@go-to-k/cdkd 0.246.0 → 0.248.0

package/README.md

@@ -4,15 +4,14 @@
 [![Downloads](https://img.shields.io/npm/dw/@go-to-k/cdkd.svg)](https://www.npmjs.com/package/@go-to-k/cdkd)
 [![License: Apache-2.0](https://img.shields.io/npm/l/@go-to-k/cdkd.svg)](./LICENSE)
 
-Drop-in CDK CLI for existing CDK apps — faster deploys via AWS SDK instead of CloudFormation, plus local emulation for Lambda, API Gateway, and ECS.
+Drop-in CDK CLI for existing CDK apps — up to 15x faster deploys via direct AWS SDK calls instead of CloudFormation.
 
-- **Drop-in CDK compatible** — your existing CDK app code runs as-is.
-- **Up to 15x faster deploys than the AWS CDK CLI (CloudFormation)**
-- **Local dev for any CDK app** — invoke Lambdas, serve API Gateway routes, run ECS tasks/services directly from your CDK code. Works against both `cdkd deploy`-managed AND `cdk deploy`-managed (CloudFormation) stacks via `--from-state` / `--from-cfn-stack` — no migration, no `cdk synth → sam local` round-trip.
+- **Drop-in CDK compatible**: your existing CDK app code runs as-is.
+- **Up to 15x faster deploys**: direct SDK calls, aggressive parallelization, and `--no-wait` to skip slow stabilization waits.
 
 ![cdk deploy vs cdkd deploy — side-by-side, 35s recording, real AWS deploy. cdkd finishes while cdk is still creating its CloudFormation changeset.](assets/cdk-vs-cdkd.gif)
 
-**cdkd complements the AWS CDK CLI rather than replacing it.** Use cdkd in dev/test for rapid iteration and SAM-style local execution; use the AWS CDK CLI in production for full CloudFormation tooling. Install cdkd alongside an existing `cdk deploy` workflow — no migration needed, `cdkd local *` reads deployed state directly via `--from-cfn-stack`. Bidirectional migration is also supported — [import](#importing-existing-resources) into cdkd or [export](#exporting-a-stack-back-to-cloudformation) back to CloudFormation when ready.
+**cdkd complements the AWS CDK CLI rather than replacing it.** Use cdkd in dev/test for rapid iteration and local execution; use the AWS CDK CLI in production for full CloudFormation tooling. Install cdkd alongside an existing `cdk deploy` workflow: no migration needed. Bidirectional migration is also supported: [import](#importing-existing-resources) into cdkd or [export](#exporting-a-stack-back-to-cloudformation) back to CloudFormation when ready.
 
 **A natural fit for AI-driven development.** AI coding agents iterate in tight spin-up / tear-down loops — and cdkd keeps each turn short, with fast deploys and an equally fast `cdkd destroy` that deletes via direct SDK calls instead of polling a CloudFormation stack-delete.
 
@@ -139,13 +138,14 @@ parsing → synthesis → asset publishing → per-stack deploy), see
 ## Prerequisites
 
 - **Node.js** >= 20.0.0
-- **AWS CDK Bootstrap: not required.** `cdkd bootstrap` (once per account) creates
-  everything cdkd needs, and per-region asset storage is added automatically on the
-  first `cdkd deploy` into each region. Existing setups, legacy-mode opt-outs, and
-  how this relates to `cdk bootstrap`: see
-  [Upgrading from an earlier cdkd version](#upgrading-from-an-earlier-cdkd-version).
 - **AWS credentials with admin-equivalent permissions** for the resources being deployed. cdkd does NOT route through CloudFormation, so CDK CLI's `cdk-hnb659fds-deploy-role-*` is NOT sufficient — see [`--role-arn`](docs/cli-reference.md).
 
+AWS CDK's `cdk bootstrap` is not required. Instead, run `cdkd bootstrap` once per
+account: it creates everything cdkd needs, and per-region asset storage is added
+automatically on the first `cdkd deploy` into each region. Existing setups,
+legacy-mode opt-outs, and how this relates to `cdk bootstrap`: see
+[Upgrading from an earlier cdkd version](#upgrading-from-an-earlier-cdkd-version).
+
 ## Installation
 
 ```bash

package/dist/cli.js

@@ -2,7 +2,7 @@
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BzO-joNR.js";
 import { A as withErrorHandling, C as StackHasActiveImportsError, S as ResourceUpdateNotSupportedError, _ as MissingCdkCliError, a as normalizeAwsTagsToCfn, b as ProvisioningError, f as LocalInvokeBuildError$1, i as matchesCdkPath, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as isTerminationProtectionPropagationError, o as resolveExplicitPhysicalId, p as LocalMigrateError, r as CDK_PATH_TAG, s as assertRegionMatch, t as disableInstanceApiTermination, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./ec2-termination-protection-q-WGWgxa.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-B15NAPbL.js";
-import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-Ci_7Y2ol.js";
+import { $ as getDockerCmd, A as DiffCalculator, B as buildAssetRedirectMap, C as findActionableSilentDrops, Ct as resolveBucketRegion, D as refStateLookupFromResource, E as cfnRefValueFromPhysicalId, F as rebuildClientForBucketRegion, G as BOOTSTRAP_MARKER_PREFIX, H as loadPublishableAssetManifest, I as shouldRetainResource, J as parseBootstrapMarker, K as ensureAssetStorage, L as AssetPublisher, M as TemplateParser, N as LockManager, O as WAFv2WebACLProvider, P as S3StateBackend, Q as formatDockerLoginError, R as stringifyValue, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as rewriteTemplateAssetReferences, V as createAssetRedirectResolver, W as AssetModeResolver, X as validateContainerRepoName, Y as validateAssetBucketName, Z as buildDockerImage, _ as green, _t as CFN_TEMPLATE_URL_LIMIT, a as withRetry, at as synthesisStatusMessage, b as IAMRoleProvider, bt as uploadCfnTemplate, c as computeImplicitDeleteEdges, ct as resolveApp, d as isStatefulRecreateTargetSync, dt as resolveSkipPrefix, et as runDockerForeground, f as renderStatefulReason, ft as resolveStateBucketWithDefault, g as gray, gt as CFN_TEMPLATE_BODY_LIMIT, h as cyan, ht as warnDeprecatedNoPrefixCliFlag, i as withResourceDeadline, it as Synthesizer, j as DagBuilder, k as applyRoleArnIfSet, l as extractDeploymentEventError, lt as resolveAutoAssetStorage, m as bold, mt as resolveUseCdkBootstrapAssets, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as AssetManifestLoader, o as isRetryableTransientError, ot as getDefaultStateBucketName, p as formatResourceLine, pt as resolveStateBucketWithDefaultAndSource, q as getBootstrapMarkerKey, r as DeployEngine, rt as getDockerImageBySourceHash, s as IMPLICIT_DELETE_DEPENDENCIES, st as getLegacyStateBucketName, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as runDockerStreaming, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as resolveCaptureObservedState, v as red, vt as MIGRATE_TMP_PREFIX, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, xt as AssemblyReader, y as yellow, yt as findLargeInlineResources, z as WorkGraph } from "./deploy-engine-D6U-Cm8B.js";
 import { t as expectedOwnerParam } from "./expected-bucket-owner-BjEfUnkA.js";
 import { t as ASGProvider } from "./asg-provider-Dbl1_mwT.js";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -60,11 +60,12 @@ import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPer
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
-import { AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ModifyClusterCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
+import { AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand as ListClustersCommand$1, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
-import { CodeCommitClient, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import { CodeCommitClient, CreateCommitCommand, CreateRepositoryCommand as CreateRepositoryCommand$1, DeleteRepositoryCommand as DeleteRepositoryCommand$1, GetRepositoryCommand, ListRepositoriesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$19, PutRepositoryTriggersCommand, RepositoryDoesNotExistException, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateRepositoryDescriptionCommand, UpdateRepositoryEncryptionKeyCommand, UpdateRepositoryNameCommand } from "@aws-sdk/client-codecommit";
+import AdmZip from "adm-zip";
 import { CreateLifecyclePolicyCommand, DLMClient, DeleteLifecyclePolicyCommand as DeleteLifecyclePolicyCommand$1, GetLifecyclePoliciesCommand, GetLifecyclePolicyCommand as GetLifecyclePolicyCommand$1, ResourceNotFoundException as ResourceNotFoundException$12, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateLifecyclePolicyCommand } from "@aws-sdk/client-dlm";
 import { CreateVectorBucketCommand, DeleteIndexCommand, DeleteVectorBucketCommand, GetVectorBucketCommand, ListIndexesCommand, ListTagsForResourceCommand as ListTagsForResourceCommand$20, ListVectorBucketsCommand, S3VectorsClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21 } from "@aws-sdk/client-s3vectors";
 import { CreateNamespaceCommand, CreateTableBucketCommand, CreateTableCommand as CreateTableCommand$2, DeleteNamespaceCommand as DeleteNamespaceCommand$1, DeleteTableBucketCommand, DeleteTableCommand as DeleteTableCommand$2, GetTableBucketCommand, GetTableCommand as GetTableCommand$1, ListNamespacesCommand as ListNamespacesCommand$1, ListTableBucketsCommand, ListTablesCommand as ListTablesCommand$1, ListTagsForResourceCommand as ListTagsForResourceCommand$21, NotFoundException as NotFoundException$6, S3TablesClient, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22 } from "@aws-sdk/client-s3tables";
@@ -1890,7 +1891,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.246.0";
+	return "0.248.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -35020,6 +35021,18 @@ const CREATE_READY_STATES = new Set(["WAITING", "RUNNING"]);
 */
 const TERMINAL_STATES = new Set(["TERMINATED", "TERMINATED_WITH_ERRORS"]);
 /**
+* Cluster states that mean "the cluster is alive" — the `ListClusters` filter
+* used by `import()` discovery so a long-gone `TERMINATED*` cluster is never
+* adopted. Everything except the two `TERMINAL_STATES`.
+*/
+const NON_TERMINATED_STATES = [
+	"STARTING",
+	"BOOTSTRAPPING",
+	"RUNNING",
+	"WAITING",
+	"TERMINATING"
+];
+/**
 * Top-level CFn properties that map to a MUTABLE EMR API surface. Every other
 * property is either registry-createOnly (routed through DELETE+CREATE by the
 * replacement-detection layer) or lives inside the `Instances` block (handled
@@ -35519,6 +35532,279 @@ var EMRClusterProvider = class {
 			default: return;
 		}
 	}
+	/**
+	* Adopt an existing EMR cluster into cdkd state.
+	*
+	* Lookup order:
+	*  1. `--resource <logicalId>=j-XXXX` override (`knownPhysicalId`) → verify
+	*     via `DescribeCluster`. There is no template name property that equals
+	*     the physical id — a cluster's id (`j-...`) is service-generated, while
+	*     the template `Name` is only the display name — so no name fallback
+	*     applies (`resolveExplicitPhysicalId(..., null)`).
+	*  2. Tag-based lookup: `ListClusters` filtered to the non-terminated states
+	*     (a `TERMINATED*` cluster is gone and must never be adopted), then a
+	*     `DescribeCluster` per candidate to read `Tags` (the list summaries do
+	*     NOT carry tags) and match `aws:cdk:path`.
+	*/
+	async import(input) {
+		const explicit = resolveExplicitPhysicalId(input, null);
+		if (explicit) {
+			const cluster = await this.describeClusterOrNull(explicit);
+			if (!cluster || cluster.Status?.State && TERMINAL_STATES.has(cluster.Status.State)) return null;
+			return {
+				physicalId: explicit,
+				attributes: this.buildAttributes(cluster)
+			};
+		}
+		if (!input.cdkPath) return null;
+		let marker;
+		do {
+			const list = await this.getClient().send(new ListClustersCommand$1({
+				ClusterStates: [...NON_TERMINATED_STATES],
+				...marker && { Marker: marker }
+			}));
+			for (const summary of list.Clusters ?? []) {
+				if (!summary.Id) continue;
+				const cluster = await this.describeClusterOrNull(summary.Id);
+				if (!cluster) continue;
+				if (matchesCdkPath(cluster.Tags, input.cdkPath)) return {
+					physicalId: summary.Id,
+					attributes: this.buildAttributes(cluster)
+				};
+			}
+			marker = list.Marker;
+		} while (marker);
+		return null;
+	}
+	/**
+	* `DescribeCluster` that maps a not-found (`InvalidRequestException` — the
+	* cluster id is unknown in this region / aged out of Describe) to `null`
+	* instead of throwing, so `import()` can treat it as "no match" rather than
+	* aborting the whole adoption run.
+	*/
+	async describeClusterOrNull(clusterId) {
+		try {
+			return (await this.getClient().send(new DescribeClusterCommand({ ClusterId: clusterId }))).Cluster;
+		} catch (err) {
+			if (err instanceof InvalidRequestException) return void 0;
+			throw err;
+		}
+	}
+	/**
+	* Read the currently-deployed properties for `cdkd drift` and to seed the
+	* `observedProperties` baseline right after `cdkd import`.
+	*
+	* The bulk of the work is reversing the flatten that `create()` applies to
+	* the CFn `Instances` block: `DescribeCluster` reports the cluster's
+	* `InstanceCollectionType`, and the instance groups / fleets themselves come
+	* from `ListInstanceGroups` / `ListInstanceFleets` as FLAT arrays with a
+	* per-entry `InstanceGroupType` / `InstanceFleetType` discriminator — the
+	* exact inverse of the role-keyed CFn `MasterInstanceGroup` /
+	* `CoreInstanceGroup` / `TaskInstanceGroups` (+ `*InstanceFleet(s)`) shape.
+	* `reverseInstancesToCfn` re-buckets them and folds in the flat
+	* `Ec2InstanceAttributes` (subnet / key name / security groups).
+	*
+	* Scope: the reversible property set — the reverse-mapped `Instances` block,
+	* `Tags` (via `normalizeAwsTagsToCfn`, `aws:*` stripped), and the top-level
+	* scalar fields `DescribeCluster` returns directly. Create-only sub-config
+	* that AWS does not read back faithfully (`ManagedScalingPolicy` /
+	* `AutoTerminationPolicy` — separate Get* APIs; `BootstrapActions` / `Steps`
+	* / `KerberosAttributes` / `Configurations` nesting / `AdditionalInfo` /
+	* `PlacementGroupConfigs`; `Instances` EBS / auto-scaling sub-specs) is
+	* declared in `getDriftUnknownPaths` so the drift comparator skips it on the
+	* `properties`-fallback path instead of firing a guaranteed false positive.
+	* On the normal path the baseline is `observedProperties` (captured via this
+	* same method), so observed == current and there is no phantom drift.
+	*
+	* Returns `undefined` when the cluster is gone (`InvalidRequestException`)
+	* so the caller reports drift-unknown rather than throwing — mirrors the
+	* optional `import` method's incremental opt-in shape.
+	*/
+	async readCurrentState(physicalId, _logicalId, _resourceType) {
+		const cluster = await this.describeClusterOrNull(physicalId);
+		if (!cluster) return void 0;
+		let instanceGroups = [];
+		let instanceFleets = [];
+		if (cluster.InstanceCollectionType === "INSTANCE_FLEET") instanceFleets = await this.listInstanceFleets(physicalId);
+		else instanceGroups = await this.listInstanceGroups(physicalId);
+		return {
+			Name: cluster.Name ?? "",
+			ReleaseLabel: cluster.ReleaseLabel ?? "",
+			ServiceRole: cluster.ServiceRole ?? "",
+			LogUri: cluster.LogUri ?? "",
+			LogEncryptionKmsKeyId: cluster.LogEncryptionKmsKeyId ?? "",
+			AutoScalingRole: cluster.AutoScalingRole ?? "",
+			ScaleDownBehavior: cluster.ScaleDownBehavior ?? "",
+			CustomAmiId: cluster.CustomAmiId ?? "",
+			OSReleaseLabel: cluster.OSReleaseLabel ?? "",
+			SecurityConfiguration: cluster.SecurityConfiguration ?? "",
+			EbsRootVolumeSize: cluster.EbsRootVolumeSize,
+			EbsRootVolumeIops: cluster.EbsRootVolumeIops,
+			EbsRootVolumeThroughput: cluster.EbsRootVolumeThroughput,
+			StepConcurrencyLevel: cluster.StepConcurrencyLevel,
+			VisibleToAllUsers: cluster.VisibleToAllUsers ?? false,
+			JobFlowRole: cluster.Ec2InstanceAttributes?.IamInstanceProfile ?? "",
+			Applications: cluster.Applications ?? [],
+			Tags: normalizeAwsTagsToCfn(cluster.Tags),
+			Instances: this.reverseInstancesToCfn(cluster, instanceGroups, instanceFleets)
+		};
+	}
+	/**
+	* State property paths this provider cannot read back from AWS faithfully,
+	* skipped by the drift comparator to avoid a guaranteed false positive on
+	* the `properties`-fallback path. See `readCurrentState`'s docstring.
+	*
+	* NOTE on the `Instances.*` entries: `reverseInstancesToCfn` deliberately
+	* reconstructs only the primary topology per group / fleet (role, type,
+	* count / capacity, market, bid price, name, custom AMI) — the lossy
+	* sub-specs `create()` reads (`EbsConfiguration` / `AutoScalingPolicy` /
+	* per-group `Configurations`; per-fleet `InstanceTypeConfigs` /
+	* `LaunchSpecifications` / `ResizeSpecifications`) and the top-level
+	* `Instances` fields AWS does not report back (`HadoopVersion` /
+	* `Placement` / `KeepJobFlowAliveWhenNoSteps`) are NOT reconstructed. On the
+	* NORMAL drift path both the `observedProperties` baseline and the current
+	* snapshot go through this same lossy reverse, so these paths are absent
+	* from both sides and never drift — ignoring them there is a no-op. On the
+	* `properties`-fallback path (no `observedProperties`) the baseline is the
+	* full template `Instances`, which DOES carry these sub-fields, so without
+	* the skip every one would fire guaranteed false-positive drift. The two
+	* `Task*` arrays are ignored WHOLE (the comparator compares arrays as leaves,
+	* so an element sub-field cannot be path-targeted); Master/Core groups and
+	* fleets are single objects, so their lossy sub-fields are targeted directly.
+	*/
+	getDriftUnknownPaths(_resourceType) {
+		return [
+			"AdditionalInfo",
+			"Applications",
+			"AutoTerminationPolicy",
+			"BootstrapActions",
+			"Configurations",
+			"Instances.HadoopVersion",
+			"Instances.KeepJobFlowAliveWhenNoSteps",
+			"Instances.Placement",
+			"Instances.CoreInstanceGroup.AutoScalingPolicy",
+			"Instances.CoreInstanceGroup.Configurations",
+			"Instances.CoreInstanceGroup.EbsConfiguration",
+			"Instances.MasterInstanceGroup.AutoScalingPolicy",
+			"Instances.MasterInstanceGroup.Configurations",
+			"Instances.MasterInstanceGroup.EbsConfiguration",
+			"Instances.CoreInstanceFleet.InstanceTypeConfigs",
+			"Instances.CoreInstanceFleet.LaunchSpecifications",
+			"Instances.CoreInstanceFleet.ResizeSpecifications",
+			"Instances.MasterInstanceFleet.InstanceTypeConfigs",
+			"Instances.MasterInstanceFleet.LaunchSpecifications",
+			"Instances.MasterInstanceFleet.ResizeSpecifications",
+			"Instances.TaskInstanceFleets",
+			"Instances.TaskInstanceGroups",
+			"KerberosAttributes",
+			"ManagedScalingPolicy",
+			"PlacementGroupConfigs",
+			"Steps"
+		];
+	}
+	async listInstanceGroups(clusterId) {
+		const groups = [];
+		let marker;
+		do {
+			const resp = await this.getClient().send(new ListInstanceGroupsCommand({
+				ClusterId: clusterId,
+				...marker && { Marker: marker }
+			}));
+			groups.push(...resp.InstanceGroups ?? []);
+			marker = resp.Marker;
+		} while (marker);
+		return groups;
+	}
+	async listInstanceFleets(clusterId) {
+		const fleets = [];
+		let marker;
+		do {
+			const resp = await this.getClient().send(new ListInstanceFleetsCommand({
+				ClusterId: clusterId,
+				...marker && { Marker: marker }
+			}));
+			fleets.push(...resp.InstanceFleets ?? []);
+			marker = resp.Marker;
+		} while (marker);
+		return fleets;
+	}
+	/**
+	* Reverse of `toJobFlowInstancesConfig` — re-bucket the flat SDK
+	* `InstanceGroup[]` / `InstanceFleet[]` (each carrying a role discriminator)
+	* back into the role-keyed CFn `Instances` shape, and fold in the flat
+	* `Ec2InstanceAttributes` (subnet / key name / security groups).
+	*
+	* Only the primary topology fields per group / fleet are reversed (role,
+	* type, count / capacity, market, bid price, name, custom AMI). Lossy
+	* sub-specs (EBS block-device / auto-scaling for groups; per-instance-type
+	* specs for fleets) are intentionally NOT reconstructed — they are covered
+	* by the drift baseline being `observedProperties` on the normal path.
+	*/
+	reverseInstancesToCfn(cluster, instanceGroups, instanceFleets) {
+		const ec2 = cluster.Ec2InstanceAttributes;
+		const instances = {};
+		const taskGroups = [];
+		for (const g of instanceGroups) {
+			const cfn = this.reverseInstanceGroup(g);
+			switch (g.InstanceGroupType) {
+				case "MASTER":
+					instances["MasterInstanceGroup"] = cfn;
+					break;
+				case "CORE":
+					instances["CoreInstanceGroup"] = cfn;
+					break;
+				case "TASK":
+					taskGroups.push(cfn);
+					break;
+			}
+		}
+		if (taskGroups.length > 0) instances["TaskInstanceGroups"] = taskGroups;
+		const taskFleets = [];
+		for (const f of instanceFleets) {
+			const cfn = this.reverseInstanceFleet(f);
+			switch (f.InstanceFleetType) {
+				case "MASTER":
+					instances["MasterInstanceFleet"] = cfn;
+					break;
+				case "CORE":
+					instances["CoreInstanceFleet"] = cfn;
+					break;
+				case "TASK":
+					taskFleets.push(cfn);
+					break;
+			}
+		}
+		if (taskFleets.length > 0) instances["TaskInstanceFleets"] = taskFleets;
+		if (ec2?.Ec2KeyName !== void 0) instances["Ec2KeyName"] = ec2.Ec2KeyName;
+		if (ec2?.Ec2SubnetId !== void 0) instances["Ec2SubnetId"] = ec2.Ec2SubnetId;
+		if (ec2?.RequestedEc2SubnetIds !== void 0) instances["Ec2SubnetIds"] = ec2.RequestedEc2SubnetIds;
+		if (ec2?.EmrManagedMasterSecurityGroup !== void 0) instances["EmrManagedMasterSecurityGroup"] = ec2.EmrManagedMasterSecurityGroup;
+		if (ec2?.EmrManagedSlaveSecurityGroup !== void 0) instances["EmrManagedSlaveSecurityGroup"] = ec2.EmrManagedSlaveSecurityGroup;
+		if (ec2?.ServiceAccessSecurityGroup !== void 0) instances["ServiceAccessSecurityGroup"] = ec2.ServiceAccessSecurityGroup;
+		if (ec2?.AdditionalMasterSecurityGroups !== void 0) instances["AdditionalMasterSecurityGroups"] = ec2.AdditionalMasterSecurityGroups;
+		if (ec2?.AdditionalSlaveSecurityGroups !== void 0) instances["AdditionalSlaveSecurityGroups"] = ec2.AdditionalSlaveSecurityGroups;
+		if (cluster.TerminationProtected !== void 0) instances["TerminationProtected"] = cluster.TerminationProtected;
+		if (cluster.UnhealthyNodeReplacement !== void 0) instances["UnhealthyNodeReplacement"] = cluster.UnhealthyNodeReplacement;
+		return instances;
+	}
+	reverseInstanceGroup(g) {
+		const out = {
+			InstanceType: g.InstanceType ?? "",
+			InstanceCount: g.RequestedInstanceCount ?? 0
+		};
+		if (g.Name !== void 0) out["Name"] = g.Name;
+		if (g.Market !== void 0) out["Market"] = g.Market;
+		if (g.BidPrice !== void 0) out["BidPrice"] = g.BidPrice;
+		if (g.CustomAmiId !== void 0) out["CustomAmiId"] = g.CustomAmiId;
+		return out;
+	}
+	reverseInstanceFleet(f) {
+		const out = {};
+		if (f.Name !== void 0) out["Name"] = f.Name;
+		if (f.TargetOnDemandCapacity !== void 0) out["TargetOnDemandCapacity"] = f.TargetOnDemandCapacity;
+		if (f.TargetSpotCapacity !== void 0) out["TargetSpotCapacity"] = f.TargetSpotCapacity;
+		return out;
+	}
 };
 
 //#endregion
@@ -37608,6 +37894,54 @@ function tagMapsEqual(a, b) {
 	if (aKeys.length !== Object.keys(b).length) return false;
 	return aKeys.every((k) => b[k] === a[k]);
 }
+/** Default branch for the `Code` seed commit when `BranchName` is omitted. */
+const DEFAULT_SEED_BRANCH = "main";
+/**
+* Coerce a CFn scalar value to a string. Post-intrinsic-resolution values are
+* strings in practice; numbers / booleans are stringified and any other shape
+* (object / null / undefined) collapses to `''` — avoids stringifying an
+* object to the useless `'[object Object]'`.
+*/
+function scalarToString(value) {
+	if (typeof value === "string") return value;
+	if (typeof value === "number" || typeof value === "boolean") return String(value);
+	return "";
+}
+/**
+* Convert the CFn `Triggers` list shape to the CodeCommit SDK's
+* `RepositoryTrigger[]` (PascalCase → camelCase). `Branches` is ALWAYS
+* emitted (defaulting to `[]` when the template omits it) — CodeCommit's
+* `PutRepositoryTriggers` rejects a trigger whose `branches` is null with
+* "Repository trigger branch name list cannot be null", and an empty array
+* means "all branches" (matching CFn's default when `Branches` is absent).
+* `CustomData` is truly optional (emitted only when present) so a re-order /
+* equality comparison stays stable. `Events` / `Branches` are coerced to
+* string arrays.
+*/
+function toSdkTriggers(triggers) {
+	if (!Array.isArray(triggers) || triggers.length === 0) return [];
+	return triggers.map((t) => {
+		const events = Array.isArray(t?.Events) ? t.Events : [];
+		const branches = Array.isArray(t?.Branches) ? t.Branches : [];
+		const trigger = {
+			name: scalarToString(t?.Name),
+			destinationArn: scalarToString(t?.DestinationArn),
+			events: events.map((e) => scalarToString(e)),
+			branches: branches.map((b) => scalarToString(b))
+		};
+		if (t?.CustomData !== void 0 && t.CustomData !== null) trigger.customData = scalarToString(t.CustomData);
+		return trigger;
+	});
+}
+/**
+* Order-sensitive structural equality for two mapped SDK trigger lists, used
+* to skip a redundant `PutRepositoryTriggers` when the template `Triggers`
+* block is unchanged. Compared as canonical JSON so `undefined` optional
+* fields (`customData` / `branches`) collapse identically on both sides.
+*/
+function triggersEqual(a, b) {
+	return JSON.stringify(a) === JSON.stringify(b);
+}
 /**
 * AWS CodeCommit Repository Provider
 *
@@ -37626,19 +37960,25 @@ function tagMapsEqual(a, b) {
 */
 var CodeCommitRepositoryProvider = class {
 	client;
+	s3Client;
 	providerRegion = process.env["AWS_REGION"];
 	logger = getLogger().child("CodeCommitRepositoryProvider");
 	handledProperties = new Map([["AWS::CodeCommit::Repository", new Set([
 		"RepositoryName",
 		"RepositoryDescription",
 		"KmsKeyId",
-		"Tags"
+		"Tags",
+		"Code",
+		"Triggers"
 	])]]);
-	unhandledByDesign = new Map([["AWS::CodeCommit::Repository", new Map([["Code", "CFn-only seed-content orchestration (S3 zip unpacked into an initial commit on a chosen branch); not wired in v1 — pre-flight rejects templates carrying it so nothing is silently dropped; a follow-up could implement it via CreateCommit/PutFile"], ["Triggers", "repository trigger management not wired in v1 — pre-flight rejects templates carrying it so nothing is silently dropped; a follow-up could implement it via PutRepositoryTriggers"]])]]);
 	getClient() {
 		if (!this.client) this.client = new CodeCommitClient(this.providerRegion ? { region: this.providerRegion } : {});
 		return this.client;
 	}
+	getS3Client() {
+		if (!this.s3Client) this.s3Client = new S3Client(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.s3Client;
+	}
 	/**
 	* Build the `Fn::GetAtt` attribute map from a `RepositoryMetadata`
 	* response. `RepositoryId` is additionally stored so the intrinsic
@@ -37671,9 +38011,26 @@ var CodeCommitRepositoryProvider = class {
 				...tags ? { tags } : {}
 			}))).repositoryMetadata;
 			if (!metadata?.repositoryName) throw new Error("CreateRepository did not return repository metadata");
-			this.logger.debug(`Successfully created CodeCommit Repository ${logicalId}: ${metadata.repositoryName}`);
+			const createdName = metadata.repositoryName;
+			try {
+				const code = properties["Code"];
+				if (code) await this.seedInitialCommit(createdName, code);
+				const triggers = properties["Triggers"];
+				if (Array.isArray(triggers) && triggers.length > 0) {
+					await this.getClient().send(new PutRepositoryTriggersCommand({
+						repositoryName: createdName,
+						triggers: toSdkTriggers(triggers)
+					}));
+					this.logger.debug(`Applied ${triggers.length} trigger(s) to ${createdName}`);
+				}
+			} catch (postCreateError) {
+				this.logger.warn(`Post-create step failed for CodeCommit Repository ${logicalId}; deleting the just-created repository ${createdName} to avoid an orphan`);
+				await this.bestEffortDelete(createdName);
+				throw postCreateError;
+			}
+			this.logger.debug(`Successfully created CodeCommit Repository ${logicalId}: ${createdName}`);
 			return {
-				physicalId: metadata.repositoryName,
+				physicalId: createdName,
 				attributes: this.toAttributes(metadata)
 			};
 		} catch (error) {
@@ -37691,7 +38048,11 @@ var CodeCommitRepositoryProvider = class {
 	* CFn's `Ref` value — survives the rename), RepositoryDescription
 	* (UpdateRepositoryDescription), KmsKeyId (UpdateRepositoryEncryptionKey),
 	* Tags (TagResource / UntagResource — full tag removal handled explicitly,
-	* see the ECR Tags regression class in issue #981).
+	* see the ECR Tags regression class in issue #981), Triggers
+	* (PutRepositoryTriggers — a full-set replace, so a dropped or fully-removed
+	* `Triggers` property is applied by putting the new/empty set; issue #1066).
+	* `Code` is create-only seed content (CFn ignores it on update) and is NOT
+	* re-applied here.
 	*
 	* A rename returns the NEW repository name as `physicalId` with
 	* `wasReplaced: false`; the deploy engine persists the returned physical
@@ -37753,6 +38114,14 @@ var CodeCommitRepositoryProvider = class {
 					this.logger.debug(`Updated tags for ${currentName}`);
 				} else this.logger.warn(`Could not resolve ARN for CodeCommit Repository ${currentName}; tag update skipped`);
 			}
+			const newSdkTriggers = toSdkTriggers(properties["Triggers"]);
+			if (!triggersEqual(newSdkTriggers, toSdkTriggers(previousProperties["Triggers"]))) {
+				await this.getClient().send(new PutRepositoryTriggersCommand({
+					repositoryName: currentName,
+					triggers: newSdkTriggers
+				}));
+				this.logger.debug(`Updated triggers for ${currentName} (${newSdkTriggers.length} trigger(s))`);
+			}
 			metadata = await this.getRepositoryMetadata(currentName);
 			return {
 				physicalId: currentName,
@@ -37882,12 +38251,15 @@ var CodeCommitRepositoryProvider = class {
 	* State property paths this provider cannot read back from AWS, skipped by
 	* the drift comparator to avoid a guaranteed false positive.
 	*
-	* `Code` (create-only S3-zip seed content unpacked into an initial commit)
-	* and `Triggers` (repository trigger management, not wired) are both
-	* `unhandledByDesign` — normally rejected pre-flight, but a state written
-	* under `--allow-unsupported-properties` could still carry them, and neither
-	* is read back by `readCurrentState`, so exclude both defensively to avoid a
-	* guaranteed false-positive drift on every run.
+	* `Code` is create-only S3-zip seed content unpacked into the initial
+	* commit — there is no read-back to compare against (the commit is git
+	* history, not a repository attribute), so it can never meaningfully drift.
+	* `Triggers` IS wired on the write side (create + update via
+	* `PutRepositoryTriggers`), but `readCurrentState` does not yet fetch
+	* `GetRepositoryTriggers`, so comparing a state that carries `Triggers`
+	* against an `observedProperties` that omits it would be a guaranteed false
+	* positive. Both are therefore excluded here; a follow-up can add
+	* `GetRepositoryTriggers` read-back and drop `Triggers` from this list.
 	*/
 	getDriftUnknownPaths(_resourceType) {
 		return ["Code", "Triggers"];
@@ -37938,6 +38310,67 @@ var CodeCommitRepositoryProvider = class {
 		return null;
 	}
 	/**
+	* Seed the repository's initial commit from the CFn `Code` property.
+	*
+	* CFn's `Code` orchestration downloads the S3 ZIP, unpacks it, and creates
+	* the repository's first commit on `BranchName` (default `main`). cdkd
+	* reproduces that here: `GetObject` the ZIP, unpack every file entry
+	* (directories are implied by file paths — CodeCommit has no empty-dir
+	* concept), and issue a single `CreateCommit` carrying all files as
+	* `putFiles`. This is create-only: CFn ignores `Code` on update, and so
+	* does cdkd (`update()` never calls this).
+	*
+	* A ZIP with no file entries is a no-op (warn + skip) rather than a hard
+	* failure — CodeCommit rejects a `CreateCommit` with an empty `putFiles`.
+	*/
+	async seedInitialCommit(repositoryName, code) {
+		const bucket = code.S3?.Bucket;
+		const key = code.S3?.Key;
+		if (typeof bucket !== "string" || typeof key !== "string" || !bucket || !key) throw new Error("Code.S3 requires string Bucket and Key");
+		const versionId = typeof code.S3?.ObjectVersion === "string" ? code.S3.ObjectVersion : void 0;
+		const branchName = typeof code.BranchName === "string" && code.BranchName ? code.BranchName : DEFAULT_SEED_BRANCH;
+		const obj = await this.getS3Client().send(new GetObjectCommand({
+			Bucket: bucket,
+			Key: key,
+			...versionId && { VersionId: versionId }
+		}));
+		if (!obj.Body) throw new Error(`Code.S3 object s3://${bucket}/${key} returned an empty body`);
+		const zipBytes = await obj.Body.transformToByteArray();
+		const zip = new AdmZip(Buffer.from(zipBytes));
+		const putFiles = [];
+		for (const entry of zip.getEntries()) {
+			if (entry.isDirectory) continue;
+			putFiles.push({
+				filePath: entry.entryName,
+				fileContent: entry.getData()
+			});
+		}
+		if (putFiles.length === 0) {
+			this.logger.warn(`Code.S3 object s3://${bucket}/${key} contained no files; skipping seed commit for ${repositoryName}`);
+			return;
+		}
+		await this.getClient().send(new CreateCommitCommand({
+			repositoryName,
+			branchName,
+			commitMessage: "Initial commit",
+			putFiles
+		}));
+		this.logger.debug(`Seeded ${repositoryName} with ${putFiles.length} file(s) on branch ${branchName}`);
+	}
+	/**
+	* Best-effort delete used to roll back a just-created repository when a
+	* post-create step (`Code` seed / `Triggers`) fails. Never throws — the
+	* original post-create error is what the caller re-throws; a cleanup
+	* failure is logged so the orphan is surfaced.
+	*/
+	async bestEffortDelete(repositoryName) {
+		try {
+			await this.getClient().send(new DeleteRepositoryCommand$1({ repositoryName }));
+		} catch (cleanupError) {
+			this.logger.warn(`Failed to clean up CodeCommit Repository ${repositoryName} after a post-create failure: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`);
+		}
+	}
+	/**
 	* Fetch the repository's metadata via `GetRepository`. Throws
 	* `RepositoryDoesNotExistException` through to the caller.
 	*/
@@ -60264,7 +60697,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.246.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.248.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());