Rebase onto v1.4.1 (AL2023 base)

ATTRIBUTION.md

@@ -60,6 +60,7 @@ Subdependencies:
 * `k8s.io/klog/v2`
 * `k8s.io/utils`
 * `sigs.k8s.io/controller-runtime`
+* `sigs.k8s.io/yaml`
 * `github.com/aws/aws-sdk-go-v2/feature/ec2/imds`
 * `github.com/aws/aws-sdk-go-v2/internal/configsources`
 * `github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`
@@ -115,7 +116,6 @@ Subdependencies:
 * `sigs.k8s.io/json`
 * `sigs.k8s.io/randfill`
 * `sigs.k8s.io/structured-merge-diff/v6`
-* `sigs.k8s.io/yaml`
 
 #### github.com/aws/aws-sdk-go-v2
 
@@ -383,6 +383,10 @@ License Identifier: Apache-2.0
 
 License Identifier: Apache-2.0
 
+#### sigs.k8s.io/yaml
+
+License Identifier: Apache-2.0
+
 #### github.com/aws/aws-sdk-go-v2/feature/ec2/imds
 
 License Identifier: Apache-2.0
@@ -1525,10 +1529,6 @@ License Identifier: Apache-2.0
 
 License Identifier: Apache-2.0
 
-#### sigs.k8s.io/yaml
-
-License Identifier: Apache-2.0
-
 ### github.com/aws/aws-sdk-go
 
 License Identifier: Apache-2.0

apis/v1alpha1/ack-generate-metadata.yaml

@@ -1,8 +1,8 @@
 ack_generate_info:
-  build_date: "2026-06-22T22:54:02Z"
-  build_hash: 2ae5d2cfadaa2a10b2ccb9e73a111b2a91c36642
-  go_version: go1.26.4
-  version: v0.60.0
+  build_date: "2026-08-13T00:58:05Z"
+  build_hash: 65d45b2e6c9efd6aca20e0d36826d1e18e4ba2b7
+  go_version: go1.26.5
+  version: v0.62.1
 api_directory_checksum: f0678a236e7f3f6ad06bc5de36a7678d0084aeac
 api_version: v1alpha1
 aws_sdk_go_version: v1.32.6

apis/v1alpha1/generator.yaml

@@ -35,12 +35,16 @@ resources:
           output_fields:
             TargetShardCount: ShardCount
     hooks:
+      delta_pre_compare:
+        template_path: hooks/stream/delta_pre_compare.go.tpl
       sdk_read_one_post_set_output:
         template_path: hooks/stream/sdk_read_one_post_set_output.go.tpl
       sdk_update_post_set_output:
         template_path: hooks/stream/sdk_update_post_set_output.go.tpl
       sdk_create_post_set_output:
         template_path: hooks/stream/sdk_create_post_set_output.go.tpl
+      sdk_create_post_build_request:
+        template_path: hooks/stream/sdk_create_post_build_request.go.tpl
       sdk_update_pre_build_request:
         template_path: hooks/stream/sdk_update_pre_build_request.go.tpl
     exceptions:
@@ -54,6 +58,67 @@ resources:
           path: Tags
       Name:
         is_primary_key: true
+      ResourcePolicy:
+        from:
+          operation: PutResourcePolicy
+          path: Policy
+        compare:
+          is_ignored: true
+      EnforceConsumerDeletion:
+        from:
+          operation: DeleteStream
+          path: EnforceConsumerDeletion
+        compare:
+          is_ignored: true
+      ShardLevelMetrics:
+        from:
+          operation: EnableEnhancedMonitoring
+          path: ShardLevelMetrics
+        compare:
+          is_ignored: true
+      WarmThroughputMiBps:
+        compare:
+          is_ignored: true
+      MaxRecordSizeInKiB:
+        compare:
+          is_ignored: true
+      # Kinesis defaults a stream to PROVISIONED capacity mode, which the read
+      # path surfaces into the latest state. Skip the generated comparison and
+      # let compareStreamModeDetails ignore the AWS default when the field is
+      # unset, while still reconciling an explicitly-requested mode via the
+      # out-of-band UpdateStreamMode API (syncStreamMode).
+      StreamModeDetails:
+        compare:
+          is_ignored: true
+      # ShardCount only applies to PROVISIONED streams. ON_DEMAND streams manage
+      # capacity automatically and reject both CreateStream and UpdateShardCount
+      # when a shard count is supplied. Skip the generated comparison and let
+      # compareShardCount ignore ShardCount for ON_DEMAND streams (the create
+      # request also strips it via sdk_create_post_build_request).
+      ShardCount:
+        compare:
+          is_ignored: true
+      # Settable Spec inputs. None of these are part of CreateStream; they are
+      # applied via separate API calls in the update path (Increase/Decrease
+      # StreamRetentionPeriod and Start/StopStreamEncryption). sdkFind mirrors
+      # the observed AWS values back into these fields so that auto-generated
+      # delta detection compares desired vs actual state correctly.
+      DesiredRetentionPeriodHours:
+        type: int64
+        late_initialize:
+          skip_incomplete_check: {}
+      DesiredEncryptionType:
+        type: string
+        late_initialize:
+          skip_incomplete_check: {}
+      # EncryptionKeyARN is the customer-managed KMS key used when
+      # DesiredEncryptionType is KMS. A key *ARN* is required (aliases are
+      # rejected in the update hook) so the observed Status.KeyID matches the
+      # desired value and the controller does not re-encrypt on every reconcile.
+      EncryptionKeyARN:
+        type: string
+        late_initialize:
+          skip_incomplete_check: {}
       # NOTE(jaypipes): It is necessary to hand-roll all these fields because
       # the CreateStream output shape has no members at all...
       ConsumerCount: