fix(cloudtrail): make the default lookup configuration runnable

A dropdown with no value() seeds and persists its first option, so attributeKey
auto-selected Username while attributeValue stayed empty and the both-or-neither
guard threw before any AWS call — a freshly dropped block could not run.

Adds a selectable no-filter sentinel, applies the same fix to SSM parameterTier
(which silently forced Standard over the account default), and records SQS's
authMode so the catalog stops reporting it as unauthenticated.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LJV2dCcAYvf1JuxquCMZAd

Author: waleedlatif1

apps/sim/blocks/blocks/cloudtrail.test.ts

@@ -0,0 +1,64 @@
+/**
+ * @vitest-environment node
+ *
+ * A dropdown subBlock with no `value()` seeds and persists its first selectable option,
+ * so a block's *default* configuration is not necessarily one that runs. These tests
+ * exercise the default the user actually gets on drop, which no other suite covers.
+ */
+import { describe, expect, it } from 'vitest'
+import { CloudTrailBlock } from '@/blocks/blocks/cloudtrail'
+
+type SubBlock = (typeof CloudTrailBlock.subBlocks)[number]
+
+function subBlock(id: string): SubBlock {
+  const found = CloudTrailBlock.subBlocks.find((block) => block.id === id)
+  if (!found) throw new Error(`missing subBlock ${id}`)
+  return found
+}
+
+/** Mirrors the dropdown's seeding rule: an explicit `value()` wins, else the first option. */
+function seededValue(block: SubBlock): unknown {
+  if (typeof block.value === 'function') return block.value()
+  const options = block.options
+  if (!Array.isArray(options)) return undefined
+  const first = options[0] as { id?: unknown } | undefined
+  return first?.id
+}
+
+describe('CloudTrail block defaults', () => {
+  it('seeds no lookup filter attribute, so the default run is unfiltered', () => {
+    expect(seededValue(subBlock('attributeKey'))).toBe('')
+  })
+
+  it('offers a selectable no-filter option so the choice can be undone', () => {
+    const options = subBlock('attributeKey').options as Array<{ id: string; label: string }>
+    expect(options[0]).toMatchObject({ id: '' })
+    expect(options.filter((option) => option.id === '')).toHaveLength(1)
+  })
+
+  it('does not throw on the configuration a freshly dropped block produces', () => {
+    const params = {
+      operation: 'lookup_events',
+      awsRegion: 'us-east-1',
+      awsAccessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+      awsSecretAccessKey: 'secret',
+      attributeKey: seededValue(subBlock('attributeKey')),
+      attributeValue: '',
+    }
+
+    expect(() => CloudTrailBlock.tools.config?.params?.(params)).not.toThrow()
+  })
+
+  it('still rejects a half-supplied filter', () => {
+    const params = {
+      operation: 'lookup_events',
+      awsRegion: 'us-east-1',
+      awsAccessKeyId: 'AKIAIOSFODNN7EXAMPLE',
+      awsSecretAccessKey: 'secret',
+      attributeKey: 'Username',
+      attributeValue: '',
+    }
+
+    expect(() => CloudTrailBlock.tools.config?.params?.(params)).toThrow(/filter/i)
+  })
+})

apps/sim/blocks/blocks/cloudtrail.ts

@@ -171,7 +171,16 @@ export const CloudTrailBlock: BlockConfig<
       id: 'attributeKey',
       title: 'Filter By',
       type: 'dropdown',
+      /**
+       * Every LookupEvents attribute is optional, so an unfiltered Region-wide lookup is
+       * the correct default. A dropdown with no `value()` seeds and persists its first
+       * selectable option, which would pair an attribute with an empty value and trip the
+       * both-or-neither guard before any AWS call — so the no-filter sentinel has to be a
+       * real, selectable option the user can also return to.
+       */
+      value: () => '',
       options: [
+        { label: 'No filter', id: '' },
         { label: 'User Name', id: 'Username' },
         { label: 'Event Name', id: 'EventName' },
         { label: 'Event Source', id: 'EventSource' },

apps/sim/blocks/blocks/sqs.ts

@@ -1,7 +1,7 @@
 import { getErrorMessage } from '@sim/utils/errors'
 import { SQSIcon } from '@/components/icons'
 import type { BlockConfig, BlockMeta } from '@/blocks/types'
-import { IntegrationType } from '@/blocks/types'
+import { AuthMode, IntegrationType } from '@/blocks/types'
 import type { SqsResponse } from '@/tools/sqs/types'
 
 export const SQSBlock: BlockConfig<SqsResponse> = {
@@ -16,6 +16,7 @@ export const SQSBlock: BlockConfig<SqsResponse> = {
   bgColor: 'linear-gradient(45deg, #2E27AD 0%, #527FFF 100%)',
   iconColor: '#527FFF',
   icon: SQSIcon,
+  authMode: AuthMode.ApiKey,
   canvasPresentation: {
     defaultTitle: 'Amazon SQS',
     sentences: {

apps/sim/blocks/blocks/ssm.ts

@@ -492,7 +492,15 @@ export const SSMBlock: BlockConfig<SsmSendCommandResponse> = {
       id: 'parameterTier',
       title: 'Parameter Tier',
       type: 'dropdown',
+      /**
+       * `Tier` is optional, and omitting it lets the account's own default apply —
+       * which may be Intelligent-Tiering. A dropdown with no `value()` seeds and
+       * persists its first option, so without this sentinel the block would silently
+       * force `Standard` on every write.
+       */
+      value: () => '',
       options: [
+        { label: 'Account default', id: '' },
         { label: 'Standard', id: 'Standard' },
         { label: 'Advanced', id: 'Advanced' },
         { label: 'Intelligent-Tiering', id: 'Intelligent-Tiering' },

gate-checks1.txt

@@ -0,0 +1,60 @@
+=== api-validation ===
+  apps/sim raw same-origin /api/ fetch() callsites: 0
+  apps/sim raw same-origin /api/ fetch() exemptions (annotated): 19
+  as unknown as double-casts (non-test): 6
+  as unknown as double-cast exemptions (annotated): 54
+  route files with raw await request.json() reads: 5 (baseline 5)
+  route raw await request.json() reads (callsites): 5
+  route raw await request.json() annotated exemptions: 1
+  contract untyped response schemas (z.unknown / z.object({}).passthrough / z.record): 0
+  contract untyped response annotated exemptions: 21
+  audit annotations missing reason: 0
+  raw fetch examples:
+  same-origin /api/ fetch examples:
+  double-cast examples:
+    apps/sim/tools/hosting.ts:9 const value = (params as unknown as Record<string, unknown>)[condition.field]
+    apps/sim/executor/utils/errors.ts:203 const candidate = current as unknown as { statusCode?: unknown }
+    apps/sim/executor/utils/errors.ts:286 const attached = error as unknown as AttachedBlockContext
+    packages/logger/src/index.ts:149 errorObj[key] = (error as unknown as Record<string, unknown>)[key]
+    packages/ts-sdk/src/index.ts:511 const errorData = (await response.json().catch(() => ({}))) as unknown as any
+    packages/ts-sdk/src/index.ts:687 const errorData = (await response.json().catch(() => ({}))) as unknown as any
+  raw await request.json() examples:
+    apps/sim/app/api/organizations/route.ts:93 const rawBody = await request.json().catch(() => ({}))
+    apps/sim/app/api/copilot/chat/abort/route.ts:40 const body = await request.json().catch((err) => {
+    apps/sim/app/api/resume/[workflowId]/[executionId]/[contextId]/route.ts:45 payload = await request.json()
+    apps/sim/app/api/workspaces/[id]/route.ts:245 const rawBody = await request.json().catch(() => ({}))
+    apps/sim/app/api/billing/portal/route.ts:24 const body = await request.json().catch(() => ({}))
+  untyped response schema examples:
+  annotations missing reason (must be 0 for --enforce-boundary-baseline):
+  annotation forms: `// boundary-raw-fetch: <reason>` (raw fetch in client hook OR same-origin /api/ fetch outside an API route handler), `// double-cast-allowed: <reason>` (double-cast), `// boundary-raw-json: <reason>` (raw request.json read), `// untyped-response: <reason>` (z.unknown() / z.object({}).passthrough() / z.record(z.string(), z.unknown()) response schema)
+
+API validation audit passed.
+EXIT:0
+=== canvas-sentences ===
+$ bun run apps/sim/scripts/check-canvas-sentences.ts --require-coverage
+✓ Canvas sentence check passed (346 block(s))
+
+Coverage: 5648/5648 operations (100%) across 346/346 blocks
+EXIT:0
+=== docs:check ===
+Getting info for tool: zoom_delete_meeting
+Getting info for tool: zoom_get_meeting_invitation
+Getting info for tool: zoom_list_recordings
+Getting info for tool: zoom_get_meeting_recordings
+Getting info for tool: zoom_delete_recording
+Getting info for tool: zoom_list_past_participants
+Getting info for tool: zoominfo_search_companies
+Getting info for tool: zoominfo_search_contacts
+Getting info for tool: zoominfo_enrich_companies
+Getting info for tool: zoominfo_enrich_contacts
+Getting info for tool: zoominfo_search_intent
+Getting info for tool: zoominfo_search_news
+Generating trigger documentation...
+✓ Loaded full config for 403 triggers
+Skipping trigger provider: generic
+Skipping trigger provider: slack
+Skipping trigger provider: table
+Skipping trigger provider: rss
+✓ Trigger sections merged into 61 integration pages
+✓ Generated integration docs are in sync
+EXIT:0

gate-checks2.txt

@@ -0,0 +1,74 @@
+=== audits ===
+✓ check:trigger-block-cycle (100ms)
+✓ check:cli-api (708ms)
+✓ check:realtime-prune (752ms)
+✓ check:tool-registry-boundary (550ms)
+✓ check:fork-dependent-coverage (780ms)
+✓ check:block-successors (898ms)
+✓ check:api-contract-routes (1287ms)
+✓ check:tool-param-reachability (1002ms)
+✓ check:bare-icons (118ms)
+✓ check:egress-boundary (1687ms)
+✓ check:icon-paths (27ms)
+✓ check:canonical-index (2144ms)
+✓ check:icon-path-precision (482ms)
+✓ check:byok-providers (960ms)
+✓ check:spec-example-ids (22ms)
+✓ check:canvas-sentences (1205ms)
+✓ check:skills (27ms)
+✓ check:react-query (1772ms)
+✓ check:api-validation:strict (2537ms)
+✓ check:desktop-ipc (31ms)
+✓ check:desktop-bridge (138ms)
+✓ deployment-config:check (74ms)
+✓ check:script-tests (386ms)
+✓ check:zustand-v5 (2209ms)
+✓ agent-stream-docs:check (35ms)
+✓ check:route-verbs (524ms)
+✓ integration-catalog:check (562ms)
+✓ check:pending-drop-tables (2786ms)
+✓ check:native-typecheck (1443ms)
+✓ tool-metadata:check (1061ms)
+✓ check:utils (2669ms)
+✓ check:sql-date-binding (3309ms)
+✓ check:client-boundary (3070ms)
+✓ check:source-text (1658ms)
+✓ check:import-specifiers (3817ms)
+✓ check:tool-request-boundary (5110ms)
+✓ docs:check (2700ms)
+✓ check:openapi (6280ms)
+
+45 audits in 6.3s wall (56.3s serial, 14-way)
+EXIT:0
+=== lint ===
+@sim/workflow-renderer:lint: Checked 41 files in 103ms. No fixes applied.
+@sim/platform-authz:lint: cache hit, replaying logs 73395b4e7eeb68f3
+@sim/platform-authz:lint: $ biome check --write --unsafe .
+@sim/platform-authz:lint: Checked 7 files in 28ms. No fixes applied.
+@sim/desktop:lint: cache hit, replaying logs b091199e60e068ec
+@sim/desktop:lint: $ biome check --write --unsafe .
+@sim/desktop:lint: Checked 151 files in 472ms. No fixes applied.
+@sim/auth:lint: cache hit, replaying logs 7127fd081aa8ea29
+@sim/auth:lint: $ biome check --write --unsafe .
+@sim/auth:lint: Checked 4 files in 53ms. No fixes applied.
+@sim/workflow-persistence:lint: cache hit, replaying logs f95340178462088d
+@sim/workflow-persistence:lint: $ biome check --write --unsafe .
+@sim/workflow-persistence:lint: Checked 11 files in 35ms. No fixes applied.
+@sim/audit:lint: cache hit, replaying logs a6444e9df75a5204
+@sim/audit:lint: $ biome check --write --unsafe .
+@sim/audit:lint: Checked 9 files in 40ms. No fixes applied.
+docs:lint: cache hit, replaying logs 565d1a6fd3549e13
+@sim/realtime:lint: cache hit, replaying logs 2b83130fbd406515
+@sim/realtime:lint: $ biome check --write --unsafe .
+@sim/realtime:lint: Checked 51 files in 206ms. No fixes applied.
+docs:lint: $ biome check --write --unsafe .
+docs:lint: Checked 111 files in 183ms. No fixes applied.
+@sim/app:lint: cache hit, replaying logs e90a315e08073392
+@sim/app:lint: $ biome check --write --unsafe .
+@sim/app:lint: Checked 16090 files in 4s. No fixes applied.
+
+ Tasks:    26 successful, 26 total
+Cached:    26 cached, 26 total
+  Time:    359ms >>> FULL TURBO
+
+EXIT:0

gate-typecheck.txt

@@ -0,0 +1,2 @@
+$ tsc --noEmit
+EXIT:0

gate-vitest.txt

@@ -0,0 +1,10 @@
+
+ RUN  v4.1.9 /private/tmp/aws-all/apps/sim
+
+
+ Test Files  31 passed (31)
+      Tests  988 passed (988)
+   Start at  19:12:37
+   Duration  2.93s (transform 3.36s, setup 3.42s, import 3.73s, tests 3.06s, environment 181ms)
+
+EXIT:0

packages/deployment-config/src/integrations.json

@@ -1126,7 +1126,7 @@
       "operationCount": 21,
       "triggers": [],
       "triggerCount": 0,
-      "authType": "none",
+      "authType": "api-key",
       "category": "tools",
       "integrationType": "devops",
       "tags": ["cloud", "messaging", "automation"]