@go-to-k/cdkd 0.245.0 → 0.247.0

package/README.md

@@ -4,11 +4,11 @@
 [![Downloads](https://img.shields.io/npm/dw/@go-to-k/cdkd.svg)](https://www.npmjs.com/package/@go-to-k/cdkd)
 [![License: Apache-2.0](https://img.shields.io/npm/l/@go-to-k/cdkd.svg)](./LICENSE)
 
-Drop-in CDK CLI for existing CDK apps — faster deploys via AWS SDK instead of CloudFormation, plus local emulation for Lambda, API Gateway, and ECS.
+Drop-in CDK CLI for existing CDK apps: up to 15x faster deploys via AWS SDK instead of CloudFormation.
 
-- **Drop-in CDK compatible** — your existing CDK app code runs as-is.
-- **Up to 15x faster deploys than the AWS CDK CLI (CloudFormation)**
-- **Local dev for any CDK app** — invoke Lambdas, serve API Gateway routes, run ECS tasks/services directly from your CDK code. Works against both `cdkd deploy`-managed AND `cdk deploy`-managed (CloudFormation) stacks via `--from-state` / `--from-cfn-stack` — no migration, no `cdk synth → sam local` round-trip.
+- **Drop-in CDK compatible**: your existing CDK app code runs as-is.
+- **Up to 15x faster deploys**: direct SDK calls, aggressive parallelization, and `--no-wait` to skip slow stabilization waits.
+- **Local execution**: run your functions and APIs locally, with env vars, secrets, and resource references resolved from your deployed stack instead of hand-written `.env` files.
 
 ![cdk deploy vs cdkd deploy — side-by-side, 35s recording, real AWS deploy. cdkd finishes while cdk is still creating its CloudFormation changeset.](assets/cdk-vs-cdkd.gif)
 

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-Ci_7Y2ol.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-D6U-Cm8B.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -64,7 +64,8 @@ import { AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient,
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import AdmZip from "adm-zip";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$21, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
@@ -1890,7 +1891,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.245.0";
+	return "0.247.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -37608,6 +37609,54 @@ function tagMapsEqual(a, b) {
 	if (aKeys.length !== Object.keys(b).length) return false;
 	return aKeys.every((k) => b[k] === a[k]);
 }
+/** Default branch for the `Code` seed commit when `BranchName` is omitted. */
+const DEFAULT_SEED_BRANCH = "main";
+/**
+* Coerce a CFn scalar value to a string. Post-intrinsic-resolution values are
+* strings in practice; numbers / booleans are stringified and any other shape
+* (object / null / undefined) collapses to `''` — avoids stringifying an
+* object to the useless `'[object Object]'`.
+*/
+function scalarToString(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	return "";
+}
+/**
+* Convert the CFn `Triggers` list shape to the CodeCommit SDK's
+* `RepositoryTrigger[]` (PascalCase → camelCase). `Branches` is ALWAYS
+* emitted (defaulting to `[]` when the template omits it) — CodeCommit's
+* `PutRepositoryTriggers` rejects a trigger whose `branches` is null with
+* "Repository trigger branch name list cannot be null", and an empty array
+* means "all branches" (matching CFn's default when `Branches` is absent).
+* `CustomData` is truly optional (emitted only when present) so a re-order /
+* equality comparison stays stable. `Events` / `Branches` are coerced to
+* string arrays.
+*/
+function toSdkTriggers(triggers) {
+	if (!Array.isArray(triggers) || triggers.length === 0) return [];
+	return triggers.map((t) => {
+		const events = Array.isArray(t?.Events) ? t.Events : [];
+		const branches = Array.isArray(t?.Branches) ? t.Branches : [];
+		const trigger = {
+			name: scalarToString(t?.Name),
+			destinationArn: scalarToString(t?.DestinationArn),
+			events: events.map((e) => scalarToString(e)),
+			branches: branches.map((b) => scalarToString(b))
+		};
+		if (t?.CustomData !== void 0 && t.CustomData !== null) trigger.customData = scalarToString(t.CustomData);
+		return trigger;
+	});
+}
+/**
+* Order-sensitive structural equality for two mapped SDK trigger lists, used
+* to skip a redundant `PutRepositoryTriggers` when the template `Triggers`
+* block is unchanged. Compared as canonical JSON so `undefined` optional
+* fields (`customData` / `branches`) collapse identically on both sides.
+*/
+function triggersEqual(a, b) {
+	return JSON.stringify(a) === JSON.stringify(b);
+}
 /**
 * AWS CodeCommit Repository Provider
 *
@@ -37626,19 +37675,25 @@ function tagMapsEqual(a, b) {
 */
 var CodeCommitRepositoryProvider = class {
 	client;
+	s3Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("CodeCommitRepositoryProvider");
 	handledProperties = new Map([["AWS::CodeCommit::Repository", new Set([
 		"RepositoryName",
 		"RepositoryDescription",
 		"KmsKeyId",
-		"Tags"
+		"Tags",
+		"Code",
+		"Triggers"
 	])]]);
-	unhandledByDesign = new Map([["AWS::CodeCommit::Repository", new Map([["Code", "CFn-only seed-content orchestration (S3 zip unpacked into an initial commit on a chosen branch); not wired in v1 — pre-flight rejects templates carrying it so nothing is silently dropped; a follow-up could implement it via CreateCommit/PutFile"], ["Triggers", "repository trigger management not wired in v1 — pre-flight rejects templates carrying it so nothing is silently dropped; a follow-up could implement it via PutRepositoryTriggers"]])]]);
 	getClient() {
 		if (!this.client) this.client = new CodeCommitClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
+	getS3Client() {
+		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.s3Client;
+	}
 	/**
 	* Build the `Fn::GetAtt` attribute map from a `RepositoryMetadata`
 	* response. `RepositoryId` is additionally stored so the intrinsic
@@ -37671,9 +37726,26 @@ var CodeCommitRepositoryProvider = class {
 				...tags ? { tags } : {}
 			}))).repositoryMetadata;
 			if (!metadata?.repositoryName) throw new Error("CreateRepository did not return repository metadata");
-			this.logger.debug(`Successfully created CodeCommit Repository ${logicalId}: ${metadata.repositoryName}`);
+			const createdName = metadata.repositoryName;
+			try {
+				const code = properties["Code"];
+				if (code) await this.seedInitialCommit(createdName, code);
+				const triggers = properties["Triggers"];
+				if (Array.isArray(triggers) && triggers.length > 0) {
+					await this.getClient().send(new PutRepositoryTriggersCommand({
+						repositoryName: createdName,
+						triggers: toSdkTriggers(triggers)
+					}));
+					this.logger.debug(`Applied ${triggers.length} trigger(s) to ${createdName}`);
+				}
+			} catch (postCreateError) {
+				this.logger.warn(`Post-create step failed for CodeCommit Repository ${logicalId}; deleting the just-created repository ${createdName} to avoid an orphan`);
+				await this.bestEffortDelete(createdName);
+				throw postCreateError;
+			}
+			this.logger.debug(`Successfully created CodeCommit Repository ${logicalId}: ${createdName}`);
 			return {
-				physicalId: metadata.repositoryName,
+				physicalId: createdName,
 				attributes: this.toAttributes(metadata)
 			};
 		} catch (error) {
@@ -37691,7 +37763,11 @@ var CodeCommitRepositoryProvider = class {
 	* CFn's `Ref` value — survives the rename), RepositoryDescription
 	* (UpdateRepositoryDescription), KmsKeyId (UpdateRepositoryEncryptionKey),
 	* Tags (TagResource / UntagResource — full tag removal handled explicitly,
-	* see the ECR Tags regression class in issue #981).
+	* see the ECR Tags regression class in issue #981), Triggers
+	* (PutRepositoryTriggers — a full-set replace, so a dropped or fully-removed
+	* `Triggers` property is applied by putting the new/empty set; issue #1066).
+	* `Code` is create-only seed content (CFn ignores it on update) and is NOT
+	* re-applied here.
 	*
 	* A rename returns the NEW repository name as `physicalId` with
 	* `wasReplaced: false`; the deploy engine persists the returned physical
@@ -37753,6 +37829,14 @@ var CodeCommitRepositoryProvider = class {
 					this.logger.debug(`Updated tags for ${currentName}`);
 				} else this.logger.warn(`Could not resolve ARN for CodeCommit Repository ${currentName}; tag update skipped`);
 			}
+			const newSdkTriggers = toSdkTriggers(properties["Triggers"]);
+			if (!triggersEqual(newSdkTriggers, toSdkTriggers(previousProperties["Triggers"]))) {
+				await this.getClient().send(new PutRepositoryTriggersCommand({
+					repositoryName: currentName,
+					triggers: newSdkTriggers
+				}));
+				this.logger.debug(`Updated triggers for ${currentName} (${newSdkTriggers.length} trigger(s))`);
+			}
 			metadata = await this.getRepositoryMetadata(currentName);
 			return {
 				physicalId: currentName,
@@ -37818,6 +37902,84 @@ var CodeCommitRepositoryProvider = class {
 		}
 	}
 	/**
+	* Read the currently-deployed properties for `cdkd drift`.
+	*
+	* Maps the CodeCommit read side back to the flat CFn inputs cdkd stores
+	* in state:
+	*   - `repositoryName`        -> `RepositoryName`
+	*   - `repositoryDescription` -> `RepositoryDescription` (placeholder `''`)
+	*   - `kmsKeyId`              -> `KmsKeyId`
+	*   - `ListTagsForResource`   -> `Tags` (CFn `[{Key, Value}]` list)
+	*
+	* Every user-controllable top-level key `update()` can mutate is emitted
+	* ALWAYS — with a `?? ''` / `?? []` placeholder when AWS returns the field
+	* as undefined / empty (docs/provider-development.md §3b). Omitting the key
+	* on the empty path would let a resource deployed WITHOUT a description
+	* never carry `RepositoryDescription` in `observedProperties`, making a
+	* console-side ADD of a description invisible to drift forever. `Tags` are
+	* returned in the CFn list shape and the comparator canonicalizes tag lists
+	* order-independently (`drift-normalize.ts`), so a tag reorder never
+	* surfaces as phantom drift. `aws:*` tags (CDK's `aws:cdk:path` etc.) are
+	* dropped by `normalizeAwsTagsToCfn` so a CDK-deployed repository does not
+	* report drift on the metadata tag cdkd never templated.
+	*
+	* Returns `undefined` when the repository no longer exists (or
+	* `GetRepository` returns no metadata) so the caller reports it as
+	* drift-unknown rather than throwing — mirrors the optional `import`
+	* method's incremental opt-in shape. A repository deleted BETWEEN the
+	* `GetRepository` and `ListTagsForResource` calls (a race with a
+	* concurrent destroy) is handled the same way rather than aborting the
+	* whole `cdkd drift` run.
+	*
+	* Caveat: `KmsKeyId` is returned as AWS resolves it — the full key ARN.
+	* On the normal drift path the baseline is `observedProperties` (captured
+	* via this same method at deploy time), so ARN == ARN and there is no
+	* phantom drift; but on the `properties`-fallback path (older state with
+	* no `observedProperties`) a template that set `KmsKeyId` as an alias or
+	* bare key id would phantom-drift against the returned ARN. This is a
+	* general fallback-path limitation shared with other providers.
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		let metadata;
+		try {
+			metadata = await this.getRepositoryMetadata(physicalId);
+		} catch (err) {
+			if (err instanceof RepositoryDoesNotExistException) return void 0;
+			throw err;
+		}
+		if (!metadata) return void 0;
+		let tags = [];
+		if (metadata.Arn) try {
+			tags = normalizeAwsTagsToCfn((await this.getClient().send(new ListTagsForResourceCommand$19({ resourceArn: metadata.Arn }))).tags);
+		} catch (err) {
+			if (err instanceof RepositoryDoesNotExistException) return void 0;
+			throw err;
+		}
+		return {
+			RepositoryName: metadata.repositoryName ?? "",
+			RepositoryDescription: metadata.repositoryDescription ?? "",
+			KmsKeyId: metadata.kmsKeyId ?? "",
+			Tags: tags
+		};
+	}
+	/**
+	* State property paths this provider cannot read back from AWS, skipped by
+	* the drift comparator to avoid a guaranteed false positive.
+	*
+	* `Code` is create-only S3-zip seed content unpacked into the initial
+	* commit — there is no read-back to compare against (the commit is git
+	* history, not a repository attribute), so it can never meaningfully drift.
+	* `Triggers` IS wired on the write side (create + update via
+	* `PutRepositoryTriggers`), but `readCurrentState` does not yet fetch
+	* `GetRepositoryTriggers`, so comparing a state that carries `Triggers`
+	* against an `observedProperties` that omits it would be a guaranteed false
+	* positive. Both are therefore excluded here; a follow-up can add
+	* `GetRepositoryTriggers` read-back and drop `Triggers` from this list.
+	*/
+	getDriftUnknownPaths(_resourceType) {
+		return ["Code", "Triggers"];
+	}
+	/**
 	* Adopt an existing CodeCommit repository into cdkd state.
 	*
 	* Lookup order:
@@ -37863,6 +38025,67 @@ var CodeCommitRepositoryProvider = class {
 		return null;
 	}
 	/**
+	* Seed the repository's initial commit from the CFn `Code` property.
+	*
+	* CFn's `Code` orchestration downloads the S3 ZIP, unpacks it, and creates
+	* the repository's first commit on `BranchName` (default `main`). cdkd
+	* reproduces that here: `GetObject` the ZIP, unpack every file entry
+	* (directories are implied by file paths — CodeCommit has no empty-dir
+	* concept), and issue a single `CreateCommit` carrying all files as
+	* `putFiles`. This is create-only: CFn ignores `Code` on update, and so
+	* does cdkd (`update()` never calls this).
+	*
+	* A ZIP with no file entries is a no-op (warn + skip) rather than a hard
+	* failure — CodeCommit rejects a `CreateCommit` with an empty `putFiles`.
+	*/
+	async seedInitialCommit(repositoryName, code) {
+		const bucket = code.S3?.Bucket;
+		const key = code.S3?.Key;
+		if (typeof bucket !== "string" || typeof key !== "string" || !bucket || !key) throw new Error("Code.S3 requires string Bucket and Key");
+		const versionId = typeof code.S3?.ObjectVersion === "string" ? code.S3.ObjectVersion : void 0;
+		const branchName = typeof code.BranchName === "string" && code.BranchName ? code.BranchName : DEFAULT_SEED_BRANCH;
+		const obj = await this.getS3Client().send(new GetObjectCommand({
+			Bucket: bucket,
+			Key: key,
+			...versionId && { VersionId: versionId }
+		}));
+		if (!obj.Body) throw new Error(`Code.S3 object s3://${bucket}/${key} returned an empty body`);
+		const zipBytes = await obj.Body.transformToByteArray();
+		const zip = new AdmZip(Buffer.from(zipBytes));
+		const putFiles = [];
+		for (const entry of zip.getEntries()) {
+			if (entry.isDirectory) continue;
+			putFiles.push({
+				filePath: entry.entryName,
+				fileContent: entry.getData()
+			});
+		}
+		if (putFiles.length === 0) {
+			this.logger.warn(`Code.S3 object s3://${bucket}/${key} contained no files; skipping seed commit for ${repositoryName}`);
+			return;
+		}
+		await this.getClient().send(new CreateCommitCommand({
+			repositoryName,
+			branchName,
+			commitMessage: "Initial commit",
+			putFiles
+		}));
+		this.logger.debug(`Seeded ${repositoryName} with ${putFiles.length} file(s) on branch ${branchName}`);
+	}
+	/**
+	* Best-effort delete used to roll back a just-created repository when a
+	* post-create step (`Code` seed / `Triggers`) fails. Never throws — the
+	* original post-create error is what the caller re-throws; a cleanup
+	* failure is logged so the orphan is surfaced.
+	*/
+	async bestEffortDelete(repositoryName) {
+		try {
+			await this.getClient().send(new DeleteRepositoryCommand$1({ repositoryName }));
+		} catch (cleanupError) {
+			this.logger.warn(`Failed to clean up CodeCommit Repository ${repositoryName} after a post-create failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+		}
+	}
+	/**
 	* Fetch the repository's metadata via `GetRepository`. Throws
 	* `RepositoryDoesNotExistException` through to the caller.
 	*/
@@ -60189,7 +60412,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.245.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.247.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());