@go-to-k/cdkd 0.50.10 → 0.50.12

package/dist/cli.js

@@ -13838,7 +13838,7 @@ var SNSSubscriptionProvider = class {
     try {
       const attributes = {};
       const filterPolicy = properties["FilterPolicy"];
-      if (filterPolicy) {
+      if (filterPolicy !== void 0) {
         attributes["FilterPolicy"] = typeof filterPolicy === "string" ? filterPolicy : JSON.stringify(filterPolicy);
       }
       const response = await this.snsClient.send(
@@ -17107,6 +17107,19 @@ var LogsLogGroupProvider = class {
     }
     return this.buildArn(physicalId);
   }
+  /**
+   * Drift comparator skip-list: properties readCurrentState deliberately
+   * cannot round-trip from AWS yet. `DataProtectionPolicy` lives behind
+   * its own `GetDataProtectionPolicy` API call (not in
+   * `DescribeLogGroups` output) — declaring it here prevents
+   * guaranteed false-positive drift on every clean run for log groups
+   * deployed with a data-protection policy. Lifting this guard requires
+   * a per-group `GetDataProtectionPolicy` round-trip in
+   * `readCurrentState`.
+   */
+  getDriftUnknownPaths() {
+    return ["DataProtectionPolicy"];
+  }
   /**
    * Read the AWS-current log group configuration in CFn-property shape.
    *
@@ -17141,25 +17154,24 @@ var LogsLogGroupProvider = class {
       if (found.logGroupName !== void 0)
         result["LogGroupName"] = found.logGroupName;
       result["KmsKeyId"] = found.kmsKeyId ?? "";
-      if (found.retentionInDays !== void 0) {
-        result["RetentionInDays"] = found.retentionInDays;
-      }
+      result["RetentionInDays"] = found.retentionInDays ?? 0;
       if (found.logGroupClass !== void 0)
         result["LogGroupClass"] = found.logGroupClass;
+      let tags = [];
       if (found.arn) {
         const arnForTags = found.arn.replace(/:\*$/, "");
         try {
           const tagsResp = await this.logsClient.send(
             new ListTagsForResourceCommand2({ resourceArn: arnForTags })
           );
-          const tags = normalizeAwsTagsToCfn(tagsResp.tags);
-          result["Tags"] = tags;
+          tags = normalizeAwsTagsToCfn(tagsResp.tags);
         } catch (err) {
           if (err instanceof ResourceNotFoundException7)
             return void 0;
           throw err;
         }
       }
+      result["Tags"] = tags;
       return result;
     } catch (err) {
       if (err instanceof ResourceNotFoundException7)
@@ -17439,6 +17451,7 @@ var CloudWatchAlarmProvider = class {
    * Build PutMetricAlarm parameters from CDK properties
    */
   buildAlarmParams(alarmName, properties) {
+    const emptyToUndefined = (v) => typeof v === "string" && v === "" ? void 0 : v;
     const params = {
       AlarmName: alarmName,
       ComparisonOperator: properties["ComparisonOperator"],
@@ -17446,15 +17459,16 @@ var CloudWatchAlarmProvider = class {
       Threshold: properties["Threshold"],
       ActionsEnabled: properties["ActionsEnabled"],
       AlarmActions: properties["AlarmActions"],
-      AlarmDescription: properties["AlarmDescription"],
+      AlarmDescription: emptyToUndefined(properties["AlarmDescription"]),
       DatapointsToAlarm: properties["DatapointsToAlarm"],
       InsufficientDataActions: properties["InsufficientDataActions"],
       OKActions: properties["OKActions"],
-      TreatMissingData: properties["TreatMissingData"],
-      Unit: properties["Unit"]
+      TreatMissingData: emptyToUndefined(properties["TreatMissingData"]),
+      Unit: emptyToUndefined(properties["Unit"])
     };
-    if (properties["Metrics"]) {
-      const metrics = properties["Metrics"];
+    const metricsValue = properties["Metrics"];
+    if (Array.isArray(metricsValue) && metricsValue.length > 0) {
+      const metrics = metricsValue;
       params["Metrics"] = metrics.map((m) => {
         const entry = {
           Id: m["Id"]
@@ -17484,10 +17498,10 @@ var CloudWatchAlarmProvider = class {
         return entry;
       });
     } else {
-      params["MetricName"] = properties["MetricName"];
-      params["Namespace"] = properties["Namespace"];
+      params["MetricName"] = emptyToUndefined(properties["MetricName"]);
+      params["Namespace"] = emptyToUndefined(properties["Namespace"]);
       params["Period"] = properties["Period"];
-      params["Statistic"] = properties["Statistic"];
+      params["Statistic"] = emptyToUndefined(properties["Statistic"]);
       params["Dimensions"] = properties["Dimensions"];
     }
     return params;
@@ -18123,19 +18137,21 @@ var SSMParameterProvider = class {
         Name: physicalId,
         Type: type,
         Value: value,
-        Description: properties["Description"],
         Overwrite: true
       };
-      if (properties["AllowedPattern"]) {
+      if (properties["Description"] !== void 0) {
+        putParams.Description = properties["Description"];
+      }
+      if (properties["AllowedPattern"] !== void 0) {
         putParams.AllowedPattern = properties["AllowedPattern"];
       }
-      if (properties["Tier"]) {
+      if (properties["Tier"] !== void 0) {
         putParams.Tier = properties["Tier"];
       }
-      if (properties["Policies"]) {
+      if (properties["Policies"] !== void 0) {
         putParams.Policies = properties["Policies"];
       }
-      if (properties["DataType"]) {
+      if (properties["DataType"] !== void 0) {
         putParams.DataType = properties["DataType"];
       }
       await this.ssmClient.send(new PutParameterCommand(putParams));
@@ -18829,6 +18845,16 @@ import {
   ResourceNotFoundException as ResourceNotFoundException10
 } from "@aws-sdk/client-eventbridge";
 init_aws_clients();
+function sanitizeDeadLetterConfig(value) {
+  if (value === null || value === void 0)
+    return void 0;
+  if (typeof value !== "object")
+    return void 0;
+  const arn = value["Arn"];
+  if (typeof arn !== "string" || arn.length === 0)
+    return void 0;
+  return { Arn: arn };
+}
 var EventBridgeBusProvider = class {
   eventBridgeClient;
   logger = getLogger().child("EventBridgeBusProvider");
@@ -18875,11 +18901,9 @@ var EventBridgeBusProvider = class {
       if (properties["Tags"]) {
         createParams.Tags = properties["Tags"];
       }
-      if (properties["DeadLetterConfig"]) {
-        const dlcConfig = properties["DeadLetterConfig"];
-        createParams.DeadLetterConfig = {
-          Arn: dlcConfig["Arn"]
-        };
+      const dlcCreate = sanitizeDeadLetterConfig(properties["DeadLetterConfig"]);
+      if (dlcCreate) {
+        createParams.DeadLetterConfig = dlcCreate;
       }
       const response = await this.eventBridgeClient.send(new CreateEventBusCommand(createParams));
       const eventBusArn = response.EventBusArn ?? "";
@@ -18918,11 +18942,11 @@ var EventBridgeBusProvider = class {
       if (properties["KmsKeyIdentifier"] !== void 0) {
         updateParams.KmsKeyIdentifier = properties["KmsKeyIdentifier"];
       }
-      if (properties["DeadLetterConfig"]) {
-        const dlcConfig = properties["DeadLetterConfig"];
-        updateParams.DeadLetterConfig = {
-          Arn: dlcConfig["Arn"]
-        };
+      if (properties["DeadLetterConfig"] !== void 0) {
+        const dlcUpdate = sanitizeDeadLetterConfig(properties["DeadLetterConfig"]);
+        if (dlcUpdate) {
+          updateParams.DeadLetterConfig = dlcUpdate;
+        }
       }
       await this.eventBridgeClient.send(new UpdateEventBusCommand(updateParams));
     }
@@ -21988,7 +22012,7 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
    * the IAM trust relationship hasn't fully propagated yet.
    */
   async updateAccountWithRetry(cloudWatchRoleArn, logicalId, _resourceType) {
-    const patchOperations = cloudWatchRoleArn ? [
+    const patchOperations = cloudWatchRoleArn !== void 0 ? [
       {
         op: "replace",
         path: "/cloudwatchRoleArn",
@@ -22932,7 +22956,10 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
       if (resp.authorizationType !== void 0) {
         result["AuthorizationType"] = resp.authorizationType;
       }
-      result["AuthorizerId"] = resp.authorizerId ?? "";
+      const authType = resp.authorizationType;
+      if (authType === "CUSTOM" || authType === "COGNITO_USER_POOLS") {
+        result["AuthorizerId"] = resp.authorizerId ?? "";
+      }
       result["Integration"] = resp.methodIntegration ?? {};
       result["MethodResponses"] = resp.methodResponses ?? {};
       return result;
@@ -23568,7 +23595,12 @@ var ApiGatewayV2Provider = class {
       if (resp.ProtocolType !== void 0)
         result["ProtocolType"] = resp.ProtocolType;
       result["Description"] = resp.Description ?? "";
-      result["CorsConfiguration"] = resp.CorsConfiguration ?? {};
+      if (resp.ProtocolType === "HTTP") {
+        result["CorsConfiguration"] = resp.CorsConfiguration ?? {};
+      }
+      if (resp.ProtocolType === "WEBSOCKET" && resp.RouteSelectionExpression !== void 0) {
+        result["RouteSelectionExpression"] = resp.RouteSelectionExpression;
+      }
       const tags = normalizeAwsTagsToCfn(resp.Tags);
       result["Tags"] = tags;
       return result;
@@ -23609,7 +23641,10 @@ var ApiGatewayV2Provider = class {
       const result = { ApiId: apiId };
       if (resp.IntegrationType !== void 0)
         result["IntegrationType"] = resp.IntegrationType;
-      result["IntegrationUri"] = resp.IntegrationUri ?? "";
+      const uriRequired = resp.IntegrationType === "AWS" || resp.IntegrationType === "AWS_PROXY" || resp.IntegrationType === "HTTP" || resp.IntegrationType === "HTTP_PROXY";
+      if (uriRequired) {
+        result["IntegrationUri"] = resp.IntegrationUri ?? "";
+      }
       result["IntegrationMethod"] = resp.IntegrationMethod ?? "";
       result["PayloadFormatVersion"] = resp.PayloadFormatVersion ?? "";
       return result;
@@ -23631,8 +23666,11 @@ var ApiGatewayV2Provider = class {
       if (resp.RouteKey !== void 0)
         result["RouteKey"] = resp.RouteKey;
       result["Target"] = resp.Target ?? "";
-      result["AuthorizationType"] = resp.AuthorizationType ?? "";
-      result["AuthorizerId"] = resp.AuthorizerId ?? "";
+      result["AuthorizationType"] = resp.AuthorizationType ?? "NONE";
+      if (resp.AuthorizationType && resp.AuthorizationType !== "NONE") {
+        result["AuthorizerId"] = resp.AuthorizerId ?? "";
+        result["AuthorizationScopes"] = resp.AuthorizationScopes ? [...resp.AuthorizationScopes] : [];
+      }
       return result;
     } catch (err) {
       if (err instanceof NotFoundException4)
@@ -23653,9 +23691,12 @@ var ApiGatewayV2Provider = class {
         result["AuthorizerType"] = resp.AuthorizerType;
       result["Name"] = resp.Name ?? "";
       result["IdentitySource"] = resp.IdentitySource ? [...resp.IdentitySource] : [];
-      result["JwtConfiguration"] = resp.JwtConfiguration ?? {};
-      result["AuthorizerUri"] = resp.AuthorizerUri ?? "";
-      result["AuthorizerPayloadFormatVersion"] = resp.AuthorizerPayloadFormatVersion ?? "";
+      if (resp.AuthorizerType === "JWT") {
+        result["JwtConfiguration"] = resp.JwtConfiguration ?? {};
+      } else if (resp.AuthorizerType === "REQUEST") {
+        result["AuthorizerUri"] = resp.AuthorizerUri ?? "";
+        result["AuthorizerPayloadFormatVersion"] = resp.AuthorizerPayloadFormatVersion ?? "";
+      }
       return result;
     } catch (err) {
       if (err instanceof NotFoundException4)
@@ -24872,22 +24913,18 @@ var StepFunctionsProvider = class {
         const tagList = properties["Tags"];
         tags = tagList.map((tag) => ({ key: tag.Key, value: tag.Value }));
       }
-      const cfnEncConfig = properties["EncryptionConfiguration"];
-      let encryptionConfiguration;
-      if (cfnEncConfig) {
-        encryptionConfiguration = {
-          type: cfnEncConfig["Type"],
-          kmsKeyId: cfnEncConfig["KmsKeyId"],
-          kmsDataKeyReusePeriodSeconds: cfnEncConfig["KmsDataKeyReusePeriodSeconds"]
-        };
-      }
+      const encryptionConfiguration = mapEncryptionConfiguration(
+        properties["EncryptionConfiguration"]
+      );
+      const loggingConfiguration = mapLoggingConfiguration(properties["LoggingConfiguration"]);
+      const tracingConfiguration = mapTracingConfiguration(properties["TracingConfiguration"]);
       const createParams = {
         name: stateMachineName,
         definition: definitionString,
         roleArn,
         type: properties["StateMachineType"],
-        loggingConfiguration: properties["LoggingConfiguration"],
-        tracingConfiguration: properties["TracingConfiguration"],
+        loggingConfiguration,
+        tracingConfiguration,
         tags,
         encryptionConfiguration
       };
@@ -24928,22 +24965,18 @@ var StepFunctionsProvider = class {
     this.logger.debug(`Updating Step Functions state machine ${logicalId}: ${physicalId}`);
     try {
       const definitionString = this.buildDefinitionString(properties);
-      const cfnEncConfig = properties["EncryptionConfiguration"];
-      let encryptionConfiguration;
-      if (cfnEncConfig) {
-        encryptionConfiguration = {
-          type: cfnEncConfig["Type"],
-          kmsKeyId: cfnEncConfig["KmsKeyId"],
-          kmsDataKeyReusePeriodSeconds: cfnEncConfig["KmsDataKeyReusePeriodSeconds"]
-        };
-      }
+      const encryptionConfiguration = mapEncryptionConfiguration(
+        properties["EncryptionConfiguration"]
+      );
+      const loggingConfiguration = mapLoggingConfiguration(properties["LoggingConfiguration"]);
+      const tracingConfiguration = mapTracingConfiguration(properties["TracingConfiguration"]);
       await this.getClient().send(
         new UpdateStateMachineCommand({
           stateMachineArn: physicalId,
           definition: definitionString,
           roleArn: properties["RoleArn"],
-          loggingConfiguration: properties["LoggingConfiguration"],
-          tracingConfiguration: properties["TracingConfiguration"],
+          loggingConfiguration,
+          tracingConfiguration,
           encryptionConfiguration
         })
       );
@@ -25231,6 +25264,57 @@ var StepFunctionsProvider = class {
     return "{}";
   }
 };
+function mapEncryptionConfiguration(value) {
+  if (value === null || value === void 0)
+    return void 0;
+  if (typeof value !== "object")
+    return void 0;
+  const cfg = value;
+  if (cfg["Type"] === void 0)
+    return void 0;
+  return {
+    type: cfg["Type"],
+    kmsKeyId: cfg["KmsKeyId"],
+    kmsDataKeyReusePeriodSeconds: cfg["KmsDataKeyReusePeriodSeconds"]
+  };
+}
+function mapLoggingConfiguration(value) {
+  if (value === null || value === void 0)
+    return void 0;
+  if (typeof value !== "object")
+    return void 0;
+  const cfg = value;
+  if (cfg["Level"] === void 0)
+    return void 0;
+  const result = {
+    level: cfg["Level"]
+  };
+  if (cfg["IncludeExecutionData"] !== void 0) {
+    result.includeExecutionData = cfg["IncludeExecutionData"];
+  }
+  if (Array.isArray(cfg["Destinations"])) {
+    result.destinations = cfg["Destinations"].map((d) => {
+      const cwLogs = d["CloudWatchLogsLogGroup"];
+      if (cwLogs?.["LogGroupArn"] !== void 0) {
+        return {
+          cloudWatchLogsLogGroup: { logGroupArn: cwLogs["LogGroupArn"] }
+        };
+      }
+      return {};
+    });
+  }
+  return result;
+}
+function mapTracingConfiguration(value) {
+  if (value === null || value === void 0)
+    return void 0;
+  if (typeof value !== "object")
+    return void 0;
+  const cfg = value;
+  if (cfg["Enabled"] === void 0)
+    return void 0;
+  return { enabled: cfg["Enabled"] };
+}
 
 // src/provisioning/providers/ecs-provider.ts
 import {
@@ -25583,23 +25667,14 @@ var ECSProvider = class {
       );
     }
   }
-  async updateTaskDefinition(logicalId, physicalId, resourceType, properties) {
-    this.logger.debug(`Updating ECS task definition ${logicalId}: ${physicalId}`);
-    const result = await this.createTaskDefinition(logicalId, resourceType, properties);
-    try {
-      const client = this.getClient();
-      await client.send(new DeregisterTaskDefinitionCommand({ taskDefinition: physicalId }));
-      this.logger.debug(`Deregistered old task definition revision: ${physicalId}`);
-    } catch (error) {
-      this.logger.debug(
-        `Failed to deregister old task definition ${physicalId}: ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    return {
-      physicalId: result.physicalId,
-      wasReplaced: false,
-      attributes: result.attributes ?? {}
-    };
+  async updateTaskDefinition(logicalId, _physicalId, _resourceType, _properties) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::ECS::TaskDefinition",
+        logicalId,
+        "TaskDefinition revisions are immutable; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   async deleteTaskDefinition(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting ECS task definition ${logicalId}: ${physicalId}`);
@@ -26138,11 +26213,19 @@ var ECSProvider = class {
     if (s.networkConfiguration)
       result["NetworkConfiguration"] = s.networkConfiguration;
     result["LoadBalancers"] = s.loadBalancers ?? [];
-    result["CapacityProviderStrategy"] = s.capacityProviderStrategy ?? [];
+    if (s.capacityProviderStrategy && s.capacityProviderStrategy.length > 0) {
+      result["CapacityProviderStrategy"] = s.capacityProviderStrategy;
+    } else if (!s.launchType) {
+      result["CapacityProviderStrategy"] = [];
+    }
     if (s.deploymentConfiguration)
       result["DeploymentConfiguration"] = s.deploymentConfiguration;
     result["PlacementConstraints"] = s.placementConstraints ?? [];
-    result["PlacementStrategy"] = s.placementStrategy ?? [];
+    if (s.launchType === "EC2" || s.launchType === "EXTERNAL") {
+      result["PlacementStrategy"] = s.placementStrategy ?? [];
+    } else if (s.placementStrategy && s.placementStrategy.length > 0) {
+      result["PlacementStrategy"] = s.placementStrategy;
+    }
     result["ServiceRegistries"] = s.serviceRegistries ?? [];
     const tags = normalizeAwsTagsToCfn(s.tags);
     result["Tags"] = tags;
@@ -29027,6 +29110,13 @@ import {
   UntagResourceCommand as UntagResourceCommand13,
   WAFNonexistentItemException
 } from "@aws-sdk/client-wafv2";
+function sanitizeDescription(value) {
+  if (value === void 0 || value === null)
+    return void 0;
+  if (typeof value === "string" && value.length === 0)
+    return void 0;
+  return value;
+}
 function parseWebACLArn(arn) {
   const parts = arn.split(":");
   const resourcePart = parts.slice(5).join(":");
@@ -29088,7 +29178,7 @@ var WAFv2WebACLProvider = class {
           Name: name,
           Scope: scope,
           DefaultAction: properties["DefaultAction"],
-          Description: properties["Description"],
+          Description: sanitizeDescription(properties["Description"]),
           Rules: properties["Rules"] || [],
           VisibilityConfig: properties["VisibilityConfig"],
           ...tags.length > 0 && { Tags: tags },
@@ -29153,7 +29243,7 @@ var WAFv2WebACLProvider = class {
           Id: id,
           LockToken: lockToken,
           DefaultAction: properties["DefaultAction"],
-          Description: properties["Description"],
+          Description: sanitizeDescription(properties["Description"]),
           Rules: properties["Rules"] || [],
           VisibilityConfig: properties["VisibilityConfig"],
           CustomResponseBodies: properties["CustomResponseBodies"],
@@ -29415,6 +29505,9 @@ import {
   ListTagsForResourceCommand as ListTagsForResourceCommand13,
   ResourceNotFoundException as ResourceNotFoundException12
 } from "@aws-sdk/client-cognito-identity-provider";
+function isEmptyObjectPlaceholder(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0;
+}
 var CognitoUserPoolProvider = class {
   cognitoClient;
   providerRegion = process.env["AWS_REGION"];
@@ -29616,7 +29709,7 @@ var CognitoUserPoolProvider = class {
       if (properties["EmailConfiguration"]) {
         updateParams.EmailConfiguration = properties["EmailConfiguration"];
       }
-      if (properties["SmsConfiguration"]) {
+      if (properties["SmsConfiguration"] && !isEmptyObjectPlaceholder(properties["SmsConfiguration"])) {
         updateParams.SmsConfiguration = properties["SmsConfiguration"];
       }
       if (properties["VerificationMessageTemplate"]) {
@@ -29625,19 +29718,19 @@ var CognitoUserPoolProvider = class {
       if (properties["DeviceConfiguration"]) {
         updateParams.DeviceConfiguration = properties["DeviceConfiguration"];
       }
-      if (properties["UserPoolAddOns"]) {
+      if (properties["UserPoolAddOns"] && !isEmptyObjectPlaceholder(properties["UserPoolAddOns"])) {
         updateParams.UserPoolAddOns = properties["UserPoolAddOns"];
       }
-      if (properties["EmailVerificationMessage"]) {
+      if (properties["EmailVerificationMessage"] !== void 0) {
         updateParams.EmailVerificationMessage = properties["EmailVerificationMessage"];
       }
-      if (properties["EmailVerificationSubject"]) {
+      if (properties["EmailVerificationSubject"] !== void 0) {
         updateParams.EmailVerificationSubject = properties["EmailVerificationSubject"];
       }
-      if (properties["SmsAuthenticationMessage"]) {
+      if (properties["SmsAuthenticationMessage"] !== void 0) {
         updateParams.SmsAuthenticationMessage = properties["SmsAuthenticationMessage"];
       }
-      if (properties["SmsVerificationMessage"]) {
+      if (properties["SmsVerificationMessage"] !== void 0) {
         updateParams.SmsVerificationMessage = properties["SmsVerificationMessage"];
       }
       await this.getClient().send(new UpdateUserPoolCommand(updateParams));
@@ -31000,6 +31093,24 @@ var ServiceDiscoveryProvider = class {
         return void 0;
     }
   }
+  /**
+   * Declare drift-unreadable property paths.
+   *
+   * - `AWS::ServiceDiscovery::PrivateDnsNamespace.Vpc`: Cloud Map's
+   *   `GetNamespace` does NOT return the VPC ID — it is only consumed at
+   *   create time and surfaced in opaque form via
+   *   `Properties.DnsProperties.HostedZoneId`. Without this declaration
+   *   the comparator would walk into `Vpc` (state has it because cdkd
+   *   stored the user-supplied template value) and report a guaranteed
+   *   false-positive on every clean drift run, since `readCurrentState`
+   *   deliberately omits the key.
+   */
+  getDriftUnknownPaths(resourceType) {
+    if (resourceType === "AWS::ServiceDiscovery::PrivateDnsNamespace") {
+      return ["Vpc"];
+    }
+    return [];
+  }
   async readNamespace(physicalId) {
     let ns;
     try {
@@ -31806,7 +31917,9 @@ var AppSyncProvider = class {
     if (ds.type !== void 0)
       result["Type"] = ds.type;
     result["Description"] = ds.description ?? "";
-    result["ServiceRoleArn"] = ds.serviceRoleArn ?? "";
+    if (ds.serviceRoleArn !== void 0 && ds.serviceRoleArn !== "") {
+      result["ServiceRoleArn"] = ds.serviceRoleArn;
+    }
     if (ds.dynamodbConfig) {
       const dynamo = {};
       if (ds.dynamodbConfig.tableName !== void 0)
@@ -31852,24 +31965,29 @@ var AppSyncProvider = class {
       result["TypeName"] = resolver.typeName;
     if (resolver.fieldName !== void 0)
       result["FieldName"] = resolver.fieldName;
-    result["DataSourceName"] = resolver.dataSourceName ?? "";
-    result["RequestMappingTemplate"] = resolver.requestMappingTemplate ?? "";
-    result["ResponseMappingTemplate"] = resolver.responseMappingTemplate ?? "";
     if (resolver.kind !== void 0)
       result["Kind"] = resolver.kind;
-    result["PipelineConfig"] = {
-      Functions: resolver.pipelineConfig?.functions ? [...resolver.pipelineConfig.functions] : []
-    };
-    {
-      const runtime = {};
-      if (resolver.runtime?.name !== void 0)
-        runtime["Name"] = resolver.runtime.name;
-      if (resolver.runtime?.runtimeVersion !== void 0) {
+    const kind = resolver.kind ?? "UNIT";
+    if (kind === "PIPELINE") {
+      result["PipelineConfig"] = {
+        Functions: resolver.pipelineConfig?.functions ? [...resolver.pipelineConfig.functions] : []
+      };
+    } else {
+      if (resolver.dataSourceName !== void 0 && resolver.dataSourceName !== "") {
+        result["DataSourceName"] = resolver.dataSourceName;
+      }
+    }
+    if (resolver.runtime?.name) {
+      result["Code"] = resolver.code ?? "";
+      const runtime = { Name: resolver.runtime.name };
+      if (resolver.runtime.runtimeVersion !== void 0) {
         runtime["RuntimeVersion"] = resolver.runtime.runtimeVersion;
       }
       result["Runtime"] = runtime;
+    } else {
+      result["RequestMappingTemplate"] = resolver.requestMappingTemplate ?? "";
+      result["ResponseMappingTemplate"] = resolver.responseMappingTemplate ?? "";
     }
-    result["Code"] = resolver.code ?? "";
     return result;
   }
   async readApiKey(physicalId) {
@@ -33232,6 +33350,11 @@ import {
   ListTagsForStreamCommand,
   ResourceNotFoundException as ResourceNotFoundException13
 } from "@aws-sdk/client-kinesis";
+function isKmsEncryption(value) {
+  if (!value)
+    return false;
+  return value["EncryptionType"] === "KMS";
+}
 var KinesisStreamProvider = class {
   client;
   providerRegion = process.env["AWS_REGION"];
@@ -33314,14 +33437,13 @@ var KinesisStreamProvider = class {
         await this.waitForStreamActive(streamName);
       }
       const streamEncryption = properties["StreamEncryption"];
-      if (streamEncryption) {
-        const encryptionType = streamEncryption["EncryptionType"] ?? "KMS";
+      if (isKmsEncryption(streamEncryption)) {
         const keyId = streamEncryption["KeyId"];
         this.logger.debug(`Enabling stream encryption for ${streamName}`);
         await this.getClient().send(
           new StartStreamEncryptionCommand({
             StreamName: streamName,
-            EncryptionType: encryptionType,
+            EncryptionType: "KMS",
             KeyId: keyId
           })
         );
@@ -33408,23 +33530,27 @@ var KinesisStreamProvider = class {
       );
       const newEncryption = properties["StreamEncryption"];
       const oldEncryption = previousProperties["StreamEncryption"];
-      if (JSON.stringify(newEncryption) !== JSON.stringify(oldEncryption)) {
-        if (oldEncryption) {
+      const oldIsKms = isKmsEncryption(oldEncryption);
+      const newIsKms = isKmsEncryption(newEncryption);
+      const oldKeyId = oldIsKms ? oldEncryption["KeyId"] : void 0;
+      const newKeyId = newIsKms ? newEncryption["KeyId"] : void 0;
+      if (oldIsKms !== newIsKms || oldIsKms && newIsKms && oldKeyId !== newKeyId) {
+        if (oldIsKms) {
           await this.getClient().send(
             new StopStreamEncryptionCommand({
               StreamName: physicalId,
-              EncryptionType: oldEncryption["EncryptionType"] ?? "KMS",
-              KeyId: oldEncryption["KeyId"]
+              EncryptionType: "KMS",
+              KeyId: oldKeyId
             })
           );
           await this.waitForStreamActive(physicalId);
         }
-        if (newEncryption) {
+        if (newIsKms) {
           await this.getClient().send(
             new StartStreamEncryptionCommand({
               StreamName: physicalId,
-              EncryptionType: newEncryption["EncryptionType"] ?? "KMS",
-              KeyId: newEncryption["KeyId"]
+              EncryptionType: "KMS",
+              KeyId: newKeyId
             })
           );
           await this.waitForStreamActive(physicalId);
@@ -33580,10 +33706,11 @@ var KinesisStreamProvider = class {
     const result = {};
     if (stream.StreamName !== void 0)
       result["Name"] = stream.StreamName;
-    if (stream.StreamModeDetails?.StreamMode !== void 0) {
-      result["StreamModeDetails"] = { StreamMode: stream.StreamModeDetails.StreamMode };
+    const streamMode = stream.StreamModeDetails?.StreamMode;
+    if (streamMode !== void 0) {
+      result["StreamModeDetails"] = { StreamMode: streamMode };
     }
-    if (stream.Shards && stream.Shards.length > 0) {
+    if (streamMode === "PROVISIONED" && stream.Shards && stream.Shards.length > 0) {
       result["ShardCount"] = stream.Shards.length;
     }
     if (stream.RetentionPeriodHours !== void 0) {
@@ -34798,14 +34925,14 @@ var FirehoseProvider = class {
       const tagsResp = await this.getClient().send(
         new ListTagsForDeliveryStreamCommand({ DeliveryStreamName: physicalId })
       );
-      const tags = normalizeAwsTagsToCfn(tagsResp.Tags);
-      result["Tags"] = tags;
+      result["Tags"] = normalizeAwsTagsToCfn(tagsResp.Tags);
     } catch (err) {
       if (err instanceof ResourceNotFoundException14)
         return void 0;
       this.logger.debug(
         `Firehose ListTagsForDeliveryStream(${physicalId}) failed: ${err instanceof Error ? err.message : String(err)}`
       );
+      result["Tags"] = [];
     }
     return result;
   }
@@ -35010,16 +35137,21 @@ var CloudTrailProvider = class {
   }
   async update(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating CloudTrail Trail ${logicalId}: ${physicalId}`);
+    const sanitizeArn = (v) => {
+      if (v === void 0 || v === null || v === "")
+        return void 0;
+      return v;
+    };
     const s3BucketName = properties["S3BucketName"];
     const s3KeyPrefix = properties["S3KeyPrefix"];
     const isMultiRegionTrail = properties["IsMultiRegionTrail"];
     const includeGlobalServiceEvents = properties["IncludeGlobalServiceEvents"];
     const enableLogFileValidation = properties["EnableLogFileValidation"];
     const isLogging = properties["IsLogging"];
-    const cloudWatchLogsLogGroupArn = properties["CloudWatchLogsLogGroupArn"];
-    const cloudWatchLogsRoleArn = properties["CloudWatchLogsRoleArn"];
-    const kmsKeyId = properties["KMSKeyId"];
-    const snsTopicName = properties["SnsTopicName"];
+    const cloudWatchLogsLogGroupArn = sanitizeArn(properties["CloudWatchLogsLogGroupArn"]);
+    const cloudWatchLogsRoleArn = sanitizeArn(properties["CloudWatchLogsRoleArn"]);
+    const kmsKeyId = sanitizeArn(properties["KMSKeyId"]);
+    const snsTopicName = sanitizeArn(properties["SnsTopicName"]);
     const isOrganizationTrail = properties["IsOrganizationTrail"];
     try {
       await this.getClient().send(
@@ -35216,58 +35348,48 @@ var CloudTrailProvider = class {
       result["TrailName"] = trail.Name;
     if (trail.S3BucketName !== void 0)
       result["S3BucketName"] = trail.S3BucketName;
-    if (trail.S3KeyPrefix !== void 0)
-      result["S3KeyPrefix"] = trail.S3KeyPrefix;
-    if (trail.IsMultiRegionTrail !== void 0) {
-      result["IsMultiRegionTrail"] = trail.IsMultiRegionTrail;
-    }
-    if (trail.IncludeGlobalServiceEvents !== void 0) {
-      result["IncludeGlobalServiceEvents"] = trail.IncludeGlobalServiceEvents;
-    }
-    if (trail.LogFileValidationEnabled !== void 0) {
-      result["EnableLogFileValidation"] = trail.LogFileValidationEnabled;
-    }
-    if (trail.CloudWatchLogsLogGroupArn !== void 0) {
+    result["S3KeyPrefix"] = trail.S3KeyPrefix ?? "";
+    result["IsMultiRegionTrail"] = trail.IsMultiRegionTrail ?? false;
+    result["IncludeGlobalServiceEvents"] = trail.IncludeGlobalServiceEvents ?? true;
+    result["EnableLogFileValidation"] = trail.LogFileValidationEnabled ?? false;
+    if (trail.CloudWatchLogsLogGroupArn && trail.CloudWatchLogsRoleArn) {
       result["CloudWatchLogsLogGroupArn"] = trail.CloudWatchLogsLogGroupArn;
-    }
-    if (trail.CloudWatchLogsRoleArn !== void 0) {
       result["CloudWatchLogsRoleArn"] = trail.CloudWatchLogsRoleArn;
     }
-    if (trail.KmsKeyId !== void 0)
-      result["KMSKeyId"] = trail.KmsKeyId;
-    if (trail.SnsTopicName !== void 0)
-      result["SnsTopicName"] = trail.SnsTopicName;
-    if (trail.IsOrganizationTrail !== void 0) {
-      result["IsOrganizationTrail"] = trail.IsOrganizationTrail;
-    }
+    result["KMSKeyId"] = trail.KmsKeyId ?? "";
+    result["SnsTopicName"] = trail.SnsTopicName ?? "";
+    result["IsOrganizationTrail"] = trail.IsOrganizationTrail ?? false;
     try {
       const status = await this.getClient().send(new GetTrailStatusCommand({ Name: physicalId }));
-      if (status.IsLogging !== void 0)
-        result["IsLogging"] = status.IsLogging;
+      result["IsLogging"] = status.IsLogging ?? false;
     } catch {
     }
     try {
       const sel = await this.getClient().send(
         new GetEventSelectorsCommand({ TrailName: physicalId })
       );
-      result["EventSelectors"] = (sel.EventSelectors ?? []).map(
-        (es) => es
-      );
+      const hasAdvanced = Array.isArray(sel.AdvancedEventSelectors) && sel.AdvancedEventSelectors.length > 0;
+      if (!hasAdvanced) {
+        result["EventSelectors"] = (sel.EventSelectors ?? []).map(
+          (es) => es
+        );
+      }
     } catch {
     }
+    let tags = [];
     if (trail.TrailARN) {
       try {
         const tagsResp = await this.getClient().send(
           new ListTagsCommand3({ ResourceIdList: [trail.TrailARN] })
         );
-        const tags = normalizeAwsTagsToCfn(tagsResp.ResourceTagList?.[0]?.TagsList);
-        result["Tags"] = tags;
+        tags = normalizeAwsTagsToCfn(tagsResp.ResourceTagList?.[0]?.TagsList);
       } catch (err) {
         this.logger.debug(
           `CloudTrail ListTags(${trail.TrailARN}) failed: ${err instanceof Error ? err.message : String(err)}`
         );
       }
     }
+    result["Tags"] = tags;
     return result;
   }
   async import(input) {
@@ -35398,7 +35520,12 @@ var CodeBuildProvider = class {
     const name = properties["Name"] ?? logicalId;
     const source = properties["Source"];
     const environment = properties["Environment"];
-    const serviceRole = properties["ServiceRole"];
+    const sanitizeOptionalString = (value) => {
+      if (typeof value !== "string")
+        return value;
+      return value === "" ? void 0 : value;
+    };
+    const serviceRole = sanitizeOptionalString(properties["ServiceRole"]);
     const artifacts = properties["Artifacts"];
     const tags = properties["Tags"];
     const envVars = environment?.["EnvironmentVariables"];
@@ -35489,7 +35616,7 @@ var CodeBuildProvider = class {
       description: properties["Description"],
       timeoutInMinutes: properties["TimeoutInMinutes"],
       queuedTimeoutInMinutes: properties["QueuedTimeoutInMinutes"],
-      encryptionKey: properties["EncryptionKey"],
+      encryptionKey: sanitizeOptionalString(properties["EncryptionKey"]),
       cache: cache2,
       vpcConfig,
       logsConfig,
@@ -35500,7 +35627,7 @@ var CodeBuildProvider = class {
       fileSystemLocations,
       buildBatchConfig,
       badgeEnabled: properties["BadgeEnabled"],
-      sourceVersion: properties["SourceVersion"]
+      sourceVersion: sanitizeOptionalString(properties["SourceVersion"])
     };
   }
   async create(logicalId, resourceType, properties) {
@@ -35954,10 +36081,11 @@ var S3VectorsProvider = class {
     }
     if (bucket?.encryptionConfiguration) {
       const enc = {};
-      if (bucket.encryptionConfiguration.sseType !== void 0) {
-        enc["SSEType"] = bucket.encryptionConfiguration.sseType;
+      const sseType = bucket.encryptionConfiguration.sseType;
+      if (sseType !== void 0) {
+        enc["SSEType"] = sseType;
       }
-      if (bucket.encryptionConfiguration.kmsKeyArn !== void 0) {
+      if (sseType === "aws:kms" && bucket.encryptionConfiguration.kmsKeyArn !== void 0) {
         enc["KMSKeyArn"] = bucket.encryptionConfiguration.kmsKeyArn;
       }
       if (Object.keys(enc).length > 0)
@@ -36982,7 +37110,9 @@ var S3TablesProvider = class {
 import {
   ECRClient as ECRClient2,
   CreateRepositoryCommand,
+  DeleteLifecyclePolicyCommand,
   DeleteRepositoryCommand,
+  DeleteRepositoryPolicyCommand,
   DescribeRepositoriesCommand,
   GetLifecyclePolicyCommand,
   PutLifecyclePolicyCommand,
@@ -37132,19 +37262,42 @@ var ECRProvider = class {
             })
           );
           this.logger.debug(`Updated lifecycle policy for ${physicalId}`);
+        } else if (oldLifecycle?.LifecyclePolicyText) {
+          try {
+            await this.getClient().send(
+              new DeleteLifecyclePolicyCommand({ repositoryName: physicalId })
+            );
+            this.logger.debug(`Deleted lifecycle policy for ${physicalId}`);
+          } catch (err) {
+            if (!(err instanceof LifecyclePolicyNotFoundException))
+              throw err;
+          }
         }
       }
       const newPolicy = properties["RepositoryPolicyText"];
       const oldPolicy = previousProperties["RepositoryPolicyText"];
-      if (JSON.stringify(newPolicy) !== JSON.stringify(oldPolicy) && newPolicy) {
-        const policyText = typeof newPolicy === "string" ? newPolicy : JSON.stringify(newPolicy);
-        await this.getClient().send(
-          new SetRepositoryPolicyCommand({
-            repositoryName: physicalId,
-            policyText
-          })
-        );
-        this.logger.debug(`Updated repository policy for ${physicalId}`);
+      if (JSON.stringify(newPolicy) !== JSON.stringify(oldPolicy)) {
+        if (newPolicy !== void 0 && newPolicy !== null && newPolicy !== "") {
+          const policyText = typeof newPolicy === "string" ? newPolicy : JSON.stringify(newPolicy);
+          await this.getClient().send(
+            new SetRepositoryPolicyCommand({
+              repositoryName: physicalId,
+              policyText
+            })
+          );
+          this.logger.debug(`Updated repository policy for ${physicalId}`);
+        } else if (oldPolicy !== void 0 && oldPolicy !== null && oldPolicy !== "") {
+          try {
+            await this.getClient().send(
+              new DeleteRepositoryPolicyCommand({ repositoryName: physicalId })
+            );
+            this.logger.debug(`Deleted repository policy for ${physicalId}`);
+          } catch (err) {
+            const code = err?.name ?? err?.__type ?? "";
+            if (!code.includes("RepositoryPolicyNotFound"))
+              throw err;
+          }
+        }
       }
       const newTags = properties["Tags"];
       const oldTags = previousProperties["Tags"];
@@ -37275,10 +37428,9 @@ var ECRProvider = class {
       ScanOnPush: r.imageScanningConfiguration?.scanOnPush ?? false
     };
     {
-      const enc = {
-        EncryptionType: r.encryptionConfiguration?.encryptionType ?? "AES256"
-      };
-      if (r.encryptionConfiguration?.kmsKey !== void 0) {
+      const encType = r.encryptionConfiguration?.encryptionType ?? "AES256";
+      const enc = { EncryptionType: encType };
+      if (encType === "KMS" && r.encryptionConfiguration?.kmsKey) {
         enc["KmsKey"] = r.encryptionConfiguration.kmsKey;
       }
       result["EncryptionConfiguration"] = enc;
@@ -43737,7 +43889,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.50.10");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.50.12");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());