@go-to-k/cdkd 0.50.9 → 0.50.11

package/dist/cli.js

@@ -19412,7 +19412,11 @@ var EC2Provider = class {
       case "AWS::EC2::NetworkAcl":
       case "AWS::EC2::NetworkAclEntry":
       case "AWS::EC2::SubnetNetworkAclAssociation":
-        return { physicalId, wasReplaced: false };
+        throw new ResourceUpdateNotSupportedError(
+          resourceType,
+          logicalId,
+          "destroy + redeploy. The property surface for this resource type is effectively immutable in cdkd today."
+        );
       default:
         throw new ProvisioningError(
           `Unsupported resource type: ${resourceType}`,
@@ -19557,21 +19561,28 @@ var EC2Provider = class {
   async updateVpc(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating VPC ${logicalId}: ${physicalId}`);
     try {
-      if (properties["EnableDnsHostnames"] !== void 0) {
-        const value = properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true";
+      const asBool = (v) => {
+        if (v === void 0)
+          return void 0;
+        return v === true || v === "true";
+      };
+      const newDnsHostnames = asBool(properties["EnableDnsHostnames"]);
+      const oldDnsHostnames = asBool(previousProperties["EnableDnsHostnames"]);
+      if (newDnsHostnames !== void 0 && newDnsHostnames !== oldDnsHostnames) {
         await this.ec2Client.send(
           new ModifyVpcAttributeCommand({
             VpcId: physicalId,
-            EnableDnsHostnames: { Value: value }
+            EnableDnsHostnames: { Value: newDnsHostnames }
           })
         );
       }
-      if (properties["EnableDnsSupport"] !== void 0) {
-        const value = properties["EnableDnsSupport"] === true || properties["EnableDnsSupport"] === "true";
+      const newDnsSupport = asBool(properties["EnableDnsSupport"]);
+      const oldDnsSupport = asBool(previousProperties["EnableDnsSupport"]);
+      if (newDnsSupport !== void 0 && newDnsSupport !== oldDnsSupport) {
         await this.ec2Client.send(
           new ModifyVpcAttributeCommand({
             VpcId: physicalId,
-            EnableDnsSupport: { Value: value }
+            EnableDnsSupport: { Value: newDnsSupport }
           })
         );
       }
@@ -19754,8 +19765,13 @@ var EC2Provider = class {
     }
   }
   updateSubnet(logicalId, physicalId) {
-    this.logger.debug(`Updating Subnet ${logicalId}: ${physicalId} (no-op, immutable properties)`);
-    return Promise.resolve({ physicalId, wasReplaced: false });
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::EC2::Subnet",
+        logicalId,
+        "destroy + redeploy the Subnet (and the resources that depend on it). Subnet properties are immutable in AWS."
+      )
+    );
   }
   async deleteSubnet(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting Subnet ${logicalId}: ${physicalId}`);
@@ -19890,8 +19906,13 @@ var EC2Provider = class {
     }
   }
   updateInternetGateway(logicalId, physicalId) {
-    this.logger.debug(`Updating InternetGateway ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({ physicalId, wasReplaced: false });
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::EC2::InternetGateway",
+        logicalId,
+        "destroy + redeploy the InternetGateway. IGW properties are immutable in AWS."
+      )
+    );
   }
   async deleteInternetGateway(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting InternetGateway ${logicalId}: ${physicalId}`);
@@ -19960,8 +19981,13 @@ var EC2Provider = class {
     }
   }
   updateVpcGatewayAttachment(logicalId, physicalId) {
-    this.logger.debug(`Updating VPCGatewayAttachment ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({ physicalId, wasReplaced: false });
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::EC2::VPCGatewayAttachment",
+        logicalId,
+        "destroy + redeploy the VPCGatewayAttachment. The (VpcId, InternetGatewayId) pair is immutable."
+      )
+    );
   }
   async deleteVpcGatewayAttachment(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting VPCGatewayAttachment ${logicalId}: ${physicalId}`);
@@ -20076,8 +20102,13 @@ var EC2Provider = class {
     }
   }
   updateNatGateway(logicalId, physicalId) {
-    this.logger.debug(`Updating NatGateway ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({ physicalId, wasReplaced: false });
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::EC2::NatGateway",
+        logicalId,
+        "destroy + redeploy the NatGateway (and the dependent Routes). NAT Gateway properties are immutable in AWS."
+      )
+    );
   }
   async deleteNatGateway(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting NatGateway ${logicalId}: ${physicalId}`);
@@ -20152,8 +20183,13 @@ var EC2Provider = class {
     }
   }
   updateRouteTable(logicalId, physicalId) {
-    this.logger.debug(`Updating RouteTable ${logicalId}: ${physicalId} (no-op)`);
-    return Promise.resolve({ physicalId, wasReplaced: false });
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::EC2::RouteTable",
+        logicalId,
+        "destroy + redeploy the RouteTable (and its associated Routes / SubnetRouteTableAssociations). VpcId is immutable."
+      )
+    );
   }
   async deleteRouteTable(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting RouteTable ${logicalId}: ${physicalId}`);
@@ -20228,8 +20264,11 @@ var EC2Provider = class {
       );
     }
   }
-  async updateRoute(logicalId, physicalId, resourceType, properties, _previousProperties) {
+  async updateRoute(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating Route ${logicalId}: ${physicalId}`);
+    if (JSON.stringify(properties) === JSON.stringify(previousProperties)) {
+      return { physicalId, wasReplaced: false };
+    }
     try {
       await this.deleteRoute(logicalId, physicalId, resourceType);
       const createResult = await this.createRoute(logicalId, resourceType, properties);
@@ -20332,10 +20371,13 @@ var EC2Provider = class {
     }
   }
   updateSubnetRouteTableAssociation(logicalId, physicalId) {
-    this.logger.debug(
-      `Updating SubnetRouteTableAssociation ${logicalId}: ${physicalId} (no-op, requires replacement)`
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::EC2::SubnetRouteTableAssociation",
+        logicalId,
+        "destroy + redeploy the association. (SubnetId, RouteTableId) is immutable."
+      )
     );
-    return Promise.resolve({ physicalId, wasReplaced: false });
   }
   async deleteSubnetRouteTableAssociation(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting SubnetRouteTableAssociation ${logicalId}: ${physicalId}`);
@@ -20633,6 +20675,9 @@ var EC2Provider = class {
   }
   async updateSecurityGroupIngress(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating SecurityGroupIngress ${logicalId}: ${physicalId}`);
+    if (JSON.stringify(properties) === JSON.stringify(previousProperties)) {
+      return { physicalId, wasReplaced: false };
+    }
     try {
       await this.deleteSecurityGroupIngress(
         logicalId,
@@ -21943,7 +21988,7 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
    * the IAM trust relationship hasn't fully propagated yet.
    */
   async updateAccountWithRetry(cloudWatchRoleArn, logicalId, _resourceType) {
-    const patchOperations = cloudWatchRoleArn ? [
+    const patchOperations = cloudWatchRoleArn !== void 0 ? [
       {
         op: "replace",
         path: "/cloudwatchRoleArn",
@@ -22887,7 +22932,10 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
       if (resp.authorizationType !== void 0) {
         result["AuthorizationType"] = resp.authorizationType;
       }
-      result["AuthorizerId"] = resp.authorizerId ?? "";
+      const authType = resp.authorizationType;
+      if (authType === "CUSTOM" || authType === "COGNITO_USER_POOLS") {
+        result["AuthorizerId"] = resp.authorizerId ?? "";
+      }
       result["Integration"] = resp.methodIntegration ?? {};
       result["MethodResponses"] = resp.methodResponses ?? {};
       return result;
@@ -23523,7 +23571,12 @@ var ApiGatewayV2Provider = class {
       if (resp.ProtocolType !== void 0)
         result["ProtocolType"] = resp.ProtocolType;
       result["Description"] = resp.Description ?? "";
-      result["CorsConfiguration"] = resp.CorsConfiguration ?? {};
+      if (resp.ProtocolType === "HTTP") {
+        result["CorsConfiguration"] = resp.CorsConfiguration ?? {};
+      }
+      if (resp.ProtocolType === "WEBSOCKET" && resp.RouteSelectionExpression !== void 0) {
+        result["RouteSelectionExpression"] = resp.RouteSelectionExpression;
+      }
       const tags = normalizeAwsTagsToCfn(resp.Tags);
       result["Tags"] = tags;
       return result;
@@ -23564,7 +23617,10 @@ var ApiGatewayV2Provider = class {
       const result = { ApiId: apiId };
       if (resp.IntegrationType !== void 0)
         result["IntegrationType"] = resp.IntegrationType;
-      result["IntegrationUri"] = resp.IntegrationUri ?? "";
+      const uriRequired = resp.IntegrationType === "AWS" || resp.IntegrationType === "AWS_PROXY" || resp.IntegrationType === "HTTP" || resp.IntegrationType === "HTTP_PROXY";
+      if (uriRequired) {
+        result["IntegrationUri"] = resp.IntegrationUri ?? "";
+      }
       result["IntegrationMethod"] = resp.IntegrationMethod ?? "";
       result["PayloadFormatVersion"] = resp.PayloadFormatVersion ?? "";
       return result;
@@ -23586,8 +23642,11 @@ var ApiGatewayV2Provider = class {
       if (resp.RouteKey !== void 0)
         result["RouteKey"] = resp.RouteKey;
       result["Target"] = resp.Target ?? "";
-      result["AuthorizationType"] = resp.AuthorizationType ?? "";
-      result["AuthorizerId"] = resp.AuthorizerId ?? "";
+      result["AuthorizationType"] = resp.AuthorizationType ?? "NONE";
+      if (resp.AuthorizationType && resp.AuthorizationType !== "NONE") {
+        result["AuthorizerId"] = resp.AuthorizerId ?? "";
+        result["AuthorizationScopes"] = resp.AuthorizationScopes ? [...resp.AuthorizationScopes] : [];
+      }
       return result;
     } catch (err) {
       if (err instanceof NotFoundException4)
@@ -23608,9 +23667,12 @@ var ApiGatewayV2Provider = class {
         result["AuthorizerType"] = resp.AuthorizerType;
       result["Name"] = resp.Name ?? "";
       result["IdentitySource"] = resp.IdentitySource ? [...resp.IdentitySource] : [];
-      result["JwtConfiguration"] = resp.JwtConfiguration ?? {};
-      result["AuthorizerUri"] = resp.AuthorizerUri ?? "";
-      result["AuthorizerPayloadFormatVersion"] = resp.AuthorizerPayloadFormatVersion ?? "";
+      if (resp.AuthorizerType === "JWT") {
+        result["JwtConfiguration"] = resp.JwtConfiguration ?? {};
+      } else if (resp.AuthorizerType === "REQUEST") {
+        result["AuthorizerUri"] = resp.AuthorizerUri ?? "";
+        result["AuthorizerPayloadFormatVersion"] = resp.AuthorizerPayloadFormatVersion ?? "";
+      }
       return result;
     } catch (err) {
       if (err instanceof NotFoundException4)
@@ -23906,6 +23968,24 @@ var CloudFrontOAIProvider = class {
       throw err;
     }
   }
+  /**
+   * State property paths the comparator must skip during drift detection.
+   *
+   * `CloudFrontOriginAccessIdentityConfig.CallerReference` is set by cdkd
+   * to `logicalId` at create time regardless of what the CDK template
+   * specified, so it ends up in `state.properties` (from the resolved
+   * template) but is intentionally not surfaced by `readCurrentState`. A
+   * keys-from-state walk would otherwise compare `state.CallerReference`
+   * against `aws=undefined` and fire a guaranteed false positive on every
+   * clean run for any stack whose template templated CallerReference.
+   *
+   * The field is also immutable in AWS — the OAI's CallerReference cannot
+   * change post-create — so omitting it from drift is also semantically
+   * correct.
+   */
+  getDriftUnknownPaths() {
+    return ["CloudFrontOriginAccessIdentityConfig.CallerReference"];
+  }
   /**
    * Adopt an existing CloudFront Origin Access Identity into cdkd state.
    *
@@ -25520,23 +25600,14 @@ var ECSProvider = class {
       );
     }
   }
-  async updateTaskDefinition(logicalId, physicalId, resourceType, properties) {
-    this.logger.debug(`Updating ECS task definition ${logicalId}: ${physicalId}`);
-    const result = await this.createTaskDefinition(logicalId, resourceType, properties);
-    try {
-      const client = this.getClient();
-      await client.send(new DeregisterTaskDefinitionCommand({ taskDefinition: physicalId }));
-      this.logger.debug(`Deregistered old task definition revision: ${physicalId}`);
-    } catch (error) {
-      this.logger.debug(
-        `Failed to deregister old task definition ${physicalId}: ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    return {
-      physicalId: result.physicalId,
-      wasReplaced: false,
-      attributes: result.attributes ?? {}
-    };
+  async updateTaskDefinition(logicalId, _physicalId, _resourceType, _properties) {
+    return Promise.reject(
+      new ResourceUpdateNotSupportedError(
+        "AWS::ECS::TaskDefinition",
+        logicalId,
+        "TaskDefinition revisions are immutable; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+      )
+    );
   }
   async deleteTaskDefinition(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting ECS task definition ${logicalId}: ${physicalId}`);
@@ -26075,11 +26146,19 @@ var ECSProvider = class {
     if (s.networkConfiguration)
       result["NetworkConfiguration"] = s.networkConfiguration;
     result["LoadBalancers"] = s.loadBalancers ?? [];
-    result["CapacityProviderStrategy"] = s.capacityProviderStrategy ?? [];
+    if (s.capacityProviderStrategy && s.capacityProviderStrategy.length > 0) {
+      result["CapacityProviderStrategy"] = s.capacityProviderStrategy;
+    } else if (!s.launchType) {
+      result["CapacityProviderStrategy"] = [];
+    }
     if (s.deploymentConfiguration)
       result["DeploymentConfiguration"] = s.deploymentConfiguration;
     result["PlacementConstraints"] = s.placementConstraints ?? [];
-    result["PlacementStrategy"] = s.placementStrategy ?? [];
+    if (s.launchType === "EC2" || s.launchType === "EXTERNAL") {
+      result["PlacementStrategy"] = s.placementStrategy ?? [];
+    } else if (s.placementStrategy && s.placementStrategy.length > 0) {
+      result["PlacementStrategy"] = s.placementStrategy;
+    }
     result["ServiceRegistries"] = s.serviceRegistries ?? [];
     const tags = normalizeAwsTagsToCfn(s.tags);
     result["Tags"] = tags;
@@ -26549,7 +26628,8 @@ var ELBv2Provider = class {
   async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties) {
     this.logger.debug(`Updating TargetGroup ${logicalId}: ${physicalId}`);
     try {
-      const matcher = properties["Matcher"];
+      const rawMatcher = properties["Matcher"];
+      const matcher = rawMatcher && (rawMatcher.HttpCode !== void 0 || rawMatcher.GrpcCode !== void 0) ? rawMatcher : void 0;
       await this.getClient().send(
         new ModifyTargetGroupCommand({
           TargetGroupArn: physicalId,
@@ -28527,7 +28607,7 @@ var Route53Provider = class {
       }
     }
     const setIdentifier = properties["SetIdentifier"];
-    if (setIdentifier) {
+    if (setIdentifier !== void 0) {
       recordSet.SetIdentifier = setIdentifier;
     }
     const weight = properties["Weight"];
@@ -28535,11 +28615,11 @@ var Route53Provider = class {
       recordSet.Weight = Number(weight);
     }
     const region = properties["Region"];
-    if (region) {
+    if (region !== void 0) {
       recordSet.Region = region;
     }
     const failover = properties["Failover"];
-    if (failover) {
+    if (failover !== void 0) {
       recordSet.Failover = failover;
     }
     const multiValueAnswer = properties["MultiValueAnswer"];
@@ -28547,15 +28627,15 @@ var Route53Provider = class {
       recordSet.MultiValueAnswer = typeof multiValueAnswer === "string" ? multiValueAnswer.toLowerCase() === "true" : multiValueAnswer;
     }
     const healthCheckId = properties["HealthCheckId"];
-    if (healthCheckId) {
+    if (healthCheckId !== void 0) {
       recordSet.HealthCheckId = healthCheckId;
     }
     const geoLocation = properties["GeoLocation"];
     if (geoLocation) {
       recordSet.GeoLocation = {
-        ...geoLocation["ContinentCode"] ? { ContinentCode: geoLocation["ContinentCode"] } : {},
-        ...geoLocation["CountryCode"] ? { CountryCode: geoLocation["CountryCode"] } : {},
-        ...geoLocation["SubdivisionCode"] ? { SubdivisionCode: geoLocation["SubdivisionCode"] } : {}
+        ...geoLocation["ContinentCode"] !== void 0 ? { ContinentCode: geoLocation["ContinentCode"] } : {},
+        ...geoLocation["CountryCode"] !== void 0 ? { CountryCode: geoLocation["CountryCode"] } : {},
+        ...geoLocation["SubdivisionCode"] !== void 0 ? { SubdivisionCode: geoLocation["SubdivisionCode"] } : {}
       };
     }
     return recordSet;
@@ -28785,14 +28865,16 @@ var Route53Provider = class {
       }
       result["HostedZoneConfig"] = cfg;
     }
-    result["VPCs"] = (resp.VPCs ?? []).map((v) => {
-      const out = {};
-      if (v.VPCId !== void 0)
-        out["VPCId"] = v.VPCId;
-      if (v.VPCRegion !== void 0)
-        out["VPCRegion"] = v.VPCRegion;
-      return out;
-    });
+    if (resp.HostedZone.Config?.PrivateZone === true) {
+      result["VPCs"] = (resp.VPCs ?? []).map((v) => {
+        const out = {};
+        if (v.VPCId !== void 0)
+          out["VPCId"] = v.VPCId;
+        if (v.VPCRegion !== void 0)
+          out["VPCRegion"] = v.VPCRegion;
+        return out;
+      });
+    }
     const idTail = physicalId.replace(/^\/hostedzone\//, "");
     try {
       const tagsResp = await this.getClient().send(
@@ -28837,9 +28919,11 @@ var Route53Provider = class {
       Name: name,
       Type: type
     };
-    if (recordSet.TTL !== void 0)
-      result["TTL"] = recordSet.TTL;
-    result["ResourceRecords"] = (recordSet.ResourceRecords ?? []).map((r) => r.Value).filter((v) => typeof v === "string");
+    if (!recordSet.AliasTarget) {
+      if (recordSet.TTL !== void 0)
+        result["TTL"] = recordSet.TTL;
+      result["ResourceRecords"] = (recordSet.ResourceRecords ?? []).map((r) => r.Value).filter((v) => typeof v === "string");
+    }
     if (recordSet.AliasTarget) {
       const at = {};
       if (recordSet.AliasTarget.HostedZoneId !== void 0) {
@@ -31738,7 +31822,9 @@ var AppSyncProvider = class {
     if (ds.type !== void 0)
       result["Type"] = ds.type;
     result["Description"] = ds.description ?? "";
-    result["ServiceRoleArn"] = ds.serviceRoleArn ?? "";
+    if (ds.serviceRoleArn !== void 0 && ds.serviceRoleArn !== "") {
+      result["ServiceRoleArn"] = ds.serviceRoleArn;
+    }
     if (ds.dynamodbConfig) {
       const dynamo = {};
       if (ds.dynamodbConfig.tableName !== void 0)
@@ -31784,24 +31870,29 @@ var AppSyncProvider = class {
       result["TypeName"] = resolver.typeName;
     if (resolver.fieldName !== void 0)
       result["FieldName"] = resolver.fieldName;
-    result["DataSourceName"] = resolver.dataSourceName ?? "";
-    result["RequestMappingTemplate"] = resolver.requestMappingTemplate ?? "";
-    result["ResponseMappingTemplate"] = resolver.responseMappingTemplate ?? "";
     if (resolver.kind !== void 0)
       result["Kind"] = resolver.kind;
-    result["PipelineConfig"] = {
-      Functions: resolver.pipelineConfig?.functions ? [...resolver.pipelineConfig.functions] : []
-    };
-    {
-      const runtime = {};
-      if (resolver.runtime?.name !== void 0)
-        runtime["Name"] = resolver.runtime.name;
-      if (resolver.runtime?.runtimeVersion !== void 0) {
+    const kind = resolver.kind ?? "UNIT";
+    if (kind === "PIPELINE") {
+      result["PipelineConfig"] = {
+        Functions: resolver.pipelineConfig?.functions ? [...resolver.pipelineConfig.functions] : []
+      };
+    } else {
+      if (resolver.dataSourceName !== void 0 && resolver.dataSourceName !== "") {
+        result["DataSourceName"] = resolver.dataSourceName;
+      }
+    }
+    if (resolver.runtime?.name) {
+      result["Code"] = resolver.code ?? "";
+      const runtime = { Name: resolver.runtime.name };
+      if (resolver.runtime.runtimeVersion !== void 0) {
         runtime["RuntimeVersion"] = resolver.runtime.runtimeVersion;
       }
       result["Runtime"] = runtime;
+    } else {
+      result["RequestMappingTemplate"] = resolver.requestMappingTemplate ?? "";
+      result["ResponseMappingTemplate"] = resolver.responseMappingTemplate ?? "";
     }
-    result["Code"] = resolver.code ?? "";
     return result;
   }
   async readApiKey(physicalId) {
@@ -36914,7 +37005,9 @@ var S3TablesProvider = class {
 import {
   ECRClient as ECRClient2,
   CreateRepositoryCommand,
+  DeleteLifecyclePolicyCommand,
   DeleteRepositoryCommand,
+  DeleteRepositoryPolicyCommand,
   DescribeRepositoriesCommand,
   GetLifecyclePolicyCommand,
   PutLifecyclePolicyCommand,
@@ -37064,19 +37157,42 @@ var ECRProvider = class {
             })
           );
           this.logger.debug(`Updated lifecycle policy for ${physicalId}`);
+        } else if (oldLifecycle?.LifecyclePolicyText) {
+          try {
+            await this.getClient().send(
+              new DeleteLifecyclePolicyCommand({ repositoryName: physicalId })
+            );
+            this.logger.debug(`Deleted lifecycle policy for ${physicalId}`);
+          } catch (err) {
+            if (!(err instanceof LifecyclePolicyNotFoundException))
+              throw err;
+          }
         }
       }
       const newPolicy = properties["RepositoryPolicyText"];
       const oldPolicy = previousProperties["RepositoryPolicyText"];
-      if (JSON.stringify(newPolicy) !== JSON.stringify(oldPolicy) && newPolicy) {
-        const policyText = typeof newPolicy === "string" ? newPolicy : JSON.stringify(newPolicy);
-        await this.getClient().send(
-          new SetRepositoryPolicyCommand({
-            repositoryName: physicalId,
-            policyText
-          })
-        );
-        this.logger.debug(`Updated repository policy for ${physicalId}`);
+      if (JSON.stringify(newPolicy) !== JSON.stringify(oldPolicy)) {
+        if (newPolicy !== void 0 && newPolicy !== null && newPolicy !== "") {
+          const policyText = typeof newPolicy === "string" ? newPolicy : JSON.stringify(newPolicy);
+          await this.getClient().send(
+            new SetRepositoryPolicyCommand({
+              repositoryName: physicalId,
+              policyText
+            })
+          );
+          this.logger.debug(`Updated repository policy for ${physicalId}`);
+        } else if (oldPolicy !== void 0 && oldPolicy !== null && oldPolicy !== "") {
+          try {
+            await this.getClient().send(
+              new DeleteRepositoryPolicyCommand({ repositoryName: physicalId })
+            );
+            this.logger.debug(`Deleted repository policy for ${physicalId}`);
+          } catch (err) {
+            const code = err?.name ?? err?.__type ?? "";
+            if (!code.includes("RepositoryPolicyNotFound"))
+              throw err;
+          }
+        }
       }
       const newTags = properties["Tags"];
       const oldTags = previousProperties["Tags"];
@@ -37207,10 +37323,9 @@ var ECRProvider = class {
       ScanOnPush: r.imageScanningConfiguration?.scanOnPush ?? false
     };
     {
-      const enc = {
-        EncryptionType: r.encryptionConfiguration?.encryptionType ?? "AES256"
-      };
-      if (r.encryptionConfiguration?.kmsKey !== void 0) {
+      const encType = r.encryptionConfiguration?.encryptionType ?? "AES256";
+      const enc = { EncryptionType: encType };
+      if (encType === "KMS" && r.encryptionConfiguration?.kmsKey) {
         enc["KmsKey"] = r.encryptionConfiguration.kmsKey;
       }
       result["EncryptionConfiguration"] = enc;
@@ -43669,7 +43784,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.50.9");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.50.11");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());