@go-to-k/cdkd 0.230.0 → 0.230.2

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as CFN_TEMPLATE_BODY_LIMIT, A as LockManager, B as runDockerForeground, C as findActionableSilentDrops, D as DiffCalculator, E as applyRoleArnIfSet, F as stringifyValue, G as getDefaultStateBucketName, H as AssetManifestLoader, I as WorkGraph, J as resolveCaptureObservedState, K as getLegacyStateBucketName, L as buildDockerImage, M as rebuildClientForBucketRegion, N as shouldRetainResource, O as DagBuilder, P as AssetPublisher, Q as warnDeprecatedNoPrefixCliFlag, R as formatDockerLoginError, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as getDockerImageBySourceHash, V as runDockerStreaming, W as Synthesizer, X as resolveStateBucketWithDefault, Y as resolveSkipPrefix, Z as resolveStateBucketWithDefaultAndSource, _ as green, a as withRetry, b as IAMRoleProvider, c as computeImplicitDeleteEdges, d as isStatefulRecreateTargetSync, et as CFN_TEMPLATE_URL_LIMIT, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as AssemblyReader, j as S3StateBackend, k as TemplateParser, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as findLargeInlineResources, o as isRetryableTransientError, ot as resolveBucketRegion, p as formatResourceLine, q as resolveApp, r as DeployEngine, rt as uploadCfnTemplate, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as MIGRATE_TMP_PREFIX, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as getDockerCmd } from "./deploy-engine-_N5kVjZN.js";
+import { $ as CFN_TEMPLATE_BODY_LIMIT, A as LockManager, B as runDockerForeground, C as findActionableSilentDrops, D as DiffCalculator, E as applyRoleArnIfSet, F as stringifyValue, G as getDefaultStateBucketName, H as AssetManifestLoader, I as WorkGraph, J as resolveCaptureObservedState, K as getLegacyStateBucketName, L as buildDockerImage, M as rebuildClientForBucketRegion, N as shouldRetainResource, O as DagBuilder, P as AssetPublisher, Q as warnDeprecatedNoPrefixCliFlag, R as formatDockerLoginError, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as getDockerImageBySourceHash, V as runDockerStreaming, W as Synthesizer, X as resolveStateBucketWithDefault, Y as resolveSkipPrefix, Z as resolveStateBucketWithDefaultAndSource, _ as green, a as withRetry, b as IAMRoleProvider, c as computeImplicitDeleteEdges, d as isStatefulRecreateTargetSync, et as CFN_TEMPLATE_URL_LIMIT, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as AssemblyReader, j as S3StateBackend, k as TemplateParser, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as findLargeInlineResources, o as isRetryableTransientError, ot as resolveBucketRegion, p as formatResourceLine, q as resolveApp, r as DeployEngine, rt as uploadCfnTemplate, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as MIGRATE_TMP_PREFIX, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as getDockerCmd } from "./deploy-engine-BHGrlCLe.js";
 import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomBytes, randomUUID } from "node:crypto";
@@ -9,7 +9,7 @@ import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurat
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListInstanceProfilesCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, ListUserTagsCommand, ListUsersCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
 import { CreateQueueCommand, DeleteQueueCommand, GetQueueAttributesCommand, GetQueueUrlCommand, ListQueueTagsCommand, ListQueuesCommand, QueueDoesNotExist, SQSClient, SetQueueAttributesCommand, TagQueueCommand, UntagQueueCommand } from "@aws-sdk/client-sqs";
 import { CreateTopicCommand, DeleteTopicCommand, GetSubscriptionAttributesCommand, GetTopicAttributesCommand, ListTagsForResourceCommand, ListTopicsCommand, NotFoundException, SNSClient, SetTopicAttributesCommand, SubscribeCommand, TagResourceCommand, UnsubscribeCommand, UntagResourceCommand } from "@aws-sdk/client-sns";
-import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListFunctionsCommand, ListLayersCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
+import { AddPermissionCommand, CreateEventSourceMappingCommand, CreateFunctionCommand, CreateFunctionUrlConfigCommand, DeleteEventSourceMappingCommand, DeleteFunctionCommand, DeleteFunctionConcurrencyCommand, DeleteFunctionEventInvokeConfigCommand, DeleteFunctionUrlConfigCommand, DeleteLayerVersionCommand, GetEventSourceMappingCommand, GetFunctionCommand, GetFunctionConcurrencyCommand, GetFunctionEventInvokeConfigCommand, GetFunctionRecursionConfigCommand, GetFunctionUrlConfigCommand, GetLayerVersionByArnCommand, GetPolicyCommand as GetPolicyCommand$1, LambdaClient, ListFunctionsCommand, ListLayersCommand, ListTagsCommand, PublishLayerVersionCommand, PutFunctionConcurrencyCommand, PutFunctionEventInvokeConfigCommand, PutFunctionRecursionConfigCommand, RemovePermissionCommand, ResourceNotFoundException, TagResourceCommand as TagResourceCommand$1, UntagResourceCommand as UntagResourceCommand$1, UpdateEventSourceMappingCommand, UpdateFunctionCodeCommand, UpdateFunctionConfigurationCommand, UpdateFunctionUrlConfigCommand, waitUntilFunctionUpdatedV2 } from "@aws-sdk/client-lambda";
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { AssociateIamInstanceProfileCommand, AssociateRouteTableCommand, AttachInternetGatewayCommand, AuthorizeSecurityGroupEgressCommand, AuthorizeSecurityGroupIngressCommand, CreateInternetGatewayCommand, CreateNatGatewayCommand, CreateNetworkAclCommand, CreateNetworkAclEntryCommand, CreateRouteCommand, CreateRouteTableCommand, CreateSecurityGroupCommand, CreateSubnetCommand, CreateTagsCommand, CreateVpcCommand, DeleteInternetGatewayCommand, DeleteNatGatewayCommand, DeleteNetworkAclCommand, DeleteNetworkAclEntryCommand, DeleteNetworkInterfaceCommand, DeleteRouteCommand, DeleteRouteTableCommand, DeleteSecurityGroupCommand, DeleteSubnetCommand, DeleteTagsCommand, DeleteVpcCommand, DescribeAvailabilityZonesCommand, DescribeIamInstanceProfileAssociationsCommand, DescribeInstanceAttributeCommand, DescribeInstanceCreditSpecificationsCommand, DescribeInstancesCommand, DescribeInternetGatewaysCommand, DescribeNatGatewaysCommand, DescribeNetworkAclsCommand, DescribeNetworkInterfacesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVolumesCommand, DescribeVpcAttributeCommand, DescribeVpcsCommand, DetachInternetGatewayCommand, DisassociateRouteTableCommand, EC2Client, ModifyInstanceAttributeCommand, ModifyInstanceCreditSpecificationCommand, ModifyInstanceMetadataOptionsCommand, ModifySubnetAttributeCommand, ModifyVpcAttributeCommand, MonitorInstancesCommand, ReplaceNetworkAclAssociationCommand, RevokeSecurityGroupEgressCommand, RevokeSecurityGroupIngressCommand, RunInstancesCommand, TerminateInstancesCommand, UnmonitorInstancesCommand, waitUntilInstanceRunning, waitUntilInstanceTerminated, waitUntilNatGatewayAvailable, waitUntilNatGatewayDeleted } from "@aws-sdk/client-ec2";
 import { CreateTableCommand, DeleteResourcePolicyCommand, DeleteTableCommand, DescribeContinuousBackupsCommand, DescribeContributorInsightsCommand, DescribeKinesisStreamingDestinationCommand, DescribeTableCommand, DescribeTimeToLiveCommand, DisableKinesisStreamingDestinationCommand, DynamoDBClient, EnableKinesisStreamingDestinationCommand, GetResourcePolicyCommand, ListTablesCommand, ListTagsOfResourceCommand, PutResourcePolicyCommand, ResourceNotFoundException as ResourceNotFoundException$1, TagResourceCommand as TagResourceCommand$2, UntagResourceCommand as UntagResourceCommand$2, UpdateContinuousBackupsCommand, UpdateContributorInsightsCommand, UpdateTableCommand, UpdateTimeToLiveCommand } from "@aws-sdk/client-dynamodb";
@@ -1445,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.230.0";
+	return "0.230.2";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -9661,6 +9661,210 @@ var LambdaLayerVersionProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/lambda-event-invoke-config-provider.ts
+/**
+* AWS Lambda EventInvokeConfig Provider
+*
+* Implements provisioning for AWS::Lambda::EventInvokeConfig (the async-invoke
+* configuration CDK synthesizes whenever a Function sets `maxEventAge`,
+* `retryAttempts`, or `onFailure` / `onSuccess` destinations).
+*
+* WHY an SDK provider instead of the Cloud Control fallback:
+* `PutFunctionEventInvokeConfig` is a synchronous **full-replace** write —
+* exactly what CloudFormation uses for this type. The Cloud Control UPDATE
+* path instead applies a JSON-patch read-modify-write, and Lambda's
+* EventInvokeConfig read handler returns an AWS-injected empty
+* `DestinationConfig.OnSuccess: {}` even when only `OnFailure` was configured.
+* That empty object then fails Cloud Control model validation on every UPDATE
+* (`#/DestinationConfig/OnSuccess: required key [Destination] not found`), so a
+* common daily pattern — an async Lambda with `onFailure` whose `maxEventAge`
+* or `retryAttempts` is later changed — was undeployable via the CC route.
+* The full-replace SDK call sends exactly the template's DestinationConfig and
+* sidesteps the merge entirely.
+*
+* The physical id is the Cloud Control primaryIdentifier shape
+* `<FunctionName>|<Qualifier>` so import / migration stays consistent with the
+* prior CC-routed behavior.
+*/
+var LambdaEventInvokeConfigProvider = class {
+	lambdaClient;
+	logger = getLogger().child("LambdaEventInvokeConfigProvider");
+	handledProperties = new Map([["AWS::Lambda::EventInvokeConfig", new Set([
+		"FunctionName",
+		"Qualifier",
+		"MaximumEventAgeInSeconds",
+		"MaximumRetryAttempts",
+		"DestinationConfig"
+	])]]);
+	constructor() {
+		const awsClients = getAwsClients();
+		this.lambdaClient = awsClients.lambda;
+	}
+	/**
+	* Compose the Cloud-Control-compatible compound physical id.
+	*/
+	buildPhysicalId(functionName, qualifier) {
+		return `${functionName}|${qualifier}`;
+	}
+	/**
+	* Split a `<FunctionName>|<Qualifier>` physical id back into its parts.
+	* Tolerates a bare function name (defaults the qualifier to `$LATEST`).
+	* Splits on the FIRST `|`, which is unambiguous: a Lambda function name is
+	* `[a-zA-Z0-9-_]+` and a function ARN contains no `|`, so the separator can
+	* never appear inside the FunctionName segment.
+	*/
+	parsePhysicalId(physicalId) {
+		const sep = physicalId.indexOf("|");
+		if (sep === -1) return {
+			functionName: physicalId,
+			qualifier: "$LATEST"
+		};
+		return {
+			functionName: physicalId.slice(0, sep),
+			qualifier: physicalId.slice(sep + 1)
+		};
+	}
+	/**
+	* Build the SDK DestinationConfig from CFn properties.
+	*
+	* Only emit a sub-key (`OnSuccess` / `OnFailure`) when the template actually
+	* carries a `Destination` for it — never send an empty `{}`, which is the
+	* exact shape that fails the type's model validation.
+	*/
+	buildDestinationConfig(raw) {
+		if (!raw) return void 0;
+		const config = {};
+		const onSuccess = raw["OnSuccess"];
+		if (onSuccess && typeof onSuccess["Destination"] === "string") config.OnSuccess = { Destination: onSuccess["Destination"] };
+		const onFailure = raw["OnFailure"];
+		if (onFailure && typeof onFailure["Destination"] === "string") config.OnFailure = { Destination: onFailure["Destination"] };
+		return Object.keys(config).length > 0 ? config : void 0;
+	}
+	buildPutInput(properties) {
+		const functionName = properties["FunctionName"];
+		const qualifier = properties["Qualifier"] ?? "$LATEST";
+		const input = { FunctionName: functionName };
+		if (qualifier !== "$LATEST") input.Qualifier = qualifier;
+		if (properties["MaximumEventAgeInSeconds"] !== void 0) input.MaximumEventAgeInSeconds = Number(properties["MaximumEventAgeInSeconds"]);
+		if (properties["MaximumRetryAttempts"] !== void 0) input.MaximumRetryAttempts = Number(properties["MaximumRetryAttempts"]);
+		const dest = this.buildDestinationConfig(properties["DestinationConfig"]);
+		if (dest) input.DestinationConfig = dest;
+		return input;
+	}
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating Lambda EventInvokeConfig ${logicalId}`);
+		const functionName = properties["FunctionName"];
+		if (!functionName) throw new ProvisioningError(`FunctionName is required for Lambda EventInvokeConfig ${logicalId}`, resourceType, logicalId);
+		const qualifier = properties["Qualifier"] ?? "$LATEST";
+		try {
+			await this.lambdaClient.send(new PutFunctionEventInvokeConfigCommand(this.buildPutInput(properties)));
+			const physicalId = this.buildPhysicalId(functionName, qualifier);
+			this.logger.debug(`Successfully created Lambda EventInvokeConfig ${logicalId}: ${physicalId}`);
+			return {
+				physicalId,
+				attributes: {}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create Lambda EventInvokeConfig ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, functionName, cause);
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating Lambda EventInvokeConfig ${logicalId}: ${physicalId}`);
+		const handled = this.handledProperties.get("AWS::Lambda::EventInvokeConfig") ?? /* @__PURE__ */ new Set();
+		let changed = false;
+		for (const key of handled) if (JSON.stringify(properties[key] ?? null) !== JSON.stringify(previousProperties[key] ?? null)) {
+			changed = true;
+			break;
+		}
+		if (!changed) return {
+			physicalId,
+			wasReplaced: false,
+			attributes: {}
+		};
+		try {
+			await this.lambdaClient.send(new PutFunctionEventInvokeConfigCommand(this.buildPutInput(properties)));
+			this.logger.debug(`Successfully updated Lambda EventInvokeConfig ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: {}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update Lambda EventInvokeConfig ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting Lambda EventInvokeConfig ${logicalId}: ${physicalId}`);
+		const { functionName, qualifier } = this.parsePhysicalId(physicalId);
+		const deleteInput = { FunctionName: functionName };
+		if (qualifier !== "$LATEST") deleteInput.Qualifier = qualifier;
+		try {
+			await this.lambdaClient.send(new DeleteFunctionEventInvokeConfigCommand(deleteInput));
+			this.logger.debug(`Successfully deleted Lambda EventInvokeConfig ${logicalId}`);
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException) {
+				assertRegionMatch(await this.lambdaClient.config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`Lambda EventInvokeConfig ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete Lambda EventInvokeConfig ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* AWS::Lambda::EventInvokeConfig exposes no `Fn::GetAtt` return values, so
+	* there is nothing to resolve. Present for interface completeness / orphan
+	* rewrites.
+	*/
+	async getAttribute(_physicalId, _resourceType, _attributeName) {}
+	/**
+	* Read the AWS-current async-invoke configuration in CFn-property shape for
+	* `cdkd drift`. Surfaces only the keys cdkd writes; the AWS-injected empty
+	* `DestinationConfig.OnSuccess: {}` is dropped so a config set with only
+	* `OnFailure` does not show phantom drift.
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		const { functionName, qualifier } = this.parsePhysicalId(physicalId);
+		let resp;
+		try {
+			const input = { FunctionName: functionName };
+			if (qualifier !== "$LATEST") input.Qualifier = qualifier;
+			resp = await this.lambdaClient.send(new GetFunctionEventInvokeConfigCommand(input));
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException) return void 0;
+			throw err;
+		}
+		const result = {
+			FunctionName: functionName,
+			Qualifier: qualifier
+		};
+		if (resp.MaximumEventAgeInSeconds !== void 0) result["MaximumEventAgeInSeconds"] = resp.MaximumEventAgeInSeconds;
+		if (resp.MaximumRetryAttempts !== void 0) result["MaximumRetryAttempts"] = resp.MaximumRetryAttempts;
+		const dest = {};
+		if (resp.DestinationConfig?.OnSuccess?.Destination) dest["OnSuccess"] = { Destination: resp.DestinationConfig.OnSuccess.Destination };
+		if (resp.DestinationConfig?.OnFailure?.Destination) dest["OnFailure"] = { Destination: resp.DestinationConfig.OnFailure.Destination };
+		if (Object.keys(dest).length > 0) result["DestinationConfig"] = dest;
+		return result;
+	}
+	/**
+	* Adopt an existing EventInvokeConfig into cdkd state.
+	*
+	* **Explicit override only.** The config attaches to a function/qualifier and
+	* has no standalone identity or `aws:cdk:path` tag to look up. Users pass
+	* `--resource <logicalId>=<FunctionName>|<Qualifier>`.
+	*/
+	async import(input) {
+		if (input.knownPhysicalId) return {
+			physicalId: input.knownPhysicalId,
+			attributes: {}
+		};
+		return null;
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/dynamodb-table-provider.ts
 /**
@@ -35093,6 +35297,32 @@ var ECRProvider = class {
 		return this.client;
 	}
 	/**
+	* Map CFn `ImageScanningConfiguration` (PascalCase `{ ScanOnPush }`) to the
+	* SDK shape (camelCase `{ scanOnPush }`). The SDK input keys are camelCase;
+	* forwarding the CFn-cased object verbatim makes the SDK ignore the unknown
+	* `ScanOnPush` key and silently default `scanOnPush` to `false` — so
+	* `imageScanOnPush: true` never reached AWS. Returns `undefined` for an
+	* absent config so the caller can omit the field.
+	*/
+	toSdkScanningConfig(cfn) {
+		if (!cfn) return void 0;
+		return { scanOnPush: Boolean(cfn["ScanOnPush"]) };
+	}
+	/**
+	* Map CFn `EncryptionConfiguration` (PascalCase `{ EncryptionType, KmsKey }`)
+	* to the SDK shape (camelCase `{ encryptionType, kmsKey }`). Same casing trap
+	* as scanning config — a KMS repo's `KmsKey` would be silently dropped (and
+	* the type would fall back to AES256) without this mapping.
+	*/
+	toSdkEncryptionConfig(cfn) {
+		if (!cfn) return void 0;
+		const encryptionType = cfn["EncryptionType"];
+		if (!encryptionType) return void 0;
+		const out = { encryptionType };
+		if (encryptionType === "KMS" && cfn["KmsKey"]) out.kmsKey = cfn["KmsKey"];
+		return out;
+	}
+	/**
 	* Create an ECR Repository
 	*/
 	async create(logicalId, resourceType, properties) {
@@ -35100,11 +35330,13 @@ var ECRProvider = class {
 		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 256 }).toLowerCase();
 		try {
 			const tags = properties["Tags"];
+			const scanningConfig = this.toSdkScanningConfig(properties["ImageScanningConfiguration"]);
+			const encryptionConfig = this.toSdkEncryptionConfig(properties["EncryptionConfiguration"]);
 			const repo = (await this.getClient().send(new CreateRepositoryCommand({
 				repositoryName,
-				...properties["ImageScanningConfiguration"] ? { imageScanningConfiguration: properties["ImageScanningConfiguration"] } : {},
+				...scanningConfig ? { imageScanningConfiguration: scanningConfig } : {},
 				...properties["ImageTagMutability"] ? { imageTagMutability: properties["ImageTagMutability"] } : {},
-				...properties["EncryptionConfiguration"] ? { encryptionConfiguration: properties["EncryptionConfiguration"] } : {},
+				...encryptionConfig ? { encryptionConfiguration: encryptionConfig } : {},
 				...tags ? { tags } : {}
 			}))).repository;
 			if (!repo?.repositoryName) throw new Error("CreateRepository did not return repository name");
@@ -35155,7 +35387,7 @@ var ECRProvider = class {
 			if (JSON.stringify(newScanConfig) !== JSON.stringify(oldScanConfig)) {
 				await this.getClient().send(new PutImageScanningConfigurationCommand({
 					repositoryName: physicalId,
-					imageScanningConfiguration: newScanConfig ?? { scanOnPush: false }
+					imageScanningConfiguration: this.toSdkScanningConfig(newScanConfig) ?? { scanOnPush: false }
 				}));
 				this.logger.debug(`Updated image scanning configuration for ${physicalId}`);
 			}
@@ -36475,6 +36707,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::Lambda::Url", new LambdaUrlProvider());
 	registry.register("AWS::Lambda::EventSourceMapping", new LambdaEventSourceMappingProvider());
 	registry.register("AWS::Lambda::LayerVersion", new LambdaLayerVersionProvider());
+	registry.register("AWS::Lambda::EventInvokeConfig", new LambdaEventInvokeConfigProvider());
 	registry.register("AWS::DynamoDB::Table", new DynamoDBTableProvider());
 	registry.register("AWS::DynamoDB::GlobalTable", new DynamoDBGlobalTableProvider());
 	registry.register("AWS::Logs::LogGroup", new LogsLogGroupProvider());
@@ -54962,7 +55195,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.2");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());