@go-to-k/cdkd 0.238.6 → 0.240.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-_tADDg2k.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-D_OJrSGP.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -61,8 +61,10 @@ import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand,
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16 } from "@aws-sdk/client-s3tables";
+import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1885,7 +1887,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.238.6";
+	return "0.240.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -35162,6 +35164,564 @@ var CodeBuildProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/codecommit-repository-provider.ts
+/**
+* Convert the CFn `Tags` list shape to CodeCommit's `Record<string, string>`
+* map. Entries without a string `Key` are skipped; non-string values are
+* stringified (post-intrinsic-resolution values can be numbers/booleans).
+* Returns `undefined` for an absent/empty list so callers can omit the field.
+*/
+function toSdkTagMap(tags) {
+	if (!tags || tags.length === 0) return void 0;
+	const out = {};
+	for (const tag of tags) {
+		if (typeof tag?.Key !== "string" || tag.Key.length === 0) continue;
+		const value = tag.Value;
+		out[tag.Key] = typeof value === "string" ? value : typeof value === "number" || typeof value === "boolean" ? String(value) : "";
+	}
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+/** Order-independent equality for two SDK tag maps. */
+function tagMapsEqual(a, b) {
+	const aKeys = Object.keys(a);
+	if (aKeys.length !== Object.keys(b).length) return false;
+	return aKeys.every((k) => b[k] === a[k]);
+}
+/**
+* AWS CodeCommit Repository Provider
+*
+* Implements resource provisioning for AWS::CodeCommit::Repository using the
+* CodeCommit SDK. The type is `ProvisioningType: NON_PROVISIONABLE`, so the
+* Cloud Control fallback cannot handle it — without this SDK provider cdkd's
+* pre-flight rejects the type outright (issue #1045). CodeCommit returned to
+* full General Availability on 2025-11-24, so the service is fully usable for
+* new sign-ups again.
+*
+* Physical id: the repository NAME (every CodeCommit API is name-based;
+* there is no lookup-by-id API). CloudFormation's `Ref` returns the
+* repository ID (a GUID), so `create()` stores `RepositoryId` in attributes
+* and the intrinsic resolver's `cfnRefValueFromPhysicalId` recovers it via
+* `stateLookup` for CFn `Ref` parity.
+*/
+var CodeCommitRepositoryProvider = class {
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("CodeCommitRepositoryProvider");
+	handledProperties = new Map([["AWS::CodeCommit::Repository", new Set([
+		"RepositoryName",
+		"RepositoryDescription",
+		"KmsKeyId",
+		"Tags"
+	])]]);
+	unhandledByDesign = new Map([["AWS::CodeCommit::Repository", new Map([["Code", "CFn-only seed-content orchestration (S3 zip unpacked into an initial commit on a chosen branch); not wired in v1 — pre-flight rejects templates carrying it so nothing is silently dropped; a follow-up could implement it via CreateCommit/PutFile"], ["Triggers", "repository trigger management not wired in v1 — pre-flight rejects templates carrying it so nothing is silently dropped; a follow-up could implement it via PutRepositoryTriggers"]])]]);
+	getClient() {
+		if (!this.client) this.client = new CodeCommitClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	/**
+	* Build the `Fn::GetAtt` attribute map from a `RepositoryMetadata`
+	* response. `RepositoryId` is additionally stored so the intrinsic
+	* resolver can recover CFn's `Ref` value (the repository ID) from state.
+	*/
+	toAttributes(metadata) {
+		return {
+			Arn: metadata?.Arn ?? "",
+			CloneUrlHttp: metadata?.cloneUrlHttp ?? "",
+			CloneUrlSsh: metadata?.cloneUrlSsh ?? "",
+			Name: metadata?.repositoryName ?? "",
+			KmsKeyId: metadata?.kmsKeyId ?? "",
+			RepositoryId: metadata?.repositoryId ?? ""
+		};
+	}
+	/**
+	* Create a CodeCommit Repository
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating CodeCommit Repository ${logicalId}`);
+		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 100 });
+		try {
+			const tags = toSdkTagMap(properties["Tags"]);
+			const description = properties["RepositoryDescription"];
+			const kmsKeyId = properties["KmsKeyId"];
+			const metadata = (await this.getClient().send(new CreateRepositoryCommand$1({
+				repositoryName,
+				...description !== void 0 ? { repositoryDescription: description } : {},
+				...kmsKeyId !== void 0 ? { kmsKeyId } : {},
+				...tags ? { tags } : {}
+			}))).repositoryMetadata;
+			if (!metadata?.repositoryName) throw new Error("CreateRepository did not return repository metadata");
+			this.logger.debug(`Successfully created CodeCommit Repository ${logicalId}: ${metadata.repositoryName}`);
+			return {
+				physicalId: metadata.repositoryName,
+				attributes: this.toAttributes(metadata)
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, repositoryName, cause);
+		}
+	}
+	/**
+	* Update a CodeCommit Repository
+	*
+	* Mutable properties: RepositoryName (UpdateRepositoryName — CFn's docs
+	* mark the property "Update requires: No interruption" and the registry
+	* schema's createOnlyProperties is empty, so CFn parity is an IN-PLACE
+	* rename that preserves the repository's git history; the repository ID —
+	* CFn's `Ref` value — survives the rename), RepositoryDescription
+	* (UpdateRepositoryDescription), KmsKeyId (UpdateRepositoryEncryptionKey),
+	* Tags (TagResource / UntagResource — full tag removal handled explicitly,
+	* see the ECR Tags regression class in issue #981).
+	*
+	* A rename returns the NEW repository name as `physicalId` with
+	* `wasReplaced: false`; the deploy engine persists the returned physical
+	* id into state unconditionally.
+	*/
+	async update(logicalId, physicalId, _resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating CodeCommit Repository ${logicalId} (${physicalId})`);
+		let currentName = physicalId;
+		try {
+			const newName = properties["RepositoryName"];
+			if (newName && newName !== physicalId) {
+				try {
+					await this.getClient().send(new UpdateRepositoryNameCommand({
+						oldName: physicalId,
+						newName
+					}));
+				} catch (err) {
+					if (!(err instanceof RepositoryDoesNotExistException)) throw err;
+					await this.getRepositoryMetadata(newName);
+					this.logger.debug(`Rename ${physicalId} -> ${newName} already applied by a previous attempt`);
+				}
+				currentName = newName;
+				this.logger.debug(`Renamed CodeCommit Repository ${physicalId} -> ${newName}`);
+			}
+			const newDescription = properties["RepositoryDescription"];
+			if (newDescription !== previousProperties["RepositoryDescription"]) {
+				await this.getClient().send(new UpdateRepositoryDescriptionCommand({
+					repositoryName: currentName,
+					repositoryDescription: newDescription ?? ""
+				}));
+				this.logger.debug(`Updated description for ${currentName}`);
+			}
+			const newKmsKeyId = properties["KmsKeyId"];
+			if (newKmsKeyId !== previousProperties["KmsKeyId"]) {
+				await this.getClient().send(new UpdateRepositoryEncryptionKeyCommand({
+					repositoryName: currentName,
+					kmsKeyId: newKmsKeyId ?? "alias/aws/codecommit"
+				}));
+				this.logger.debug(`Updated encryption key for ${currentName}`);
+			}
+			const newTags = properties["Tags"];
+			const oldTags = previousProperties["Tags"];
+			const newTagMap = toSdkTagMap(newTags) ?? {};
+			const oldTagMap = toSdkTagMap(oldTags) ?? {};
+			let metadata;
+			if (!tagMapsEqual(newTagMap, oldTagMap)) {
+				metadata = await this.getRepositoryMetadata(currentName);
+				const repoArn = metadata?.Arn;
+				if (repoArn) {
+					const removedKeys = Object.keys(oldTagMap).filter((k) => !(k in newTagMap));
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$15({
+						resourceArn: repoArn,
+						tagKeys: removedKeys
+					}));
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$15({
+						resourceArn: repoArn,
+						tags: newTagMap
+					}));
+					this.logger.debug(`Updated tags for ${currentName}`);
+				} else this.logger.warn(`Could not resolve ARN for CodeCommit Repository ${currentName}; tag update skipped`);
+			}
+			metadata = await this.getRepositoryMetadata(currentName);
+			return {
+				physicalId: currentName,
+				wasReplaced: false,
+				attributes: this.toAttributes(metadata)
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, _resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Delete a CodeCommit Repository
+	*
+	* `DeleteRepository` is idempotent on the AWS side: for an
+	* already-deleted repository it does NOT throw — it returns a null
+	* `repositoryId`. That silent-success shape would bypass the shared
+	* region check entirely (the exact scenario `assertRegionMatch` exists
+	* for: a client pointed at region B while the state says the repo lives
+	* in region A), so a null `repositoryId` runs the region check before
+	* being treated as idempotent success. A
+	* `RepositoryDoesNotExistException` is additionally handled (same
+	* check) for defense in depth.
+	*/
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting CodeCommit Repository ${logicalId}: ${physicalId}`);
+		let deletedRepositoryId;
+		try {
+			deletedRepositoryId = (await this.getClient().send(new DeleteRepositoryCommand$1({ repositoryName: physicalId }))).repositoryId;
+		} catch (error) {
+			if (error instanceof RepositoryDoesNotExistException) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`CodeCommit Repository ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		if (!deletedRepositoryId) {
+			assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+			this.logger.debug(`CodeCommit Repository ${physicalId} does not exist, skipping deletion`);
+			return;
+		}
+		this.logger.debug(`Successfully deleted CodeCommit Repository ${logicalId}`);
+	}
+	/**
+	* Get repository attributes for Fn::GetAtt resolution.
+	*
+	* Supported: `Arn`, `CloneUrlHttp`, `CloneUrlSsh`, `Name`, `KmsKeyId`
+	* (the CFn-documented attribute set).
+	*/
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		switch (attributeName) {
+			case "Name": return physicalId;
+			case "Arn":
+			case "CloneUrlHttp":
+			case "CloneUrlSsh":
+			case "KmsKeyId": {
+				const metadata = await this.getRepositoryMetadata(physicalId);
+				return this.toAttributes(metadata)[attributeName];
+			}
+			default: return;
+		}
+	}
+	/**
+	* Adopt an existing CodeCommit repository into cdkd state.
+	*
+	* Lookup order:
+	*  1. `--resource` override or `Properties.RepositoryName` → verify via
+	*     `GetRepository`.
+	*  2. `ListRepositories` paginated, then `ListTagsForResource(arn)` per
+	*     repository to match `aws:cdk:path` (CodeCommit uses the
+	*     `Record<string, string>` tag-map shape).
+	*/
+	async import(input) {
+		const explicit = resolveExplicitPhysicalId(input, "RepositoryName");
+		if (explicit) try {
+			const resp = await this.getClient().send(new GetRepositoryCommand({ repositoryName: explicit }));
+			return resp.repositoryMetadata?.repositoryName ? {
+				physicalId: explicit,
+				attributes: this.toAttributes(resp.repositoryMetadata)
+			} : null;
+		} catch (err) {
+			if (err instanceof RepositoryDoesNotExistException) return null;
+			throw err;
+		}
+		if (!input.cdkPath) return null;
+		let nextToken;
+		do {
+			const list = await this.getClient().send(new ListRepositoriesCommand({ ...nextToken && { nextToken } }));
+			for (const repo of list.repositories ?? []) {
+				if (!repo.repositoryName) continue;
+				let metadata;
+				try {
+					metadata = await this.getRepositoryMetadata(repo.repositoryName);
+				} catch (err) {
+					if (err instanceof RepositoryDoesNotExistException) continue;
+					throw err;
+				}
+				if (!metadata?.Arn) continue;
+				if ((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: metadata.Arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					physicalId: repo.repositoryName,
+					attributes: this.toAttributes(metadata)
+				};
+			}
+			nextToken = list.nextToken;
+		} while (nextToken);
+		return null;
+	}
+	/**
+	* Fetch the repository's metadata via `GetRepository`. Throws
+	* `RepositoryDoesNotExistException` through to the caller.
+	*/
+	async getRepositoryMetadata(repositoryName) {
+		return (await this.getClient().send(new GetRepositoryCommand({ repositoryName }))).repositoryMetadata;
+	}
+};
+
+//#endregion
+//#region src/provisioning/providers/dlm-lifecycle-policy-provider.ts
+/**
+* SDK Provider for AWS::DLM::LifecyclePolicy (Data Lifecycle Manager).
+*
+* Why an SDK provider (issue #1040): the type is
+* `ProvisioningType: NON_PROVISIONABLE`, so cdkd's Cloud Control fallback
+* cannot handle it and pre-flight rejected it. The DLM API surface is small
+* and the CFn property shape maps 1:1 onto the SDK's PascalCase inputs; the
+* only conversion is the CFn `Tags` list <-> DLM tag-map.
+*
+* physicalId is the service-generated policy id (`policy-0123456789abcdef0`)
+* — matches CFn, where `Ref` returns the policy id (`Id` is the
+* primaryIdentifier). `Fn::GetAtt Arn` returns the policy ARN.
+*
+* API mapping:
+*   - create      -> CreateLifecyclePolicy (+ GetLifecyclePolicy for the Arn
+*                    attribute — the create response only carries PolicyId)
+*   - update      -> UpdateLifecyclePolicy for policy fields, plus explicit
+*                    TagResource / UntagResource for tag diffs (the update
+*                    API has no Tags parameter). Tag removal — including a
+*                    FULL `Tags` property removal — is handled explicitly
+*                    via UntagResource (the #981 ECR regression class).
+*   - delete      -> DeleteLifecyclePolicy (NotFound idempotent, guarded by
+*                    assertRegionMatch)
+*   - getAttribute-> GetLifecyclePolicy (`Arn` from Policy.PolicyArn)
+*
+* `DefaultPolicy` is create-only at the API level (UpdateLifecyclePolicy has
+* no such parameter; CFn documents it as "Update requires: Replacement"), so
+* a change is rejected with `ResourceUpdateNotSupportedError` and the deploy
+* engine's `--replace` fallback recreates the policy.
+*/
+var DLMLifecyclePolicyProvider = class {
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("DLMLifecyclePolicyProvider");
+	handledProperties = new Map([["AWS::DLM::LifecyclePolicy", new Set([
+		"Description",
+		"ExecutionRoleArn",
+		"State",
+		"PolicyDetails",
+		"Tags",
+		"DefaultPolicy",
+		"CreateInterval",
+		"RetainInterval",
+		"CopyTags",
+		"ExtendDeletion",
+		"CrossRegionCopyTargets",
+		"Exclusions"
+	])]]);
+	getClient() {
+		if (!this.client) this.client = new DLMClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	/**
+	* Convert the CFn `Tags` list (`[{ Key, Value }]`) to the DLM tag map
+	* (`Record<string, string>`). Returns `undefined` for an absent / empty
+	* list so callers can omit the field.
+	*/
+	cfnTagsToMap(tags) {
+		if (!Array.isArray(tags)) return void 0;
+		const map = {};
+		for (const t of tags) if (typeof t?.Key === "string" && t.Key.length > 0) map[t.Key] = typeof t.Value === "string" ? t.Value : "";
+		return Object.keys(map).length > 0 ? map : void 0;
+	}
+	/**
+	* Map the CFn property shape to the SDK input shape (shared by create and
+	* update — every field name is PascalCase-identical). `Tags` and
+	* `DefaultPolicy` are intentionally NOT included: create wires them
+	* separately (update has neither parameter).
+	*/
+	toSdkFields(properties) {
+		return {
+			...properties["ExecutionRoleArn"] !== void 0 && { ExecutionRoleArn: properties["ExecutionRoleArn"] },
+			...properties["Description"] !== void 0 && { Description: properties["Description"] },
+			...properties["State"] !== void 0 && { State: properties["State"] },
+			...properties["PolicyDetails"] !== void 0 && { PolicyDetails: properties["PolicyDetails"] },
+			...properties["CreateInterval"] !== void 0 && { CreateInterval: properties["CreateInterval"] },
+			...properties["RetainInterval"] !== void 0 && { RetainInterval: properties["RetainInterval"] },
+			...properties["CopyTags"] !== void 0 && { CopyTags: properties["CopyTags"] },
+			...properties["ExtendDeletion"] !== void 0 && { ExtendDeletion: properties["ExtendDeletion"] },
+			...properties["CrossRegionCopyTargets"] !== void 0 && { CrossRegionCopyTargets: properties["CrossRegionCopyTargets"] },
+			...properties["Exclusions"] !== void 0 && { Exclusions: properties["Exclusions"] }
+		};
+	}
+	/** Fetch the policy ARN (`Fn::GetAtt Arn`) for a policy id. */
+	async fetchPolicyArn(policyId) {
+		return (await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: policyId }))).Policy?.PolicyArn ?? "";
+	}
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating DLM Lifecycle Policy ${logicalId}`);
+		try {
+			const tags = this.cfnTagsToMap(properties["Tags"]);
+			const input = {
+				...this.toSdkFields(properties),
+				...properties["DefaultPolicy"] !== void 0 && { DefaultPolicy: properties["DefaultPolicy"] },
+				...tags && { Tags: tags }
+			};
+			const response = await this.getClient().send(new CreateLifecyclePolicyCommand(input));
+			if (!response.PolicyId) throw new Error("CreateLifecyclePolicy did not return a PolicyId");
+			let arn = "";
+			try {
+				arn = await this.fetchPolicyArn(response.PolicyId);
+			} catch (err) {
+				this.logger.warn(`Created DLM Lifecycle Policy ${response.PolicyId} but could not fetch its ARN: ${err instanceof Error ? err.message : String(err)}`);
+			}
+			this.logger.debug(`Successfully created DLM Lifecycle Policy ${logicalId}: ${response.PolicyId}`);
+			return {
+				physicalId: response.PolicyId,
+				attributes: arn ? { Arn: arn } : {}
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		if (JSON.stringify(properties["DefaultPolicy"]) !== JSON.stringify(previousProperties["DefaultPolicy"])) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `DefaultPolicy cannot be changed in place; re-run with \`cdkd deploy --replace ${logicalId}\` to recreate the policy`);
+		this.logger.debug(`Updating DLM Lifecycle Policy ${logicalId} (${physicalId})`);
+		try {
+			await this.getClient().send(new UpdateLifecyclePolicyCommand({
+				PolicyId: physicalId,
+				...this.toSdkFields(properties)
+			}));
+			const newTags = this.cfnTagsToMap(properties["Tags"]) ?? {};
+			const oldTags = this.cfnTagsToMap(previousProperties["Tags"]) ?? {};
+			const arn = await this.fetchPolicyArn(physicalId);
+			const tagsChanged = JSON.stringify(newTags) !== JSON.stringify(oldTags);
+			if (tagsChanged && !arn) this.logger.warn(`Skipping tag update for DLM Lifecycle Policy ${physicalId}: GetLifecyclePolicy returned no PolicyArn`);
+			if (tagsChanged && arn) {
+				const removedKeys = Object.keys(oldTags).filter((k) => !(k in newTags));
+				if (removedKeys.length > 0) {
+					await this.getClient().send(new UntagResourceCommand$16({
+						ResourceArn: arn,
+						TagKeys: removedKeys
+					}));
+					this.logger.debug(`Removed ${removedKeys.length} tag(s) from DLM Lifecycle Policy ${physicalId}`);
+				}
+				const tagsToAdd = {};
+				for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) tagsToAdd[k] = v;
+				if (Object.keys(tagsToAdd).length > 0) {
+					await this.getClient().send(new TagResourceCommand$16({
+						ResourceArn: arn,
+						Tags: tagsToAdd
+					}));
+					this.logger.debug(`Added/updated ${Object.keys(tagsToAdd).length} tag(s) on DLM Lifecycle Policy ${physicalId}`);
+				}
+			}
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: arn ? { Arn: arn } : {}
+			};
+		} catch (error) {
+			if (error instanceof ResourceUpdateNotSupportedError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting DLM Lifecycle Policy ${logicalId}: ${physicalId}`);
+		try {
+			await this.getClient().send(new DeleteLifecyclePolicyCommand$1({ PolicyId: physicalId }));
+			this.logger.debug(`Successfully deleted DLM Lifecycle Policy ${logicalId}`);
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$12) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`DLM Lifecycle Policy ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete DLM Lifecycle Policy ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Attribute fallback. `Arn` is cached in state at create/update time, so
+	* this only fires for imported/degraded records.
+	*/
+	async getAttribute(physicalId, resourceType, attributeName) {
+		if (attributeName === "Id" || attributeName === "PolicyId") return physicalId;
+		if (attributeName !== "Arn") throw new ProvisioningError(`Unknown attribute ${attributeName} for ${resourceType}`, resourceType, physicalId);
+		try {
+			return await this.fetchPolicyArn(physicalId);
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to resolve Arn for DLM Lifecycle Policy ${physicalId}: ${cause?.message ?? String(error)}`, resourceType, physicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Drift read-back. Surfaces `Description`, `State`, `ExecutionRoleArn`,
+	* and `Tags` (DLM tag map -> CFn list via `normalizeAwsTagsToCfn`).
+	*
+	* `PolicyDetails` is intentionally NOT surfaced (see
+	* `getDriftUnknownPaths`): the service normalizes the stored details —
+	* filling `PolicyType` / `ResourceTypes` / per-schedule defaults the
+	* template omitted — and the drift comparator's positional array equality
+	* would flag those AWS-added defaults as phantom drift on every clean run.
+	* The default-policy shorthand fields (`CreateInterval` / `RetainInterval`
+	* / `CopyTags` / `ExtendDeletion` / `CrossRegionCopyTargets` /
+	* `Exclusions`) are folded into the normalized `PolicyDetails` by the
+	* service (GetLifecyclePolicy does not return them at the top level), so
+	* they are excluded for the same reason.
+	*
+	* Returns `undefined` when the policy is gone (ResourceNotFoundException).
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		try {
+			const policy = (await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: physicalId }))).Policy;
+			if (!policy) return void 0;
+			return {
+				...policy.Description !== void 0 && { Description: policy.Description },
+				...policy.State !== void 0 && { State: policy.State },
+				...policy.ExecutionRoleArn !== void 0 && { ExecutionRoleArn: policy.ExecutionRoleArn },
+				Tags: normalizeAwsTagsToCfn(policy.Tags)
+			};
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$12) return;
+			throw error;
+		}
+	}
+	/**
+	* State property paths the provider deliberately does not read back from
+	* AWS — see `readCurrentState` for the rationale.
+	*/
+	getDriftUnknownPaths(_resourceType) {
+		return [
+			"PolicyDetails",
+			"CreateInterval",
+			"RetainInterval",
+			"CopyTags",
+			"ExtendDeletion",
+			"CrossRegionCopyTargets",
+			"Exclusions",
+			"DefaultPolicy"
+		];
+	}
+	/**
+	* Adopt an existing lifecycle policy into cdkd state.
+	*
+	* Lookup order:
+	*  1. `--resource` override (`knownPhysicalId`) -> verify via
+	*     GetLifecyclePolicy. There is no template name property — the policy
+	*     id is service-generated — so no name fallback applies.
+	*  2. Tag-based lookup: GetLifecyclePolicies returns every policy summary
+	*     WITH its tag map in a single unpaginated call, so the `aws:cdk:path`
+	*     match needs no per-policy follow-up.
+	*/
+	async import(input) {
+		if (input.knownPhysicalId) try {
+			const response = await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: input.knownPhysicalId }));
+			return response.Policy?.PolicyId ? {
+				physicalId: input.knownPhysicalId,
+				attributes: { Arn: response.Policy.PolicyArn ?? "" }
+			} : null;
+		} catch (err) {
+			if (err instanceof ResourceNotFoundException$12) return null;
+			throw err;
+		}
+		if (!input.cdkPath) return null;
+		const list = await this.getClient().send(new GetLifecyclePoliciesCommand({}));
+		for (const policy of list.Policies ?? []) {
+			if (!policy.PolicyId) continue;
+			if (policy.Tags?.["aws:cdk:path"] === input.cdkPath) return {
+				physicalId: policy.PolicyId,
+				attributes: {}
+			};
+		}
+		return null;
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/s3-vectors-provider.ts
 /**
@@ -35235,11 +35795,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$15({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$17({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$15({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$17({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -35367,7 +35927,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -35403,7 +35963,7 @@ var S3VectorsProvider = class {
 			for (const bucket of list.vectorBuckets ?? []) {
 				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) continue;
 				try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.vectorBucketName,
 						attributes: {}
 					};
@@ -36013,7 +36573,7 @@ var S3TablesProvider = class {
 					attributes: {}
 				};
 				if (input.cdkPath) try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.arn,
 						attributes: {}
 					};
@@ -36080,7 +36640,7 @@ var S3TablesProvider = class {
 							for (const table of tables.tables ?? []) {
 								if (!table.name || !table.tableARN) continue;
 								try {
-									if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+									if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 										physicalId: `${bucket.arn}|${namespaceName}|${table.name}`,
 										attributes: {}
 									};
@@ -36176,7 +36736,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -36230,7 +36790,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$18({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -36239,7 +36799,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$16({
+			await this.getClient().send(new TagResourceCommand$18({
 				resourceArn,
 				tags: upserts
 			}));
@@ -36271,7 +36831,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$16({
+			await this.getClient().send(new UntagResourceCommand$18({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -36280,7 +36840,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$16({
+			await this.getClient().send(new TagResourceCommand$18({
 				resourceArn,
 				tags: upserts
 			}));
@@ -37927,6 +38487,8 @@ function registerAllProviders(registry) {
 	registry.register("AWS::KinesisFirehose::DeliveryStream", new FirehoseProvider());
 	registry.register("AWS::CloudTrail::Trail", new CloudTrailProvider());
 	registry.register("AWS::CodeBuild::Project", new CodeBuildProvider());
+	registry.register("AWS::CodeCommit::Repository", new CodeCommitRepositoryProvider());
+	registry.register("AWS::DLM::LifecyclePolicy", new DLMLifecyclePolicyProvider());
 	registry.register("AWS::S3Vectors::VectorBucket", new S3VectorsProvider());
 	registry.register("AWS::ECR::Repository", new ECRProvider());
 	registry.register("AWS::AutoScaling::AutoScalingGroup", new ASGProvider());
@@ -57199,7 +57761,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.238.6");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.240.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());