012:my-topic:sub2",
+                    Protocol: "email",
+                    Endpoint: "delete-me@company.com",
+                    TopicArn: "arn:aws:sns:us-east-1:123456789012:my-topic",
+                },
+            ],
+        };
+        const builder = new SNSTopicBuilder("my-topic")
+            .displayName("Cool Alert")
+            .subscribe("email", "keep-me@company.com")
+            .subscribe("sms", "+19999999999");
+        await builder.deploy();
+        // Verify unsubscribe was called for stale one
+        const unsubscribeCall = snsCalls.find((c) => c.commandName === "UnsubscribeCommand");
+        assert.ok(unsubscribeCall);
+        assert.strictEqual(unsubscribeCall.input.SubscriptionArn, "arn:aws:sns:us-east-1:123456789012:my-topic:sub2");
+        // Verify subscribe was called for the new sms one, but NOT for keep-me@company.com
+        const subscribeCalls = snsCalls.filter((c) => c.commandName === "SubscribeCommand");
+        assert.strictEqual(subscribeCalls.length, 1);
+        assert.deepStrictEqual(subscribeCalls[0].input, {
+            TopicArn: "arn:aws:sns:us-east-1:123456789012:my-topic",
+            Protocol: "sms",
+            Endpoint: "+19999999999",
+        });
+    });
+    test("destroys an existing topic successfully", async () => {
+        mockSnsResponses["ListTopicsCommand"] = {
+            Topics: [{ TopicArn: "arn:aws:sns:us-east-1:123456789012:my-topic" }],
+        };
+        const builder = new SNSTopicBuilder("my-topic");
+        await builder.discoveryPromise;
+        const destroyResult = await builder.destroy();
+        assert.deepStrictEqual(destroyResult, { destroyed: "my-topic" });
+        const deleteCall = snsCalls.find((c) => c.commandName === "DeleteTopicCommand");
+        assert.ok(deleteCall);
+        assert.strictEqual(deleteCall.input.TopicArn, "arn:aws:sns:us-east-1:123456789012:my-topic");
+    });
+    test("runs in dry run mode safely", async () => {
+        Config.set({
+            dryRun: true,
+            providers: {
+                aws: { region: "us-east-1" },
+            },
+        });
+        mockSnsResponses["ListTopicsCommand"] = { Topics: [] };
+        const builder = new SNSTopicBuilder("my-topic")
+            .displayName("Cool Alert")
+            .subscribe("email", "ops@company.com");
+        const deployResult = await builder.deploy();
+        assert.ok(deployResult.arn.includes("DRYRUN"));
+        // No create topic or subscribe commands should be called in real mode
+        assert.ok(!snsCalls.some((c) => c.commandName === "CreateTopicCommand"));
+        assert.ok(!snsCalls.some((c) => c.commandName === "SubscribeCommand"));
+    });
+});

package/dist/providers/do/api.js

@@ -6,7 +6,11 @@ export class DoApiClient {
         this.token = token;
     }
     get authHeaders() {
-        return { Authorization: `Bearer ${this.token}`, 'Content-Type': 'application/json' };
+        return {
+            Authorization: `Bearer ${this.token}`,
+            'Content-Type': 'application/json',
+            'Accept-Encoding': 'identity'
+        };
     }
     async get(path) {
         const res = await fetch(`${DoApiClient.BASE}${path}`, { headers: this.authHeaders });

package/dist/providers/do/certificate.test.d.ts

@@ -0,0 +1 @@
+export {};