fix(deployment): resolve AWS::NotificationARNs pseudo-parameter to empty in Fn::Sub/Ref

cdkd's intrinsic resolver returned `undefined` for the AWS::NotificationARNs
pseudo-parameter. In an Fn::Sub body that left the literal placeholder
`${AWS::NotificationARNs}` in the output (the pseudo branch is skipped on
`undefined`, and the subsequent Ref attempt throws + keeps the placeholder),
diverging from CloudFormation.

cdkd has no stack-notification-ARN concept (a cdkd deploy never sets SNS
notification ARNs on a stack), so the list is always empty. CloudFormation
resolves an empty AWS::NotificationARNs list to an empty string in an
Fn::Sub / Ref string context, so the resolver now returns '' (empty string)
for AWS::NotificationARNs in both Fn::Sub and bare Ref contexts.

- src/deployment/intrinsic-function-resolver.ts: return '' instead of undefined
- tests/unit/deployment/intrinsic-functions.test.ts: add a describe block
  asserting Fn::Sub('${AWS::NotificationARNs}') and Ref: AWS::NotificationARNs
  both resolve to ''
- tests/integration/intrinsics-torture: update the verify.sh expected value
  from `notif=undefined` to `notif=` (the prior expectation pinned a
  non-existent "undefined" behavior); update the stack/README/changelog notes
  to describe the CFn-parity empty-string resolution

Author: go-to-k

src/deployment/intrinsic-function-resolver.ts

@@ -2096,7 +2096,13 @@ export class IntrinsicFunctionResolver {
         return 'amazonaws.com';
 
       case 'AWS::NotificationARNs':
-        return undefined;
+        // cdkd has no stack-notification-ARN concept — a cdkd deploy never
+        // sets SNS notification ARNs on a stack — so the list is always
+        // empty. CloudFormation resolves an empty AWS::NotificationARNs list
+        // to an empty string in an Fn::Sub / Ref string context, so returning
+        // '' (not undefined) matches CFn parity and ensures the pseudo
+        // parameter is substituted rather than left as a literal placeholder.
+        return '';
 
       case 'AWS::NoValue':
         // Return special symbol to indicate property should be omitted

tests/integration/intrinsics-torture/README.md

@@ -41,18 +41,17 @@ This goes **beyond** the existing
 | `base64` | `Fn::Base64('cdkd-intrinsics-torture')` | `Y2RrZC1pbnRyaW5zaWNzLXRvcnR1cmU=` |
 | `split-select-join` | nested `Fn::Join` of three `Fn::Select`-of-`Fn::Split` picks | `a\|c\|e` |
 | `nested-sub` | two-arg `Fn::Sub`: literal-map var (nested `Fn::Join`) + `${AWS::Region}` + `${TortureQueue.Arn}` GetAtt | `label=cdkd-torture-sub;region=<r>;queueArn=arn:<p>:sqs:<r>:<acct>:...` |
-| `pseudo` | `Fn::Sub` over ALL pseudo-params: `${AWS::AccountId}` / `${AWS::Region}` / `${AWS::Partition}` / `${AWS::StackName}` / `${AWS::URLSuffix}` / `${AWS::NotificationARNs}` | `account=<acct>;region=<r>;partition=aws;stack=<stack>;urlsuffix=amazonaws.com;notif=undefined` |
+| `pseudo` | `Fn::Sub` over ALL pseudo-params: `${AWS::AccountId}` / `${AWS::Region}` / `${AWS::Partition}` / `${AWS::StackName}` / `${AWS::URLSuffix}` / `${AWS::NotificationARNs}` | `account=<acct>;region=<r>;partition=aws;stack=<stack>;urlsuffix=amazonaws.com;notif=` |
 | `topic-ref-sub` | `Fn::Sub` with pseudo params + a `Ref` to the SNS topic | `arn-prefix=arn:<p>:sns:<r>:<acct>;topicRef=arn:<p>:sns:<r>:<acct>:...` |
 
 ### Note on `AWS::NotificationARNs`
 
-cdkd resolves the `AWS::NotificationARNs` list pseudo-parameter to `undefined`
-(there is no CloudFormation notification-ARN list in cdkd's
-CloudFormation-free model). Inside `Fn::Sub` that stringifies to the literal
-`undefined`. The `pseudo` assertion **pins this documented behavior** — a
-regression that changed it (to an empty string, or a crash) would flip the
-assertion. This is intentional: the test exists to catch divergence, including
-in cdkd's own deliberate semantics.
+cdkd has no CloudFormation notification-ARN list in its CloudFormation-free
+model, so `AWS::NotificationARNs` is always an empty list. Matching
+CloudFormation's behavior for an empty list, it resolves to an **empty string**
+inside `Fn::Sub` (so `notif=` has nothing after the `=`). The `pseudo`
+assertion **pins this CFn-parity behavior** — a regression that left the literal
+`${AWS::NotificationARNs}` placeholder, or crashed, would flip the assertion.
 
 ## Resources
 

tests/integration/intrinsics-torture/lib/intrinsics-torture-stack.ts

@@ -199,10 +199,10 @@ export class IntrinsicsTortureStack extends cdk.Stack {
     // -----------------------------------------------------------------
     // 7. ALL pseudo-parameters, each fed through Fn::Sub into a parameter
     //    value so verify.sh can read back the resolved concrete value.
-    //    AWS::NotificationARNs is a LIST pseudo param that cdkd resolves to
-    //    `undefined` (there is no notification ARN list in cdkd's
-    //    CloudFormation-free model); inside Fn::Sub that stringifies to the
-    //    literal "undefined". verify.sh asserts cdkd's documented behavior.
+    //    AWS::NotificationARNs is a LIST pseudo param that is always empty in
+    //    cdkd's CloudFormation-free model (there is no notification ARN list).
+    //    Matching CloudFormation, an empty list resolves to an EMPTY STRING
+    //    inside Fn::Sub, so `notif=` is empty. verify.sh asserts this.
     // -----------------------------------------------------------------
     intrinsicParam(
       'PseudoParam',

tests/integration/intrinsics-torture/verify.sh

@@ -197,11 +197,13 @@ case "${NESTED_SUB}" in
 esac
 
 # -- 7. ALL pseudo-parameters via Fn::Sub --
-# cdkd resolves AWS::NotificationARNs to `undefined` (no CFn notification ARN
-# list in cdkd's model); inside Fn::Sub it stringifies to the literal
-# "undefined". This pins cdkd's DOCUMENTED behavior — a regression that
-# changed it (e.g. to empty string, or a crash) would flip this assertion.
-PSEUDO_EXPECTED="account=${ACCOUNT_ID};region=${REGION};partition=${PARTITION};stack=${STACK};urlsuffix=amazonaws.com;notif=undefined"
+# cdkd has no stack-notification-ARN concept (no CFn notification ARN list in
+# cdkd's model), so AWS::NotificationARNs is always an empty list. Matching
+# CloudFormation, an empty AWS::NotificationARNs list resolves to an EMPTY
+# STRING inside an Fn::Sub body — so `notif=` (nothing after the `=`). A
+# regression that left the literal `${AWS::NotificationARNs}` placeholder
+# (or crashed) would flip this assertion.
+PSEUDO_EXPECTED="account=${ACCOUNT_ID};region=${REGION};partition=${PARTITION};stack=${STACK};urlsuffix=amazonaws.com;notif="
 assert_param "all pseudo-parameters (Fn::Sub)" "${PFX}/pseudo" "${PSEUDO_EXPECTED}"
 
 # -- 8. Fn::Sub with pseudo params + a Ref to the SNS topic --

tests/unit/deployment/intrinsic-functions.test.ts

@@ -1424,6 +1424,46 @@ describe('IntrinsicFunctionResolver - Fn::Sub same-stack implicit Ref', () => {
   });
 });
 
+describe('IntrinsicFunctionResolver - AWS::NotificationARNs pseudo parameter', () => {
+  // cdkd has no stack-notification-ARN concept, so AWS::NotificationARNs is
+  // always an empty list — which CloudFormation resolves to an empty string
+  // in an Fn::Sub / Ref string context. Before the fix it resolved to
+  // `undefined`, which left the literal `${AWS::NotificationARNs}` placeholder
+  // in an Fn::Sub body (the pseudo branch was skipped on `undefined`).
+  let resolver: IntrinsicFunctionResolver;
+
+  beforeEach(() => {
+    resolver = new IntrinsicFunctionResolver();
+    resetAccountInfoCache();
+  });
+
+  const context: ResolverContext = {
+    template: { Resources: {} },
+    resources: {},
+  };
+
+  it('substitutes ${AWS::NotificationARNs} to an empty string in Fn::Sub', async () => {
+    const result = await resolver.resolve(
+      { 'Fn::Sub': '${AWS::NotificationARNs}' },
+      context
+    );
+    expect(result).toBe('');
+  });
+
+  it('substitutes ${AWS::NotificationARNs} embedded in a surrounding Fn::Sub string', async () => {
+    const result = await resolver.resolve(
+      { 'Fn::Sub': 'notif=${AWS::NotificationARNs};done' },
+      context
+    );
+    expect(result).toBe('notif=;done');
+  });
+
+  it('resolves a bare Ref: AWS::NotificationARNs to an empty string', async () => {
+    const result = await resolver.resolve({ Ref: 'AWS::NotificationARNs' }, context);
+    expect(result).toBe('');
+  });
+});
+
 describe('IntrinsicFunctionResolver - nested attribute path fallback (Issue #381)', () => {
   let resolver: IntrinsicFunctionResolver;