@go-to-k/cdkd 0.244.0 → 0.246.0

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-3KNTmr1u.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-Ci_7Y2ol.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -60,8 +60,9 @@ import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPer
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
+import { AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ModifyClusterCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
-import { AddTagsCommand as AddTagsCommand$1, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$1, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
+import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
 import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
@@ -1889,7 +1890,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.244.0";
+	return "0.246.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -34411,8 +34412,8 @@ var EFSProvider = class {
 * storage-capacity growth and deletes can take substantially longer —
 * mirror the Custom Resource provider's 1-hour ceiling.
 */
-const DEFAULT_MAX_WAIT_MS = 3600 * 1e3;
-const DEFAULT_POLL_INTERVAL_MS = 15e3;
+const DEFAULT_MAX_WAIT_MS$1 = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
 /**
 * Lustre sub-properties that `UpdateFileSystem` accepts (the mutable
 * subset of the CFn `LustreConfiguration` block). Everything else in the
@@ -34443,8 +34444,8 @@ const TOP_LEVEL_IMMUTABLE_PROPS = [
 	"KmsKeyId",
 	"BackupId"
 ];
-const toNumber = (v) => v === void 0 ? void 0 : Number(v);
-const toBoolean = (v) => {
+const toNumber$1 = (v) => v === void 0 ? void 0 : Number(v);
+const toBoolean$1 = (v) => {
 	if (v === void 0) return void 0;
 	if (typeof v === "string") return v === "true";
 	return Boolean(v);
@@ -34495,8 +34496,8 @@ var FSxFileSystemProvider = class {
 	pollIntervalMs;
 	maxWaitMs;
 	constructor(options) {
-		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$1;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$1;
 	}
 	handledProperties = new Map([["AWS::FSx::FileSystem", new Set([
 		"BackupId",
@@ -34550,7 +34551,7 @@ var FSxFileSystemProvider = class {
 			SecurityGroupIds: properties["SecurityGroupIds"],
 			KmsKeyId: properties["KmsKeyId"],
 			StorageType: properties["StorageType"],
-			StorageCapacity: toNumber(properties["StorageCapacity"]),
+			StorageCapacity: toNumber$1(properties["StorageCapacity"]),
 			FileSystemTypeVersion: properties["FileSystemTypeVersion"],
 			NetworkType: properties["NetworkType"],
 			LustreConfiguration: this.toCreateLustreConfiguration(properties["LustreConfiguration"]),
@@ -34603,24 +34604,24 @@ var FSxFileSystemProvider = class {
 			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
 			ImportPath: config["ImportPath"],
 			ExportPath: config["ExportPath"],
-			ImportedFileChunkSize: toNumber(config["ImportedFileChunkSize"]),
+			ImportedFileChunkSize: toNumber$1(config["ImportedFileChunkSize"]),
 			DeploymentType: config["DeploymentType"],
 			AutoImportPolicy: config["AutoImportPolicy"],
-			PerUnitStorageThroughput: toNumber(config["PerUnitStorageThroughput"]),
+			PerUnitStorageThroughput: toNumber$1(config["PerUnitStorageThroughput"]),
 			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
-			AutomaticBackupRetentionDays: toNumber(config["AutomaticBackupRetentionDays"]),
-			CopyTagsToBackups: toBoolean(config["CopyTagsToBackups"]),
+			AutomaticBackupRetentionDays: toNumber$1(config["AutomaticBackupRetentionDays"]),
+			CopyTagsToBackups: toBoolean$1(config["CopyTagsToBackups"]),
 			DriveCacheType: config["DriveCacheType"],
 			DataCompressionType: config["DataCompressionType"],
-			EfaEnabled: toBoolean(config["EfaEnabled"]),
-			ThroughputCapacity: toNumber(config["ThroughputCapacity"]),
+			EfaEnabled: toBoolean$1(config["EfaEnabled"]),
+			ThroughputCapacity: toNumber$1(config["ThroughputCapacity"]),
 			MetadataConfiguration: metadata ? {
 				Mode: metadata["Mode"],
-				Iops: toNumber(metadata["Iops"])
+				Iops: toNumber$1(metadata["Iops"])
 			} : void 0,
 			DataReadCacheConfiguration: readCache ? {
 				SizingMode: readCache["SizingMode"],
-				SizeGiB: toNumber(readCache["SizeGiB"])
+				SizeGiB: toNumber$1(readCache["SizeGiB"])
 			} : void 0
 		};
 	}
@@ -34650,7 +34651,7 @@ var FSxFileSystemProvider = class {
 				case "AutomaticBackupRetentionDays":
 				case "PerUnitStorageThroughput":
 				case "ThroughputCapacity":
-					lustreMutableDiff[key] = toNumber(next);
+					lustreMutableDiff[key] = toNumber$1(next);
 					break;
 				case "AutoImportPolicy":
 				case "DataCompressionType":
@@ -34660,7 +34661,7 @@ var FSxFileSystemProvider = class {
 					const metadata = next;
 					lustreMutableDiff.MetadataConfiguration = metadata ? {
 						Mode: metadata["Mode"],
-						Iops: toNumber(metadata["Iops"])
+						Iops: toNumber$1(metadata["Iops"])
 					} : void 0;
 					break;
 				}
@@ -34668,7 +34669,7 @@ var FSxFileSystemProvider = class {
 					const readCache = next;
 					lustreMutableDiff.DataReadCacheConfiguration = readCache ? {
 						SizingMode: readCache["SizingMode"],
-						SizeGiB: toNumber(readCache["SizeGiB"])
+						SizeGiB: toNumber$1(readCache["SizeGiB"])
 					} : void 0;
 					break;
 				}
@@ -34694,7 +34695,7 @@ var FSxFileSystemProvider = class {
 				const callTimeMs = Date.now();
 				const respPendingActions = ((await this.getClient().send(new UpdateFileSystemCommand$1({
 					FileSystemId: physicalId,
-					...storageCapacityChanged && { StorageCapacity: toNumber(properties["StorageCapacity"]) },
+					...storageCapacityChanged && { StorageCapacity: toNumber$1(properties["StorageCapacity"]) },
 					...storageTypeChanged && { StorageType: properties["StorageType"] },
 					...typeVersionChanged && { FileSystemTypeVersion: properties["FileSystemTypeVersion"] },
 					...networkTypeChanged && { NetworkType: properties["NetworkType"] },
@@ -34998,6 +34999,528 @@ var FSxFileSystemProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/emr-cluster-provider.ts
+/**
+* Default polling budget for EMR cluster lifecycle transitions. A cluster
+* create (RunJobFlow → WAITING/RUNNING) typically takes 5-15 minutes
+* (instance provisioning + bootstrap + application install), and a delete
+* (TerminateJobFlows → TERMINATED) 5-10 minutes. Mirror the Custom Resource /
+* FSx providers' 1-hour ceiling so the slowest realistic create/terminate
+* still fits inside the per-resource deadline.
+*/
+const DEFAULT_MAX_WAIT_MS = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS = 15e3;
+/** Cluster states that mean "create succeeded, the cluster is up". */
+const CREATE_READY_STATES = new Set(["WAITING", "RUNNING"]);
+/**
+* Cluster states that mean "the cluster is gone" (for delete polling and
+* delete idempotency). `TERMINATED_WITH_ERRORS` still counts as gone — the
+* cluster no longer bills — but is logged so a failed terminate is visible.
+*/
+const TERMINAL_STATES = new Set(["TERMINATED", "TERMINATED_WITH_ERRORS"]);
+/**
+* Top-level CFn properties that map to a MUTABLE EMR API surface. Every other
+* property is either registry-createOnly (routed through DELETE+CREATE by the
+* replacement-detection layer) or lives inside the `Instances` block (handled
+* specially in `update()` — only `TerminationProtected` is mutable there).
+*/
+const MUTABLE_TOP_LEVEL_PROPS = new Set([
+	"Tags",
+	"VisibleToAllUsers",
+	"StepConcurrencyLevel",
+	"ManagedScalingPolicy",
+	"AutoTerminationPolicy"
+]);
+const toNumber = (v) => {
+	if (v === void 0) return void 0;
+	const n = Number(v);
+	return Number.isNaN(n) ? void 0 : n;
+};
+const toBoolean = (v) => {
+	if (v === void 0) return void 0;
+	if (typeof v === "string") return v === "true";
+	return Boolean(v);
+};
+const jsonEqual = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+/**
+* SDK Provider for `AWS::EMR::Cluster` (EMR on EC2).
+*
+* The type is `ProvisioningType: NON_PROVISIONABLE` in the CFn registry, so
+* cdkd's Cloud Control fallback cannot handle it (issue #1043) — pre-flight
+* would otherwise reject it via `unsupported-types.generated.ts`.
+*
+* Lifecycle — a cluster is a stateful, per-instance-hour-billed resource, so
+* every path is polled to completion:
+*  - `create` → `RunJobFlow` + poll `DescribeCluster` until `WAITING`/`RUNNING`
+*    (the cluster is up and idle / running steps). A `TERMINATED*` terminal
+*    during create is a hard error; the partially-created cluster is
+*    best-effort terminated so it does not bill.
+*  - `update` → the limited mutable surface only: `SetTerminationProtection`
+*    (`Instances.TerminationProtected`), `SetVisibleToAllUsers`,
+*    `ModifyCluster` (`StepConcurrencyLevel`), managed-scaling / auto-
+*    termination policy APIs, and `AddTags`/`RemoveTags`. Everything else
+*    (instance topology, applications, release label, ...) is createOnly →
+*    replacement via the schema fallback; a change that reaches `update()`
+*    anyway is refused with a `--replace` pointer.
+*  - `delete` → `TerminateJobFlows` + poll until `TERMINATED`. Idempotent on
+*    an already-gone cluster (`assertRegionMatch` guards the region). Honors
+*    termination protection: under `--remove-protection` it flips
+*    `SetTerminationProtection(false)` first (mirroring the EC2/ASG pattern).
+*
+* `getMinResourceTimeoutMs()` lifts the deploy engine's per-resource deadline
+* to the polling ceiling (mirrors `CustomResourceProvider` / `FSxFileSystem
+* Provider`), so slow EMR creates/terminates don't require `--resource-timeout`.
+*/
+var EMRClusterProvider = class {
+	/**
+	* Cloud Control has NO handlers for this type (`ProvisioningType:
+	* NON_PROVISIONABLE`), so the deploy engine's #614 silent-drop auto-route
+	* MUST NOT send an unhandled-property EMR template to CC — it would fail at
+	* provisioning time with an opaque UnsupportedActionException. With this
+	* opt-out the ProviderRegistry rejects such templates pre-flight with a
+	* clear error instead.
+	*/
+	disableCcApiFallback = true;
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("EMRClusterProvider");
+	pollIntervalMs;
+	maxWaitMs;
+	constructor(options) {
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
+	}
+	handledProperties = new Map([["AWS::EMR::Cluster", new Set([
+		"AdditionalInfo",
+		"Applications",
+		"AutoScalingRole",
+		"AutoTerminationPolicy",
+		"BootstrapActions",
+		"Configurations",
+		"CustomAmiId",
+		"EbsRootVolumeIops",
+		"EbsRootVolumeSize",
+		"EbsRootVolumeThroughput",
+		"Instances",
+		"JobFlowRole",
+		"KerberosAttributes",
+		"LogEncryptionKmsKeyId",
+		"LogUri",
+		"ManagedScalingPolicy",
+		"Name",
+		"OSReleaseLabel",
+		"PlacementGroupConfigs",
+		"ReleaseLabel",
+		"ScaleDownBehavior",
+		"SecurityConfiguration",
+		"ServiceRole",
+		"StepConcurrencyLevel",
+		"Steps",
+		"Tags",
+		"VisibleToAllUsers"
+	])]]);
+	getClient() {
+		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	/**
+	* Self-reported minimum per-resource timeout: the deploy engine resolves
+	* `max(getMinResourceTimeoutMs(), globalCliDefault)` so EMR's slow
+	* create/terminate polling fits inside the resource deadline without the
+	* user passing `--resource-timeout`.
+	*
+	* Return the poll ceiling PLUS one poll interval (not exactly `maxWaitMs`):
+	* the deploy engine's `withResourceDeadline` is a non-cancelling
+	* `Promise.race`, so if the external deadline were exactly equal to the
+	* internal poll ceiling the two could fire together and the external one
+	* could win — leaving the internal timeout + best-effort rollback terminate
+	* un-run and (if the CLI then exits) a live cluster billing. The extra
+	* interval guarantees the internal `waitForCluster*` timeout fires first and
+	* the rollback path always runs.
+	*/
+	getMinResourceTimeoutMs() {
+		return this.maxWaitMs + this.pollIntervalMs;
+	}
+	async create(logicalId, resourceType, properties) {
+		if (resourceType !== "AWS::EMR::Cluster") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		this.logger.debug(`Creating EMR Cluster ${logicalId}`);
+		let clusterId;
+		try {
+			const tags = properties["Tags"];
+			const input = {
+				Name: properties["Name"],
+				ReleaseLabel: properties["ReleaseLabel"],
+				ServiceRole: properties["ServiceRole"],
+				JobFlowRole: properties["JobFlowRole"],
+				LogUri: properties["LogUri"],
+				LogEncryptionKmsKeyId: properties["LogEncryptionKmsKeyId"],
+				AdditionalInfo: properties["AdditionalInfo"],
+				AutoScalingRole: properties["AutoScalingRole"],
+				ScaleDownBehavior: properties["ScaleDownBehavior"],
+				CustomAmiId: properties["CustomAmiId"],
+				OSReleaseLabel: properties["OSReleaseLabel"],
+				SecurityConfiguration: properties["SecurityConfiguration"],
+				EbsRootVolumeSize: toNumber(properties["EbsRootVolumeSize"]),
+				EbsRootVolumeIops: toNumber(properties["EbsRootVolumeIops"]),
+				EbsRootVolumeThroughput: toNumber(properties["EbsRootVolumeThroughput"]),
+				StepConcurrencyLevel: toNumber(properties["StepConcurrencyLevel"]),
+				VisibleToAllUsers: toBoolean(properties["VisibleToAllUsers"]),
+				Applications: properties["Applications"],
+				Configurations: properties["Configurations"],
+				BootstrapActions: properties["BootstrapActions"],
+				Steps: properties["Steps"],
+				KerberosAttributes: properties["KerberosAttributes"],
+				PlacementGroupConfigs: properties["PlacementGroupConfigs"],
+				ManagedScalingPolicy: this.toManagedScalingPolicy(properties["ManagedScalingPolicy"]),
+				AutoTerminationPolicy: this.toAutoTerminationPolicy(properties["AutoTerminationPolicy"]),
+				Tags: tags?.map((t) => ({
+					Key: t.Key,
+					Value: t.Value
+				})),
+				Instances: this.toJobFlowInstancesConfig(properties["Instances"])
+			};
+			clusterId = (await this.getClient().send(new RunJobFlowCommand(input))).JobFlowId;
+			if (!clusterId) throw new ProvisioningError(`EMR RunJobFlow for ${logicalId} returned no JobFlowId`, resourceType, logicalId);
+			const cluster = await this.waitForClusterReady(clusterId, logicalId, resourceType);
+			this.logger.debug(`Successfully created EMR Cluster ${logicalId}: ${clusterId}`);
+			return {
+				physicalId: clusterId,
+				attributes: this.buildAttributes(cluster)
+			};
+		} catch (error) {
+			if (clusterId !== void 0) try {
+				await this.getClient().send(new SetTerminationProtectionCommand({
+					JobFlowIds: [clusterId],
+					TerminationProtected: false
+				}));
+				await this.getClient().send(new TerminateJobFlowsCommand({ JobFlowIds: [clusterId] }));
+				this.logger.warn(`Rolled back partially-created EMR Cluster ${clusterId}`);
+			} catch (cleanupError) {
+				this.logger.warn(`Failed to roll back partially-created EMR Cluster ${clusterId}: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)} — terminate it manually to stop billing`);
+			}
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to create EMR Cluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	/**
+	* Map the CFn `Instances` (`JobFlowInstancesConfig`) block to the SDK
+	* `RunJobFlow.Instances` shape. Most field names are identical; the one
+	* structural difference is the role-keyed CFn groups/fleets
+	* (`MasterInstanceGroup` / `CoreInstanceGroup` / `TaskInstanceGroups` and
+	* the `*InstanceFleet(s)` siblings) which the SDK expresses as flat
+	* `InstanceGroups` / `InstanceFleets` arrays with an explicit
+	* `InstanceRole` / `InstanceFleetType` discriminator per entry.
+	*/
+	toJobFlowInstancesConfig(config) {
+		if (!config) return void 0;
+		const instanceGroups = [];
+		const pushGroup = (raw, role) => {
+			if (raw === void 0 || raw === null) return;
+			instanceGroups.push(this.toInstanceGroupConfig(raw, role));
+		};
+		pushGroup(config["MasterInstanceGroup"], "MASTER");
+		pushGroup(config["CoreInstanceGroup"], "CORE");
+		for (const task of config["TaskInstanceGroups"] ?? []) pushGroup(task, "TASK");
+		const instanceFleets = [];
+		const pushFleet = (raw, type) => {
+			if (raw === void 0 || raw === null) return;
+			instanceFleets.push(this.toInstanceFleetConfig(raw, type));
+		};
+		pushFleet(config["MasterInstanceFleet"], "MASTER");
+		pushFleet(config["CoreInstanceFleet"], "CORE");
+		for (const task of config["TaskInstanceFleets"] ?? []) pushFleet(task, "TASK");
+		return {
+			InstanceGroups: instanceGroups.length > 0 ? instanceGroups : void 0,
+			InstanceFleets: instanceFleets.length > 0 ? instanceFleets : void 0,
+			Ec2KeyName: config["Ec2KeyName"],
+			Ec2SubnetId: config["Ec2SubnetId"],
+			Ec2SubnetIds: config["Ec2SubnetIds"],
+			HadoopVersion: config["HadoopVersion"],
+			Placement: config["Placement"],
+			KeepJobFlowAliveWhenNoSteps: toBoolean(config["KeepJobFlowAliveWhenNoSteps"]),
+			TerminationProtected: toBoolean(config["TerminationProtected"]),
+			UnhealthyNodeReplacement: toBoolean(config["UnhealthyNodeReplacement"]),
+			EmrManagedMasterSecurityGroup: config["EmrManagedMasterSecurityGroup"],
+			EmrManagedSlaveSecurityGroup: config["EmrManagedSlaveSecurityGroup"],
+			ServiceAccessSecurityGroup: config["ServiceAccessSecurityGroup"],
+			AdditionalMasterSecurityGroups: config["AdditionalMasterSecurityGroups"],
+			AdditionalSlaveSecurityGroups: config["AdditionalSlaveSecurityGroups"]
+		};
+	}
+	toInstanceGroupConfig(raw, role) {
+		return {
+			InstanceRole: role,
+			InstanceType: raw["InstanceType"],
+			InstanceCount: toNumber(raw["InstanceCount"]),
+			Name: raw["Name"],
+			Market: raw["Market"],
+			BidPrice: raw["BidPrice"],
+			Configurations: raw["Configurations"],
+			EbsConfiguration: raw["EbsConfiguration"],
+			AutoScalingPolicy: raw["AutoScalingPolicy"],
+			CustomAmiId: raw["CustomAmiId"]
+		};
+	}
+	toInstanceFleetConfig(raw, type) {
+		return {
+			InstanceFleetType: type,
+			Name: raw["Name"],
+			TargetOnDemandCapacity: toNumber(raw["TargetOnDemandCapacity"]),
+			TargetSpotCapacity: toNumber(raw["TargetSpotCapacity"]),
+			InstanceTypeConfigs: raw["InstanceTypeConfigs"],
+			LaunchSpecifications: raw["LaunchSpecifications"],
+			ResizeSpecifications: raw["ResizeSpecifications"]
+		};
+	}
+	toManagedScalingPolicy(config) {
+		if (!config) return void 0;
+		const limits = config["ComputeLimits"];
+		if (!limits) return void 0;
+		return {
+			ComputeLimits: {
+				UnitType: limits["UnitType"],
+				MinimumCapacityUnits: toNumber(limits["MinimumCapacityUnits"]),
+				MaximumCapacityUnits: toNumber(limits["MaximumCapacityUnits"]),
+				MaximumOnDemandCapacityUnits: toNumber(limits["MaximumOnDemandCapacityUnits"]),
+				MaximumCoreCapacityUnits: toNumber(limits["MaximumCoreCapacityUnits"])
+			},
+			UtilizationPerformanceIndex: toNumber(config["UtilizationPerformanceIndex"]),
+			ScalingStrategy: config["ScalingStrategy"]
+		};
+	}
+	toAutoTerminationPolicy(config) {
+		if (!config) return void 0;
+		return { IdleTimeout: toNumber(config["IdleTimeout"]) };
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		const changed = (key) => !jsonEqual(properties[key], previousProperties[key]);
+		const nextInstances = properties["Instances"] ?? {};
+		const prevInstances = previousProperties["Instances"] ?? {};
+		let terminationProtectedChanged = false;
+		if (changed("Instances")) {
+			const instanceKeys = new Set([...Object.keys(nextInstances), ...Object.keys(prevInstances)]);
+			for (const key of instanceKeys) {
+				if (jsonEqual(nextInstances[key], prevInstances[key])) continue;
+				if (key === "TerminationProtected") {
+					terminationProtectedChanged = true;
+					continue;
+				}
+				throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster Instances.${key} is immutable on AWS — a running cluster's instance topology / networking cannot be changed in place. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+			}
+		}
+		for (const key of Object.keys({
+			...properties,
+			...previousProperties
+		})) {
+			if (key === "Instances") continue;
+			if (!changed(key)) continue;
+			if (!MUTABLE_TOP_LEVEL_PROPS.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR Cluster ${key} is immutable on AWS — it is fixed at cluster creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+		}
+		const visibleChanged = changed("VisibleToAllUsers");
+		const stepConcurrencyChanged = changed("StepConcurrencyLevel");
+		const managedScalingChanged = changed("ManagedScalingPolicy");
+		const autoTerminationChanged = changed("AutoTerminationPolicy");
+		const tagsChanged = changed("Tags");
+		if (!terminationProtectedChanged && !visibleChanged && !stepConcurrencyChanged && !managedScalingChanged && !autoTerminationChanged && !tagsChanged) {
+			this.logger.debug(`No mutable diff for EMR Cluster ${logicalId}, skipping update`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		}
+		this.logger.debug(`Updating EMR Cluster ${logicalId}: ${physicalId}`);
+		try {
+			if (terminationProtectedChanged) await this.getClient().send(new SetTerminationProtectionCommand({
+				JobFlowIds: [physicalId],
+				TerminationProtected: toBoolean(nextInstances["TerminationProtected"]) ?? false
+			}));
+			if (visibleChanged) await this.getClient().send(new SetVisibleToAllUsersCommand({
+				JobFlowIds: [physicalId],
+				VisibleToAllUsers: toBoolean(properties["VisibleToAllUsers"]) ?? false
+			}));
+			if (stepConcurrencyChanged) await this.getClient().send(new ModifyClusterCommand({
+				ClusterId: physicalId,
+				StepConcurrencyLevel: toNumber(properties["StepConcurrencyLevel"])
+			}));
+			if (managedScalingChanged) {
+				const next = this.toManagedScalingPolicy(properties["ManagedScalingPolicy"]);
+				if (next) await this.getClient().send(new PutManagedScalingPolicyCommand({
+					ClusterId: physicalId,
+					ManagedScalingPolicy: next
+				}));
+				else await this.getClient().send(new RemoveManagedScalingPolicyCommand({ ClusterId: physicalId }));
+			}
+			if (autoTerminationChanged) {
+				const next = this.toAutoTerminationPolicy(properties["AutoTerminationPolicy"]);
+				if (next && next.IdleTimeout !== void 0) await this.getClient().send(new PutAutoTerminationPolicyCommand({
+					ClusterId: physicalId,
+					AutoTerminationPolicy: next
+				}));
+				else await this.getClient().send(new RemoveAutoTerminationPolicyCommand({ ClusterId: physicalId }));
+			}
+			if (tagsChanged) await this.applyTagDiff(physicalId, properties["Tags"], previousProperties["Tags"]);
+			let cluster;
+			try {
+				cluster = (await this.getClient().send(new DescribeClusterCommand({ ClusterId: physicalId }))).Cluster;
+			} catch (describeError) {
+				this.logger.debug(`Post-update attribute refresh for ${physicalId} failed (returning without attributes): ${describeError instanceof Error ? describeError.message : String(describeError)}`);
+			}
+			this.logger.debug(`Successfully updated EMR Cluster ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				...cluster && { attributes: this.buildAttributes(cluster) }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update EMR Cluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	/**
+	* Apply a `Tags` diff via `AddTags` / `RemoveTags`. Full-tag-removal is
+	* handled explicitly (a tag present before and absent now must be removed
+	* via `RemoveTags` — mirrors the #981 ECR regression class where an empty
+	* desired tag set silently left the old tags in place).
+	*/
+	async applyTagDiff(physicalId, nextTags, prevTags) {
+		const next = new Map((nextTags ?? []).map((t) => [t.Key, t.Value]));
+		const prev = new Map((prevTags ?? []).map((t) => [t.Key, t.Value]));
+		const toSet = [];
+		for (const [key, value] of next) {
+			if (key === void 0) continue;
+			if (prev.get(key) !== value) toSet.push({
+				Key: key,
+				Value: value
+			});
+		}
+		const toRemove = [];
+		for (const key of prev.keys()) if (key !== void 0 && !next.has(key)) toRemove.push(key);
+		if (toRemove.length > 0) await this.getClient().send(new RemoveTagsCommand$1({
+			ResourceId: physicalId,
+			TagKeys: toRemove
+		}));
+		if (toSet.length > 0) await this.getClient().send(new AddTagsCommand$1({
+			ResourceId: physicalId,
+			Tags: toSet
+		}));
+	}
+	async delete(logicalId, physicalId, resourceType, _properties, context) {
+		this.logger.debug(`Deleting EMR Cluster ${logicalId}: ${physicalId}`);
+		let current;
+		try {
+			current = (await this.getClient().send(new DescribeClusterCommand({ ClusterId: physicalId }))).Cluster;
+		} catch (error) {
+			if (error instanceof InvalidRequestException) {
+				assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+				this.logger.debug(`EMR Cluster ${physicalId} does not exist, skipping deletion`);
+				return;
+			}
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to describe EMR Cluster ${logicalId} before deletion: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		const currentState = current?.Status?.State;
+		if (currentState && TERMINAL_STATES.has(currentState)) {
+			this.logger.debug(`EMR Cluster ${physicalId} already ${currentState}, skipping deletion`);
+			return;
+		}
+		try {
+			if (context?.removeProtection) {
+				await this.getClient().send(new SetTerminationProtectionCommand({
+					JobFlowIds: [physicalId],
+					TerminationProtected: false
+				}));
+				this.logger.debug(`Disabled termination protection on EMR Cluster ${physicalId} before deletion`);
+			}
+			await this.getClient().send(new TerminateJobFlowsCommand({ JobFlowIds: [physicalId] }));
+		} catch (error) {
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to terminate EMR Cluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+		await this.waitForClusterTerminated(physicalId, logicalId, resourceType);
+		this.logger.debug(`Successfully deleted EMR Cluster ${logicalId}`);
+	}
+	/**
+	* Issue the polling `DescribeCluster` with bounded tolerance for TRANSIENT
+	* errors (throttling / 5xx / connection resets): up to
+	* `maxConsecutiveTransient` consecutive failures are absorbed before the
+	* error propagates. A 10-minute poll at 15s intervals would otherwise turn
+	* a single throttle into a spurious failure + rollback cycle. Non-transient
+	* errors propagate immediately.
+	*/
+	async describeForPoll(clusterId, transientState, maxConsecutiveTransient = 5) {
+		try {
+			const response = await this.getClient().send(new DescribeClusterCommand({ ClusterId: clusterId }));
+			transientState.count = 0;
+			return response.Cluster;
+		} catch (error) {
+			const name = error instanceof Error ? error.name : "";
+			const msg = error instanceof Error ? error.message : String(error);
+			if ((name === "ThrottlingException" || name === "InternalServerException" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|throttl|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
+				transientState.count += 1;
+				this.logger.debug(`Transient DescribeCluster error while polling ${clusterId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
+				return;
+			}
+			throw error;
+		}
+	}
+	async waitForClusterReady(clusterId, logicalId, resourceType) {
+		const startTime = Date.now();
+		const transientState = { count: 0 };
+		while (Date.now() - startTime < this.maxWaitMs) {
+			const cluster = await this.describeForPoll(clusterId, transientState);
+			const state = cluster?.Status?.State;
+			if (cluster && state && CREATE_READY_STATES.has(state)) return cluster;
+			if (state && TERMINAL_STATES.has(state)) throw new ProvisioningError(`EMR Cluster ${clusterId} entered terminal state ${state} during creation: ${cluster?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, clusterId);
+			this.logger.debug(`EMR Cluster ${clusterId} state: ${state ?? "unknown"}, waiting...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(`Timed out waiting for EMR Cluster ${clusterId} to reach WAITING/RUNNING (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, clusterId);
+	}
+	async waitForClusterTerminated(clusterId, logicalId, resourceType) {
+		const startTime = Date.now();
+		const transientState = { count: 0 };
+		while (Date.now() - startTime < this.maxWaitMs) {
+			let cluster;
+			try {
+				cluster = await this.describeForPoll(clusterId, transientState);
+			} catch (error) {
+				if (error instanceof InvalidRequestException) return;
+				const cause = error instanceof Error ? error : void 0;
+				throw new ProvisioningError(`Failed to poll EMR Cluster ${clusterId} termination: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, clusterId, cause);
+			}
+			const state = cluster?.Status?.State;
+			if (state && TERMINAL_STATES.has(state)) {
+				if (state === "TERMINATED_WITH_ERRORS") {
+					const reason = cluster?.Status?.StateChangeReason?.Message ?? "no state-change reason reported";
+					this.logger.warn(`EMR Cluster ${clusterId} terminated with errors: ${reason} (the cluster is gone and no longer bills)`);
+				}
+				return;
+			}
+			this.logger.debug(`EMR Cluster ${clusterId} state: ${state ?? "unknown"}, waiting for termination...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(`Timed out waiting for EMR Cluster ${clusterId} termination (${Math.round(this.maxWaitMs / 6e4)} min) — verify and terminate it manually to stop billing`, resourceType, logicalId, clusterId);
+	}
+	buildAttributes(cluster) {
+		const attributes = {};
+		if (cluster?.Id !== void 0) attributes["Id"] = cluster.Id;
+		if (cluster?.MasterPublicDnsName !== void 0) attributes["MasterPublicDNS"] = cluster.MasterPublicDnsName;
+		return attributes;
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "Id") return physicalId;
+		const cluster = (await this.getClient().send(new DescribeClusterCommand({ ClusterId: physicalId }))).Cluster;
+		if (!cluster) return void 0;
+		switch (attributeName) {
+			case "MasterPublicDNS": return cluster.MasterPublicDnsName;
+			default: return;
+		}
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/firehose-provider.ts
 /**
@@ -36479,14 +37002,14 @@ var CloudTrailProvider = class {
 			Value: v
 		});
 		if (tagsToRemove.length > 0) {
-			await this.getClient().send(new RemoveTagsCommand$1({
+			await this.getClient().send(new RemoveTagsCommand$2({
 				ResourceId: trailArn,
 				TagsList: tagsToRemove
 			}));
 			this.logger.debug(`Removed ${tagsToRemove.length} tag(s) from CloudTrail Trail ${trailArn}`);
 		}
 		if (tagsToAdd.length > 0) {
-			await this.getClient().send(new AddTagsCommand$1({
+			await this.getClient().send(new AddTagsCommand$2({
 				ResourceId: trailArn,
 				TagsList: tagsToAdd
 			}));
@@ -37295,6 +37818,81 @@ var CodeCommitRepositoryProvider = class {
 		}
 	}
 	/**
+	* Read the currently-deployed properties for `cdkd drift`.
+	*
+	* Maps the CodeCommit read side back to the flat CFn inputs cdkd stores
+	* in state:
+	*   - `repositoryName`        -> `RepositoryName`
+	*   - `repositoryDescription` -> `RepositoryDescription` (placeholder `''`)
+	*   - `kmsKeyId`              -> `KmsKeyId`
+	*   - `ListTagsForResource`   -> `Tags` (CFn `[{Key, Value}]` list)
+	*
+	* Every user-controllable top-level key `update()` can mutate is emitted
+	* ALWAYS — with a `?? ''` / `?? []` placeholder when AWS returns the field
+	* as undefined / empty (docs/provider-development.md §3b). Omitting the key
+	* on the empty path would let a resource deployed WITHOUT a description
+	* never carry `RepositoryDescription` in `observedProperties`, making a
+	* console-side ADD of a description invisible to drift forever. `Tags` are
+	* returned in the CFn list shape and the comparator canonicalizes tag lists
+	* order-independently (`drift-normalize.ts`), so a tag reorder never
+	* surfaces as phantom drift. `aws:*` tags (CDK's `aws:cdk:path` etc.) are
+	* dropped by `normalizeAwsTagsToCfn` so a CDK-deployed repository does not
+	* report drift on the metadata tag cdkd never templated.
+	*
+	* Returns `undefined` when the repository no longer exists (or
+	* `GetRepository` returns no metadata) so the caller reports it as
+	* drift-unknown rather than throwing — mirrors the optional `import`
+	* method's incremental opt-in shape. A repository deleted BETWEEN the
+	* `GetRepository` and `ListTagsForResource` calls (a race with a
+	* concurrent destroy) is handled the same way rather than aborting the
+	* whole `cdkd drift` run.
+	*
+	* Caveat: `KmsKeyId` is returned as AWS resolves it — the full key ARN.
+	* On the normal drift path the baseline is `observedProperties` (captured
+	* via this same method at deploy time), so ARN == ARN and there is no
+	* phantom drift; but on the `properties`-fallback path (older state with
+	* no `observedProperties`) a template that set `KmsKeyId` as an alias or
+	* bare key id would phantom-drift against the returned ARN. This is a
+	* general fallback-path limitation shared with other providers.
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let metadata;
+		try {
+			metadata = await this.getRepositoryMetadata(physicalId);
+		} catch (err) {
+			if (err instanceof RepositoryDoesNotExistException) return void 0;
+			throw err;
+		}
+		if (!metadata) return void 0;
+		let tags = [];
+		if (metadata.Arn) try {
+			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }))).tags);
+		} catch (err) {
+			if (err instanceof RepositoryDoesNotExistException) return void 0;
+			throw err;
+		}
+		return {
+			RepositoryName: metadata.repositoryName ?? "",
+			RepositoryDescription: metadata.repositoryDescription ?? "",
+			KmsKeyId: metadata.kmsKeyId ?? "",
+			Tags: tags
+		};
+	}
+	/**
+	* State property paths this provider cannot read back from AWS, skipped by
+	* the drift comparator to avoid a guaranteed false positive.
+	*
+	* `Code` (create-only S3-zip seed content unpacked into an initial commit)
+	* and `Triggers` (repository trigger management, not wired) are both
+	* `unhandledByDesign` — normally rejected pre-flight, but a state written
+	* under `--allow-unsupported-properties` could still carry them, and neither
+	* is read back by `readCurrentState`, so exclude both defensively to avoid a
+	* guaranteed false-positive drift on every run.
+	*/
+	getDriftUnknownPaths(_resourceType) {
+		return ["Code", "Triggers"];
+	}
+	/**
 	* Adopt an existing CodeCommit repository into cdkd state.
 	*
 	* Lookup order:
@@ -40387,6 +40985,7 @@ function registerAllProviders(registry) {
 	registry.register("AWS::EFS::MountTarget", efsProvider);
 	registry.register("AWS::EFS::AccessPoint", efsProvider);
 	registry.register("AWS::FSx::FileSystem", new FSxFileSystemProvider());
+	registry.register("AWS::EMR::Cluster", new EMRClusterProvider());
 	registry.register("AWS::KinesisFirehose::DeliveryStream", new FirehoseProvider());
 	registry.register("AWS::CloudTrail::Trail", new CloudTrailProvider());
 	registry.register("AWS::CodeBuild::Project", new CodeBuildProvider());
@@ -59665,7 +60264,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.244.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.246.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());