@go-to-k/cdkd 0.267.11 → 0.267.13

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as WorkGraph, $t as NestedStackChildDirectDestroyError, A as slowCcOperationTimeoutMs, At as CFN_TEMPLATE_BODY_LIMIT, B as applyRoleArnIfSet, Bt as AwsClients, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as expectedOwnerParam, G as DagBuilder, Gt as CdkdError, H as describeTypeWithThrottleRetry, Ht as resetAwsClients, I as WAFv2WebACLProvider, It as AssemblyReader, J as S3StateBackend, Jt as LocalInvokeBuildError$1, K as TemplateParser, L as normalizeAwsTagsToCfn, Lt as processStackMessages, M as isTerminationProtectionPropagationError, Mt as MIGRATE_TMP_PREFIX, N as IntrinsicFunctionResolver, Nt as findLargeInlineResources, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as uploadCfnTemplate, Q as stringifyValue, Qt as MissingCdkCliError, R as resolveExplicitPhysicalId, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as setAwsClients, V as DiffCalculator, Vt as getAwsClients, W as isRetryableTransientError, X as shouldRetainResource, Xt as LocalStartServiceError, Y as rebuildClientForBucketRegion, Yt as LocalMigrateError, Z as AssetPublisher, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as StackTerminationProtectionError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dn as withErrorHandling, dt as buildDockerImage, en as PartialFailureError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as StackHasActiveImportsError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_URL_LIMIT, k as CloudControlProvider, kt as warnDeprecatedNoPrefixCliFlag, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as ResourceTimeoutError, nt as loadPublishableAssetManifest, o as planFailedOps, ot as ensureAssetStorage, p as extractDeploymentEventError, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ResourceUpdateNotSupportedError, rt as rewriteTemplateAssetReferences, s as planRollback, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as ProvisioningError, tt as createAssetRedirectResolver, u as withResourceDeadline, un as normalizeAwsError, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch, zt as resolveBucketRegion } from "./deploy-engine-ChJTdrUr.js";
+import { $ as WorkGraph, $t as NestedStackChildDirectDestroyError, A as slowCcOperationTimeoutMs, At as CFN_TEMPLATE_BODY_LIMIT, B as applyRoleArnIfSet, Bt as AwsClients, C as yellow, Ct as resolveAutoAssetStorage, D as ProviderRegistry, Dt as resolveStateBucketWithDefaultAndSource, E as clearOnUpdateRemoval, Et as resolveStateBucketWithDefault, F as refStateLookupFromResource, Ft as expectedOwnerParam, G as DagBuilder, Gt as CdkdError, H as describeTypeWithThrottleRetry, Ht as resetAwsClients, I as WAFv2WebACLProvider, It as AssemblyReader, J as S3StateBackend, Jt as LocalInvokeBuildError$1, K as TemplateParser, L as normalizeAwsTagsToCfn, Lt as processStackMessages, M as isTerminationProtectionPropagationError, Mt as MIGRATE_TMP_PREFIX, N as IntrinsicFunctionResolver, Nt as findLargeInlineResources, O as findActionableSilentDrops, Ot as resolveUseCdkBootstrapAssets, P as cfnRefValueFromPhysicalId, Pt as uploadCfnTemplate, Q as stringifyValue, Qt as MissingCdkCliError, R as resolveExplicitPhysicalId, S as red, St as resolveApp, T as collectInlinePolicyNamesManagedBySiblings, Tt as resolveSkipPrefix, U as withRetry, Ut as setAwsClients, V as DiffCalculator, Vt as getAwsClients, W as isRetryableTransientError, X as shouldRetainResource, Xt as LocalStartServiceError, Y as rebuildClientForBucketRegion, Yt as LocalMigrateError, Z as AssetPublisher, _ as formatResourceLine, _t as getDockerImageBySourceHash, a as DeploymentEventsStore, an as StackTerminationProtectionError, at as BOOTSTRAP_MARKER_PREFIX, b as gray, bt as getDefaultStateBucketName, c as replayFailedOperations, ct as parseBootstrapMarker, d as IMPLICIT_DELETE_DEPENDENCIES, dn as withErrorHandling, dt as buildDockerImage, en as PartialFailureError, et as buildAssetRedirectMap, f as computeImplicitDeleteEdges, ft as formatDockerLoginError, g as renderStatefulReason, gt as AssetManifestLoader, h as isStatefulRecreateTargetSync, ht as runDockerStreaming, i as DeploymentEventsReader, in as StackHasActiveImportsError, it as AssetModeResolver, j as disableInstanceApiTermination, jt as CFN_TEMPLATE_URL_LIMIT, k as CloudControlProvider, kt as warnDeprecatedNoPrefixCliFlag, l as replayRollback, lt as validateAssetBucketName, m as MULTI_REGION_RECREATE_BLOCKED_TYPES, mt as runDockerForeground, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as ResourceTimeoutError, nt as loadPublishableAssetManifest, o as planFailedOps, ot as ensureAssetStorage, p as extractDeploymentEventError, pt as getDockerCmd, q as LockManager, r as DeployEngine, rn as ResourceUpdateNotSupportedError, rt as rewriteTemplateAssetReferences, s as planRollback, st as getBootstrapMarkerKey, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as ProvisioningError, tt as createAssetRedirectResolver, u as withResourceDeadline, un as normalizeAwsError, ut as validateContainerRepoName, v as bold, vt as Synthesizer, w as IAMRoleProvider, wt as resolveCaptureObservedState, x as green, xt as getLegacyStateBucketName, y as cyan, yt as synthesisStatusMessage, z as assertRegionMatch, zt as resolveBucketRegion } from "./deploy-engine-D1M5yCxb.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CKDQjSTS.js";
+import { t as ASGProvider } from "./asg-provider-CYG6Bl7y.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -28060,7 +28060,7 @@ var ElastiCacheProvider = class {
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
 		switch (resourceType) {
-			case "AWS::ElastiCache::SubnetGroup": return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties);
+			case "AWS::ElastiCache::SubnetGroup": return this.updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties);
 			case "AWS::ElastiCache::CacheCluster": return this.updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties);
 			default: throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId, physicalId);
 		}
@@ -28094,12 +28094,12 @@ var ElastiCacheProvider = class {
 			throw new ProvisioningError(`Failed to create CacheSubnetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, cacheSubnetGroupName, cause);
 		}
 	}
-	async updateSubnetGroup(logicalId, physicalId, resourceType, properties) {
+	async updateSubnetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating CacheSubnetGroup ${logicalId}: ${physicalId}`);
 		try {
 			await this.getClient().send(new ModifyCacheSubnetGroupCommand({
 				CacheSubnetGroupName: physicalId,
-				CacheSubnetGroupDescription: properties["Description"] ?? properties["CacheSubnetGroupDescription"],
+				CacheSubnetGroupDescription: clearOnUpdateRemoval(properties["Description"] ?? properties["CacheSubnetGroupDescription"], previousProperties["Description"] ?? previousProperties["CacheSubnetGroupDescription"], `Subnet group for ${logicalId}`),
 				SubnetIds: properties["SubnetIds"]
 			}));
 			this.logger.debug(`Successfully updated CacheSubnetGroup ${logicalId}`);
@@ -28189,6 +28189,8 @@ var ElastiCacheProvider = class {
 		try {
 			const rawSgIds = properties["VpcSecurityGroupIds"];
 			const sgIds = rawSgIds && rawSgIds.length > 0 ? rawSgIds : void 0;
+			const notificationTopicArn = properties["NotificationTopicArn"];
+			const notificationRemoved = notificationTopicArn === void 0 && previousProperties["NotificationTopicArn"] != null;
 			await this.getClient().send(new ModifyCacheClusterCommand({
 				CacheClusterId: physicalId,
 				NumCacheNodes: properties["NumCacheNodes"] != null ? Number(properties["NumCacheNodes"]) : void 0,
@@ -28196,11 +28198,13 @@ var ElastiCacheProvider = class {
 				CacheParameterGroupName: properties["CacheParameterGroupName"],
 				EngineVersion: properties["EngineVersion"],
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
-				SnapshotRetentionLimit: properties["SnapshotRetentionLimit"] != null ? Number(properties["SnapshotRetentionLimit"]) : void 0,
+				SnapshotRetentionLimit: clearOnUpdateRemoval(properties["SnapshotRetentionLimit"] != null ? Number(properties["SnapshotRetentionLimit"]) : void 0, previousProperties["SnapshotRetentionLimit"] != null ? Number(previousProperties["SnapshotRetentionLimit"]) : void 0, 0),
 				SnapshotWindow: properties["SnapshotWindow"],
-				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
-				NotificationTopicArn: properties["NotificationTopicArn"],
-				LogDeliveryConfigurations: properties["LogDeliveryConfigurations"],
+				AutoMinorVersionUpgrade: clearOnUpdateRemoval(properties["AutoMinorVersionUpgrade"], previousProperties["AutoMinorVersionUpgrade"], true),
+				NotificationTopicArn: notificationTopicArn,
+				...notificationRemoved && { NotificationTopicStatus: "inactive" },
+				...notificationTopicArn !== void 0 && { NotificationTopicStatus: "active" },
+				LogDeliveryConfigurations: this.buildLogDeliveryConfigurationsForUpdate(properties["LogDeliveryConfigurations"], previousProperties["LogDeliveryConfigurations"]),
 				IpDiscovery: properties["IpDiscovery"],
 				ApplyImmediately: true
 			}));
@@ -28246,6 +28250,30 @@ var ElastiCacheProvider = class {
 		}
 	}
 	/**
+	* Build the `LogDeliveryConfigurations` input for ModifyCacheCluster so a
+	* log type REMOVED from the template is explicitly disabled (issue #1160).
+	*
+	* ModifyCacheCluster applies each request entry to ONLY its own LogType
+	* (per-entry merge semantics), so both a whole-property removal and a
+	* per-entry removal would silently keep the live delivery config. The
+	* documented disable sentinel is `{ LogType, Enabled: false }`
+	* (LogDeliveryConfigurationRequest doc: "Specify if log delivery is
+	* enabled. Default true."). Kept / added entries pass through unchanged;
+	* previously-configured log types missing from the new template get a
+	* disable entry appended. Returns `undefined` when there is nothing to
+	* send (no change).
+	*/
+	buildLogDeliveryConfigurationsForUpdate(newConfigs, previousConfigs) {
+		const kept = newConfigs ?? [];
+		const keptLogTypes = new Set(kept.map((c) => c.LogType).filter((t) => t !== void 0));
+		const disables = (previousConfigs ?? []).filter((c) => c.LogType !== void 0 && !keptLogTypes.has(c.LogType)).map((c) => ({
+			LogType: c.LogType,
+			Enabled: false
+		}));
+		const merged = [...kept, ...disables];
+		return merged.length > 0 ? merged : void 0;
+	}
+	/**
 	* Apply a diff between old and new CFn-shape Tags arrays via ElastiCache's
 	* `AddTagsToResource` / `RemoveTagsFromResource` APIs (keyed by
 	* `ResourceName=arn`).
@@ -28389,7 +28417,7 @@ var ElastiCacheProvider = class {
 		if (cluster.SnapshotRetentionLimit !== void 0) result["SnapshotRetentionLimit"] = cluster.SnapshotRetentionLimit;
 		if (cluster.SnapshotWindow !== void 0) result["SnapshotWindow"] = cluster.SnapshotWindow;
 		if (cluster.AutoMinorVersionUpgrade !== void 0) result["AutoMinorVersionUpgrade"] = cluster.AutoMinorVersionUpgrade;
-		if (cluster.NotificationConfiguration?.TopicArn !== void 0) result["NotificationTopicArn"] = cluster.NotificationConfiguration.TopicArn;
+		if (cluster.NotificationConfiguration?.TopicArn !== void 0 && cluster.NotificationConfiguration.TopicStatus !== "inactive") result["NotificationTopicArn"] = cluster.NotificationConfiguration.TopicArn;
 		if (cluster.IpDiscovery !== void 0) result["IpDiscovery"] = cluster.IpDiscovery;
 		if (cluster.NetworkType !== void 0) result["NetworkType"] = cluster.NetworkType;
 		if (cluster.Engine === "redis" && cluster.TransitEncryptionEnabled !== void 0) result["TransitEncryptionEnabled"] = cluster.TransitEncryptionEnabled;
@@ -39363,21 +39391,83 @@ var DLMLifecyclePolicyProvider = class {
 	* Map the CFn property shape to the SDK input shape (shared by create and
 	* update — every field name is PascalCase-identical). `Tags` and
 	* `DefaultPolicy` are intentionally NOT included: create wires them
-	* separately (update has neither parameter).
+	* separately (update has neither parameter). `!= null` (not
+	* `!== undefined`) so an explicit-null template value is treated as
+	* absent instead of being passed to the SDK as `null` — matches
+	* `buildRemovalResets`' null normalization.
 	*/
 	toSdkFields(properties) {
 		return {
-			...properties["ExecutionRoleArn"] !== void 0 && { ExecutionRoleArn: properties["ExecutionRoleArn"] },
-			...properties["Description"] !== void 0 && { Description: properties["Description"] },
-			...properties["State"] !== void 0 && { State: properties["State"] },
-			...properties["PolicyDetails"] !== void 0 && { PolicyDetails: properties["PolicyDetails"] },
-			...properties["CreateInterval"] !== void 0 && { CreateInterval: properties["CreateInterval"] },
-			...properties["RetainInterval"] !== void 0 && { RetainInterval: properties["RetainInterval"] },
-			...properties["CopyTags"] !== void 0 && { CopyTags: properties["CopyTags"] },
-			...properties["ExtendDeletion"] !== void 0 && { ExtendDeletion: properties["ExtendDeletion"] },
-			...properties["CrossRegionCopyTargets"] !== void 0 && { CrossRegionCopyTargets: properties["CrossRegionCopyTargets"] },
-			...properties["Exclusions"] !== void 0 && { Exclusions: properties["Exclusions"] }
-		};
+			...properties["ExecutionRoleArn"] != null && { ExecutionRoleArn: properties["ExecutionRoleArn"] },
+			...properties["Description"] != null && { Description: properties["Description"] },
+			...properties["State"] != null && { State: properties["State"] },
+			...properties["PolicyDetails"] != null && { PolicyDetails: properties["PolicyDetails"] },
+			...properties["CreateInterval"] != null && { CreateInterval: properties["CreateInterval"] },
+			...properties["RetainInterval"] != null && { RetainInterval: properties["RetainInterval"] },
+			...properties["CopyTags"] != null && { CopyTags: properties["CopyTags"] },
+			...properties["ExtendDeletion"] != null && { ExtendDeletion: properties["ExtendDeletion"] },
+			...properties["CrossRegionCopyTargets"] != null && { CrossRegionCopyTargets: properties["CrossRegionCopyTargets"] },
+			...properties["Exclusions"] != null && { Exclusions: properties["Exclusions"] }
+		};
+	}
+	/**
+	* Removal resets for the default-policy shorthand fields (issue #1160).
+	*
+	* UpdateLifecyclePolicy uses merge semantics (live-probed 2026-07-27: an
+	* update carrying only PolicyId retains every live value), while CFn
+	* resets a property removed from the template to its default. Each
+	* shorthand field is routed through `clearOnUpdateRemoval` with its
+	* documented default — all live-probed as accepted AND applied (the
+	* service create-defaults match: a create omitting them reads back
+	* 1 / 7 / false / false):
+	*   CreateInterval -> 1, RetainInterval -> 7, CopyTags -> false,
+	*   ExtendDeletion -> false, CrossRegionCopyTargets -> [].
+	*   Exclusions -> the per-DefaultPolicy explicit-empty shape:
+	*     VOLUME   -> { ExcludeBootVolumes: false, ExcludeVolumeTypes: [],
+	*                   ExcludeTags: [] }
+	*     INSTANCE -> { ExcludeTags: [] } (the volume-only sub-fields are
+	*                  rejected on IMAGE_MANAGEMENT policies — live-probed
+	*                  "ExcludeBootVolumes cannot be enabled for the
+	*                  following policy type {IMAGE_MANAGEMENT}")
+	*   (A KEPT-but-partial Exclusions object needs no handling: the API
+	*   replaces the whole object — live-probed, a kept object with
+	*   ExcludeTags dropped reads back ExcludeTags: [] — so pass-through is
+	*   already CFn parity at the sub-field level.)
+	* These fields only exist on default policies, so the resets can only
+	* fire there (a standard policy never had them in previousProperties).
+	* Deferred with rationale:
+	*   Description — UpdateLifecyclePolicy rejects '' (live-probed
+	*     InvalidRequestException: "The following parameter(s) are invalid:
+	*     Description") and documents no clear sentinel, so there is no
+	*     wire shape that resets it; pass-through (keep live value) is the
+	*     only expressible behavior.
+	*   State / ExecutionRoleArn / PolicyDetails — required-on-create
+	*     fields with no CFn default; removal is not a meaningful template
+	*     operation for them.
+	*/
+	buildRemovalResets(properties, previousProperties) {
+		const resets = {};
+		const createInterval = clearOnUpdateRemoval(properties["CreateInterval"] != null ? Number(properties["CreateInterval"]) : void 0, previousProperties["CreateInterval"] != null ? Number(previousProperties["CreateInterval"]) : void 0, 1);
+		if (createInterval !== void 0) resets.CreateInterval = createInterval;
+		const retainInterval = clearOnUpdateRemoval(properties["RetainInterval"] != null ? Number(properties["RetainInterval"]) : void 0, previousProperties["RetainInterval"] != null ? Number(previousProperties["RetainInterval"]) : void 0, 7);
+		if (retainInterval !== void 0) resets.RetainInterval = retainInterval;
+		const copyTags = clearOnUpdateRemoval(properties["CopyTags"] ?? void 0, previousProperties["CopyTags"] ?? void 0, false);
+		if (copyTags !== void 0) resets.CopyTags = copyTags;
+		const extendDeletion = clearOnUpdateRemoval(properties["ExtendDeletion"] ?? void 0, previousProperties["ExtendDeletion"] ?? void 0, false);
+		if (extendDeletion !== void 0) resets.ExtendDeletion = extendDeletion;
+		const crossRegionCopyTargets = clearOnUpdateRemoval(properties["CrossRegionCopyTargets"] ?? void 0, previousProperties["CrossRegionCopyTargets"] ?? void 0, []);
+		if (crossRegionCopyTargets !== void 0) resets.CrossRegionCopyTargets = crossRegionCopyTargets;
+		const defaultPolicy = properties["DefaultPolicy"] ?? previousProperties["DefaultPolicy"];
+		const exclusionsClear = defaultPolicy === "VOLUME" ? {
+			ExcludeBootVolumes: false,
+			ExcludeVolumeTypes: [],
+			ExcludeTags: []
+		} : defaultPolicy === "INSTANCE" ? { ExcludeTags: [] } : void 0;
+		if (exclusionsClear !== void 0) {
+			const exclusions = clearOnUpdateRemoval(properties["Exclusions"] ?? void 0, previousProperties["Exclusions"] ?? void 0, exclusionsClear);
+			if (exclusions !== void 0) resets.Exclusions = exclusions;
+		}
+		return resets;
 	}
 	/** Fetch the policy ARN (`Fn::GetAtt Arn`) for a policy id. */
 	async fetchPolicyArn(policyId) {
@@ -39416,7 +39506,8 @@ var DLMLifecyclePolicyProvider = class {
 		try {
 			await this.getClient().send(new UpdateLifecyclePolicyCommand({
 				PolicyId: physicalId,
-				...this.toSdkFields(properties)
+				...this.toSdkFields(properties),
+				...this.buildRemovalResets(properties, previousProperties)
 			}));
 			const newTags = this.cfnTagsToMap(properties["Tags"]) ?? {};
 			const oldTags = this.cfnTagsToMap(previousProperties["Tags"]) ?? {};
@@ -61986,7 +62077,7 @@ function createMigrateCommand() {
 */
 function buildProgram() {
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.267.11");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.267.13");
 	program.hook("preAction", (_thisCommand, actionCommand) => {
 		const { profile } = actionCommand.optsWithGlobals();
 		if (profile !== void 0) process.env["AWS_PROFILE"] = profile;