@go-to-k/cdkd 0.239.0 → 0.240.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-8lyaaElh.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-D_OJrSGP.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -61,9 +61,10 @@ import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand,
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
-import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16 } from "@aws-sdk/client-s3vectors";
-import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$18, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17 } from "@aws-sdk/client-s3tables";
+import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$17, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$15, UntagResourceCommand as UntagResourceCommand$15, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$16, UntagResourceCommand as UntagResourceCommand$16, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
+import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$18, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$17, UntagResourceCommand as UntagResourceCommand$17 } from "@aws-sdk/client-s3vectors";
+import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$19, NotFoundException as NotFoundException$5, S3TablesClient, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18 } from "@aws-sdk/client-s3tables";
 import { Document, Pair, Scalar, YAMLMap, YAMLSeq, parse as parse$1, stringify } from "yaml";
 import { createLocalStartAgentCoreCommand, createLocalStartCloudFrontCommand, createLocalStateProvider, getEmbedConfig, isCfnFlagPresent, listTargets, rejectExplicitCfnStackWithMultipleStacks, resolveCfnFallbackRegion, setEmbedConfig, substituteAgainstState, substituteAgainstStateAsync, substituteEnvVarsFromState, substituteEnvVarsFromStateAsync } from "cdk-local";
 import { A2A_CONTAINER_PORT, A2A_PATH, AGENTCORE_A2A_PROTOCOL, AGENTCORE_AGUI_PROTOCOL, AGENTCORE_MCP_PROTOCOL, ConnectionRegistry, EcsTaskResolutionError, HOST_GATEWAY_MIN_VERSION, LocalInvokeBuildError, MCP_CONTAINER_PORT, MCP_PATH, a2aInvokeOnce, addAlbSpecificOptions, addCommonEcsServiceOptions, addStartServiceSpecificOptions, albStrategy, architectureToPlatform, attachAuthorizers, attachStageContext, availableApiIdentifiers, bufferToBody, buildAgentCoreCodeImage, buildCognitoJwksUrl, buildConnectEvent, buildContainerImage, buildCorsConfigByApiId, buildCorsConfigFromCloudFrontChain, buildDisconnectEvent, buildJwksUrlFromIssuer, buildMessageEvent, buildMgmtEndpointEnvUrl, buildStageMap, classifySourceChange, createAuthorizerCache, createFileWatcher, createFileWatcher as createFileWatcher$1, createJwksCache, createWatchPredicates, defaultCredentialsLoader, derivePseudoParametersFromRegion, discoverRoutes, discoverWebSocketApis, downloadAndExtractS3Bundle, filterRoutesByApiIdentifier, groupRoutesByServer, handleConnectionsRequest, invokeAgentCore, invokeAgentCoreWs, materializeLayerFromArn, mcpInvokeOnce, parseConnectionsPath, parseSelectionExpressionPath, pickAgentCoreCandidateStack, pickAgentCoreCandidateStack as pickAgentCoreCandidateStack$1, probeHostGatewaySupport, readMtlsMaterialsFromDisk, resolveAgentCoreTarget, resolveEnvVars, resolveHostGatewayExtraHosts, resolveRuntimeCodeMountPath, resolveRuntimeFileExtension, resolveRuntimeImage, resolveSingleTarget, resolveWatchConfig, runEcsServiceEmulator, signAgentCoreInvocation, startApiServer, substituteImagePlaceholders, tryResolveImageFnJoin, verifyJwtViaDiscovery, waitForAgentCorePing } from "cdk-local/internal";
@@ -1886,7 +1887,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.239.0";
+	return "0.240.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -35163,6 +35164,293 @@ var CodeBuildProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/codecommit-repository-provider.ts
+/**
+* Convert the CFn `Tags` list shape to CodeCommit's `Record<string, string>`
+* map. Entries without a string `Key` are skipped; non-string values are
+* stringified (post-intrinsic-resolution values can be numbers/booleans).
+* Returns `undefined` for an absent/empty list so callers can omit the field.
+*/
+function toSdkTagMap(tags) {
+	if (!tags || tags.length === 0) return void 0;
+	const out = {};
+	for (const tag of tags) {
+		if (typeof tag?.Key !== "string" || tag.Key.length === 0) continue;
+		const value = tag.Value;
+		out[tag.Key] = typeof value === "string" ? value : typeof value === "number" || typeof value === "boolean" ? String(value) : "";
+	}
+	return Object.keys(out).length > 0 ? out : void 0;
+}
+/** Order-independent equality for two SDK tag maps. */
+function tagMapsEqual(a, b) {
+	const aKeys = Object.keys(a);
+	if (aKeys.length !== Object.keys(b).length) return false;
+	return aKeys.every((k) => b[k] === a[k]);
+}
+/**
+* AWS CodeCommit Repository Provider
+*
+* Implements resource provisioning for AWS::CodeCommit::Repository using the
+* CodeCommit SDK. The type is `ProvisioningType: NON_PROVISIONABLE`, so the
+* Cloud Control fallback cannot handle it — without this SDK provider cdkd's
+* pre-flight rejects the type outright (issue #1045). CodeCommit returned to
+* full General Availability on 2025-11-24, so the service is fully usable for
+* new sign-ups again.
+*
+* Physical id: the repository NAME (every CodeCommit API is name-based;
+* there is no lookup-by-id API). CloudFormation's `Ref` returns the
+* repository ID (a GUID), so `create()` stores `RepositoryId` in attributes
+* and the intrinsic resolver's `cfnRefValueFromPhysicalId` recovers it via
+* `stateLookup` for CFn `Ref` parity.
+*/
+var CodeCommitRepositoryProvider = class {
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("CodeCommitRepositoryProvider");
+	handledProperties = new Map([["AWS::CodeCommit::Repository", new Set([
+		"RepositoryName",
+		"RepositoryDescription",
+		"KmsKeyId",
+		"Tags"
+	])]]);
+	unhandledByDesign = new Map([["AWS::CodeCommit::Repository", new Map([["Code", "CFn-only seed-content orchestration (S3 zip unpacked into an initial commit on a chosen branch); not wired in v1 — pre-flight rejects templates carrying it so nothing is silently dropped; a follow-up could implement it via CreateCommit/PutFile"], ["Triggers", "repository trigger management not wired in v1 — pre-flight rejects templates carrying it so nothing is silently dropped; a follow-up could implement it via PutRepositoryTriggers"]])]]);
+	getClient() {
+		if (!this.client) this.client = new CodeCommitClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	/**
+	* Build the `Fn::GetAtt` attribute map from a `RepositoryMetadata`
+	* response. `RepositoryId` is additionally stored so the intrinsic
+	* resolver can recover CFn's `Ref` value (the repository ID) from state.
+	*/
+	toAttributes(metadata) {
+		return {
+			Arn: metadata?.Arn ?? "",
+			CloneUrlHttp: metadata?.cloneUrlHttp ?? "",
+			CloneUrlSsh: metadata?.cloneUrlSsh ?? "",
+			Name: metadata?.repositoryName ?? "",
+			KmsKeyId: metadata?.kmsKeyId ?? "",
+			RepositoryId: metadata?.repositoryId ?? ""
+		};
+	}
+	/**
+	* Create a CodeCommit Repository
+	*/
+	async create(logicalId, resourceType, properties) {
+		this.logger.debug(`Creating CodeCommit Repository ${logicalId}`);
+		const repositoryName = properties["RepositoryName"] || generateResourceName(logicalId, { maxLength: 100 });
+		try {
+			const tags = toSdkTagMap(properties["Tags"]);
+			const description = properties["RepositoryDescription"];
+			const kmsKeyId = properties["KmsKeyId"];
+			const metadata = (await this.getClient().send(new CreateRepositoryCommand$1({
+				repositoryName,
+				...description !== void 0 ? { repositoryDescription: description } : {},
+				...kmsKeyId !== void 0 ? { kmsKeyId } : {},
+				...tags ? { tags } : {}
+			}))).repositoryMetadata;
+			if (!metadata?.repositoryName) throw new Error("CreateRepository did not return repository metadata");
+			this.logger.debug(`Successfully created CodeCommit Repository ${logicalId}: ${metadata.repositoryName}`);
+			return {
+				physicalId: metadata.repositoryName,
+				attributes: this.toAttributes(metadata)
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, repositoryName, cause);
+		}
+	}
+	/**
+	* Update a CodeCommit Repository
+	*
+	* Mutable properties: RepositoryName (UpdateRepositoryName — CFn's docs
+	* mark the property "Update requires: No interruption" and the registry
+	* schema's createOnlyProperties is empty, so CFn parity is an IN-PLACE
+	* rename that preserves the repository's git history; the repository ID —
+	* CFn's `Ref` value — survives the rename), RepositoryDescription
+	* (UpdateRepositoryDescription), KmsKeyId (UpdateRepositoryEncryptionKey),
+	* Tags (TagResource / UntagResource — full tag removal handled explicitly,
+	* see the ECR Tags regression class in issue #981).
+	*
+	* A rename returns the NEW repository name as `physicalId` with
+	* `wasReplaced: false`; the deploy engine persists the returned physical
+	* id into state unconditionally.
+	*/
+	async update(logicalId, physicalId, _resourceType, properties, previousProperties) {
+		this.logger.debug(`Updating CodeCommit Repository ${logicalId} (${physicalId})`);
+		let currentName = physicalId;
+		try {
+			const newName = properties["RepositoryName"];
+			if (newName && newName !== physicalId) {
+				try {
+					await this.getClient().send(new UpdateRepositoryNameCommand({
+						oldName: physicalId,
+						newName
+					}));
+				} catch (err) {
+					if (!(err instanceof RepositoryDoesNotExistException)) throw err;
+					await this.getRepositoryMetadata(newName);
+					this.logger.debug(`Rename ${physicalId} -> ${newName} already applied by a previous attempt`);
+				}
+				currentName = newName;
+				this.logger.debug(`Renamed CodeCommit Repository ${physicalId} -> ${newName}`);
+			}
+			const newDescription = properties["RepositoryDescription"];
+			if (newDescription !== previousProperties["RepositoryDescription"]) {
+				await this.getClient().send(new UpdateRepositoryDescriptionCommand({
+					repositoryName: currentName,
+					repositoryDescription: newDescription ?? ""
+				}));
+				this.logger.debug(`Updated description for ${currentName}`);
+			}
+			const newKmsKeyId = properties["KmsKeyId"];
+			if (newKmsKeyId !== previousProperties["KmsKeyId"]) {
+				await this.getClient().send(new UpdateRepositoryEncryptionKeyCommand({
+					repositoryName: currentName,
+					kmsKeyId: newKmsKeyId ?? "alias/aws/codecommit"
+				}));
+				this.logger.debug(`Updated encryption key for ${currentName}`);
+			}
+			const newTags = properties["Tags"];
+			const oldTags = previousProperties["Tags"];
+			const newTagMap = toSdkTagMap(newTags) ?? {};
+			const oldTagMap = toSdkTagMap(oldTags) ?? {};
+			let metadata;
+			if (!tagMapsEqual(newTagMap, oldTagMap)) {
+				metadata = await this.getRepositoryMetadata(currentName);
+				const repoArn = metadata?.Arn;
+				if (repoArn) {
+					const removedKeys = Object.keys(oldTagMap).filter((k) => !(k in newTagMap));
+					if (removedKeys.length > 0) await this.getClient().send(new UntagResourceCommand$15({
+						resourceArn: repoArn,
+						tagKeys: removedKeys
+					}));
+					if (Object.keys(newTagMap).length > 0) await this.getClient().send(new TagResourceCommand$15({
+						resourceArn: repoArn,
+						tags: newTagMap
+					}));
+					this.logger.debug(`Updated tags for ${currentName}`);
+				} else this.logger.warn(`Could not resolve ARN for CodeCommit Repository ${currentName}; tag update skipped`);
+			}
+			metadata = await this.getRepositoryMetadata(currentName);
+			return {
+				physicalId: currentName,
+				wasReplaced: false,
+				attributes: this.toAttributes(metadata)
+			};
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, _resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Delete a CodeCommit Repository
+	*
+	* `DeleteRepository` is idempotent on the AWS side: for an
+	* already-deleted repository it does NOT throw — it returns a null
+	* `repositoryId`. That silent-success shape would bypass the shared
+	* region check entirely (the exact scenario `assertRegionMatch` exists
+	* for: a client pointed at region B while the state says the repo lives
+	* in region A), so a null `repositoryId` runs the region check before
+	* being treated as idempotent success. A
+	* `RepositoryDoesNotExistException` is additionally handled (same
+	* check) for defense in depth.
+	*/
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting CodeCommit Repository ${logicalId}: ${physicalId}`);
+		let deletedRepositoryId;
+		try {
+			deletedRepositoryId = (await this.getClient().send(new DeleteRepositoryCommand$1({ repositoryName: physicalId }))).repositoryId;
+		} catch (error) {
+			if (error instanceof RepositoryDoesNotExistException) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`CodeCommit Repository ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to delete CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		if (!deletedRepositoryId) {
+			assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+			this.logger.debug(`CodeCommit Repository ${physicalId} does not exist, skipping deletion`);
+			return;
+		}
+		this.logger.debug(`Successfully deleted CodeCommit Repository ${logicalId}`);
+	}
+	/**
+	* Get repository attributes for Fn::GetAtt resolution.
+	*
+	* Supported: `Arn`, `CloneUrlHttp`, `CloneUrlSsh`, `Name`, `KmsKeyId`
+	* (the CFn-documented attribute set).
+	*/
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		switch (attributeName) {
+			case "Name": return physicalId;
+			case "Arn":
+			case "CloneUrlHttp":
+			case "CloneUrlSsh":
+			case "KmsKeyId": {
+				const metadata = await this.getRepositoryMetadata(physicalId);
+				return this.toAttributes(metadata)[attributeName];
+			}
+			default: return;
+		}
+	}
+	/**
+	* Adopt an existing CodeCommit repository into cdkd state.
+	*
+	* Lookup order:
+	*  1. `--resource` override or `Properties.RepositoryName` → verify via
+	*     `GetRepository`.
+	*  2. `ListRepositories` paginated, then `ListTagsForResource(arn)` per
+	*     repository to match `aws:cdk:path` (CodeCommit uses the
+	*     `Record<string, string>` tag-map shape).
+	*/
+	async import(input) {
+		const explicit = resolveExplicitPhysicalId(input, "RepositoryName");
+		if (explicit) try {
+			const resp = await this.getClient().send(new GetRepositoryCommand({ repositoryName: explicit }));
+			return resp.repositoryMetadata?.repositoryName ? {
+				physicalId: explicit,
+				attributes: this.toAttributes(resp.repositoryMetadata)
+			} : null;
+		} catch (err) {
+			if (err instanceof RepositoryDoesNotExistException) return null;
+			throw err;
+		}
+		if (!input.cdkPath) return null;
+		let nextToken;
+		do {
+			const list = await this.getClient().send(new ListRepositoriesCommand({ ...nextToken && { nextToken } }));
+			for (const repo of list.repositories ?? []) {
+				if (!repo.repositoryName) continue;
+				let metadata;
+				try {
+					metadata = await this.getRepositoryMetadata(repo.repositoryName);
+				} catch (err) {
+					if (err instanceof RepositoryDoesNotExistException) continue;
+					throw err;
+				}
+				if (!metadata?.Arn) continue;
+				if ((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: metadata.Arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					physicalId: repo.repositoryName,
+					attributes: this.toAttributes(metadata)
+				};
+			}
+			nextToken = list.nextToken;
+		} while (nextToken);
+		return null;
+	}
+	/**
+	* Fetch the repository's metadata via `GetRepository`. Throws
+	* `RepositoryDoesNotExistException` through to the caller.
+	*/
+	async getRepositoryMetadata(repositoryName) {
+		return (await this.getClient().send(new GetRepositoryCommand({ repositoryName }))).repositoryMetadata;
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/dlm-lifecycle-policy-provider.ts
 /**
@@ -35295,7 +35583,7 @@ var DLMLifecyclePolicyProvider = class {
 			if (tagsChanged && arn) {
 				const removedKeys = Object.keys(oldTags).filter((k) => !(k in newTags));
 				if (removedKeys.length > 0) {
-					await this.getClient().send(new UntagResourceCommand$15({
+					await this.getClient().send(new UntagResourceCommand$16({
 						ResourceArn: arn,
 						TagKeys: removedKeys
 					}));
@@ -35304,7 +35592,7 @@ var DLMLifecyclePolicyProvider = class {
 				const tagsToAdd = {};
 				for (const [k, v] of Object.entries(newTags)) if (oldTags[k] !== v) tagsToAdd[k] = v;
 				if (Object.keys(tagsToAdd).length > 0) {
-					await this.getClient().send(new TagResourceCommand$15({
+					await this.getClient().send(new TagResourceCommand$16({
 						ResourceArn: arn,
 						Tags: tagsToAdd
 					}));
@@ -35507,11 +35795,11 @@ var S3VectorsProvider = class {
 		}
 		if (!resourceArn) throw new ProvisioningError(`Could not resolve ARN for S3 VectorBucket ${logicalId} (${physicalId}); cannot apply tag update.`, resourceType, logicalId, physicalId);
 		try {
-			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$16({
+			if (Object.keys(toSet).length > 0) await this.getClient().send(new TagResourceCommand$17({
 				resourceArn,
 				tags: toSet
 			}));
-			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$16({
+			if (toRemove.length > 0) await this.getClient().send(new UntagResourceCommand$17({
 				resourceArn,
 				tagKeys: toRemove
 			}));
@@ -35639,7 +35927,7 @@ var S3VectorsProvider = class {
 			if (Object.keys(enc).length > 0) result["EncryptionConfiguration"] = enc;
 		}
 		if (bucket?.vectorBucketArn) try {
-			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags);
+			result["Tags"] = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags);
 		} catch (err) {
 			this.logger.debug(`S3Vectors ListTagsForResource(${bucket.vectorBucketArn}) failed: ${err instanceof Error ? err.message : String(err)}`);
 			result["Tags"] = [];
@@ -35675,7 +35963,7 @@ var S3VectorsProvider = class {
 			for (const bucket of list.vectorBuckets ?? []) {
 				if (!bucket.vectorBucketName || !bucket.vectorBucketArn) continue;
 				try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$17({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.vectorBucketArn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.vectorBucketName,
 						attributes: {}
 					};
@@ -36285,7 +36573,7 @@ var S3TablesProvider = class {
 					attributes: {}
 				};
 				if (input.cdkPath) try {
-					if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+					if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: bucket.arn }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 						physicalId: bucket.arn,
 						attributes: {}
 					};
@@ -36352,7 +36640,7 @@ var S3TablesProvider = class {
 							for (const table of tables.tables ?? []) {
 								if (!table.name || !table.tableARN) continue;
 								try {
-									if ((await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
+									if ((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: table.tableARN }))).tags?.["aws:cdk:path"] === input.cdkPath) return {
 										physicalId: `${bucket.arn}|${namespaceName}|${table.name}`,
 										attributes: {}
 									};
@@ -36448,7 +36736,7 @@ var S3TablesProvider = class {
 	*/
 	async readTagsBestEffort(resourceArn) {
 		try {
-			const tags = (await this.getClient().send(new ListTagsForResourceCommand$18({ resourceArn }))).tags ?? {};
+			const tags = (await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn }))).tags ?? {};
 			const out = [];
 			for (const [Key, Value] of Object.entries(tags)) out.push({
 				Key,
@@ -36502,7 +36790,7 @@ var S3TablesProvider = class {
 		const resourceArn = await this.lookupTableArn(tableBucketARN, namespace, name);
 		if (!resourceArn) throw new ProvisioningError(`applyTableTagsDiff: GetTable returned no tableARN for ${physicalId} — table is gone or state is out-of-sync. Refusing to silently drop the tag update (run 'cdkd state orphan ${logicalId}' to clean up if the table was deleted out-of-band).`, resourceType, logicalId, physicalId);
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$17({
+			await this.getClient().send(new UntagResourceCommand$18({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -36511,7 +36799,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$17({
+			await this.getClient().send(new TagResourceCommand$18({
 				resourceArn,
 				tags: upserts
 			}));
@@ -36543,7 +36831,7 @@ var S3TablesProvider = class {
 		if (removedKeys.length === 0 && Object.keys(upserts).length === 0) return;
 		const resourceArn = physicalId;
 		if (removedKeys.length > 0) try {
-			await this.getClient().send(new UntagResourceCommand$17({
+			await this.getClient().send(new UntagResourceCommand$18({
 				resourceArn,
 				tagKeys: removedKeys
 			}));
@@ -36552,7 +36840,7 @@ var S3TablesProvider = class {
 			throw new ProvisioningError(`applyTableBucketTagsDiff: UntagResource failed for ${resourceArn} (keys: ${removedKeys.join(", ")}): ${err instanceof Error ? err.message : String(err)}. State has NOT been updated so the next deploy will retry the tag-diff.`, resourceType, logicalId, physicalId, cause);
 		}
 		if (Object.keys(upserts).length > 0) try {
-			await this.getClient().send(new TagResourceCommand$17({
+			await this.getClient().send(new TagResourceCommand$18({
 				resourceArn,
 				tags: upserts
 			}));
@@ -38199,6 +38487,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::KinesisFirehose::DeliveryStream", new FirehoseProvider());
 	registry.register("AWS::CloudTrail::Trail", new CloudTrailProvider());
 	registry.register("AWS::CodeBuild::Project", new CodeBuildProvider());
+	registry.register("AWS::CodeCommit::Repository", new CodeCommitRepositoryProvider());
 	registry.register("AWS::DLM::LifecyclePolicy", new DLMLifecyclePolicyProvider());
 	registry.register("AWS::S3Vectors::VectorBucket", new S3VectorsProvider());
 	registry.register("AWS::ECR::Repository", new ECRProvider());
@@ -57472,7 +57761,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.239.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.240.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());