@go-to-k/cdkd 0.249.0 → 0.251.0

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { $ as ensureAssetStorage, A as WAFv2WebACLProvider, B as LockManager, Bt as LocalInvokeBuildError$1, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_BODY_LIMIT, D as IntrinsicFunctionResolver, Dt as uploadCfnTemplate, E as isTerminationProtectionPropagationError, Et as findLargeInlineResources, F as assertRegionMatch, Ft as setAwsClients, G as stringifyValue, Gt as NestedStackChildDirectDestroyError, H as rebuildClientForBucketRegion, Ht as LocalStartServiceError, I as applyRoleArnIfSet, J as createAssetRedirectResolver, Jt as ResourceTimeoutError, K as WorkGraph, Kt as PartialFailureError, L as DiffCalculator, Lt as CdkdError, M as matchesCdkPath, Mt as AwsClients, N as normalizeAwsTagsToCfn, Nt as getAwsClients, O as cfnRefValueFromPhysicalId, Ot as expectedOwnerParam, P as resolveExplicitPhysicalId, Pt as resetAwsClients, Q as BOOTSTRAP_MARKER_PREFIX, R as DagBuilder, S as ProviderRegistry, St as warnDeprecatedNoPrefixCliFlag, T as disableInstanceApiTermination, Tt as MIGRATE_TMP_PREFIX, U as shouldRetainResource, V as S3StateBackend, Vt as LocalMigrateError, W as AssetPublisher, Wt as MissingCdkCliError, X as rewriteTemplateAssetReferences, Xt as StackHasActiveImportsError, Y as loadPublishableAssetManifest, Yt as ResourceUpdateNotSupportedError, Z as AssetModeResolver, Zt as StackTerminationProtectionError, _ as green, _t as resolveCaptureObservedState, a as withRetry, at as formatDockerLoginError, b as IAMRoleProvider, bt as resolveStateBucketWithDefaultAndSource, c as computeImplicitDeleteEdges, ct as runDockerStreaming, d as isStatefulRecreateTargetSync, dt as Synthesizer, et as getBootstrapMarkerKey, f as renderStatefulReason, ft as synthesisStatusMessage, g as gray, gt as resolveAutoAssetStorage, h as cyan, ht as resolveApp, i as withResourceDeadline, it as buildDockerImage, j as CDK_PATH_TAG, jt as resolveBucketRegion, k as refStateLookupFromResource, kt as AssemblyReader, l as extractDeploymentEventError, lt as AssetManifestLoader, m as bold, mt as getLegacyStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as normalizeAwsError, nt as validateAssetBucketName, o as isRetryableTransientError, ot as getDockerCmd, p as formatResourceLine, pt as getDefaultStateBucketName, q as buildAssetRedirectMap, qt as ProvisioningError, r as DeployEngine, rn as withErrorHandling, rt as validateContainerRepoName, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerForeground, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as parseBootstrapMarker, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as getDockerImageBySourceHash, v as red, vt as resolveSkipPrefix, w as CloudControlProvider, wt as CFN_TEMPLATE_URL_LIMIT, x as collectInlinePolicyNamesManagedBySiblings, xt as resolveUseCdkBootstrapAssets, y as yellow, yt as resolveStateBucketWithDefault, z as TemplateParser } from "./deploy-engine-DqAyGFJu.js";
+import { $ as ensureAssetStorage, A as WAFv2WebACLProvider, B as LockManager, Bt as LocalInvokeBuildError$1, C as findActionableSilentDrops, Ct as CFN_TEMPLATE_BODY_LIMIT, D as IntrinsicFunctionResolver, Dt as uploadCfnTemplate, E as isTerminationProtectionPropagationError, Et as findLargeInlineResources, F as assertRegionMatch, Ft as setAwsClients, G as stringifyValue, Gt as NestedStackChildDirectDestroyError, H as rebuildClientForBucketRegion, Ht as LocalStartServiceError, I as applyRoleArnIfSet, J as createAssetRedirectResolver, Jt as ResourceTimeoutError, K as WorkGraph, Kt as PartialFailureError, L as DiffCalculator, Lt as CdkdError, M as matchesCdkPath, Mt as AwsClients, N as normalizeAwsTagsToCfn, Nt as getAwsClients, O as cfnRefValueFromPhysicalId, Ot as expectedOwnerParam, P as resolveExplicitPhysicalId, Pt as resetAwsClients, Q as BOOTSTRAP_MARKER_PREFIX, R as DagBuilder, S as ProviderRegistry, St as warnDeprecatedNoPrefixCliFlag, T as disableInstanceApiTermination, Tt as MIGRATE_TMP_PREFIX, U as shouldRetainResource, V as S3StateBackend, Vt as LocalMigrateError, W as AssetPublisher, Wt as MissingCdkCliError, X as rewriteTemplateAssetReferences, Xt as StackHasActiveImportsError, Y as loadPublishableAssetManifest, Yt as ResourceUpdateNotSupportedError, Z as AssetModeResolver, Zt as StackTerminationProtectionError, _ as green, _t as resolveCaptureObservedState, a as withRetry, at as formatDockerLoginError, b as IAMRoleProvider, bt as resolveStateBucketWithDefaultAndSource, c as computeImplicitDeleteEdges, ct as runDockerStreaming, d as isStatefulRecreateTargetSync, dt as Synthesizer, et as getBootstrapMarkerKey, f as renderStatefulReason, ft as synthesisStatusMessage, g as gray, gt as resolveAutoAssetStorage, h as cyan, ht as resolveApp, i as withResourceDeadline, it as buildDockerImage, j as CDK_PATH_TAG, jt as resolveBucketRegion, k as refStateLookupFromResource, kt as AssemblyReader, l as extractDeploymentEventError, lt as AssetManifestLoader, m as bold, mt as getLegacyStateBucketName, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as normalizeAwsError, nt as validateAssetBucketName, o as isRetryableTransientError, ot as getDockerCmd, p as formatResourceLine, pt as getDefaultStateBucketName, q as buildAssetRedirectMap, qt as ProvisioningError, r as DeployEngine, rn as withErrorHandling, rt as validateContainerRepoName, s as IMPLICIT_DELETE_DEPENDENCIES, st as runDockerForeground, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as parseBootstrapMarker, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, ut as getDockerImageBySourceHash, v as red, vt as resolveSkipPrefix, w as CloudControlProvider, wt as CFN_TEMPLATE_URL_LIMIT, x as collectInlinePolicyNamesManagedBySiblings, xt as resolveUseCdkBootstrapAssets, y as yellow, yt as resolveStateBucketWithDefault, z as TemplateParser } from "./deploy-engine-D-gBbMiZ.js";
 import { a as getLiveRenderer, c as PATTERN_B_RESOURCE_TYPES, d as generateResourceNameWithFallback, f as withSkipPrefix, i as runStackBuffered, n as getLogger, o as PATTERN_B_NAME_OPTIONS, p as withStackName, s as PATTERN_B_NAME_PROPERTIES, u as generateResourceName } from "./logger-BYMEE-BS.js";
-import { t as ASGProvider } from "./asg-provider-CMWe8LlY.js";
+import { t as ASGProvider } from "./asg-provider-er3xGYRo.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListBucketsCommand, ListDirectoryBucketsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -57,7 +57,7 @@ import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPer
 import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$9, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
-import { AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand as ListClustersCommand$1, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
+import { AddInstanceFleetCommand, AddInstanceGroupsCommand, AddTagsCommand as AddTagsCommand$1, DescribeClusterCommand, EMRClient, InvalidRequestException, ListClustersCommand as ListClustersCommand$1, ListInstanceFleetsCommand, ListInstanceGroupsCommand, ModifyClusterCommand, ModifyInstanceFleetCommand, ModifyInstanceGroupsCommand, PutAutoScalingPolicyCommand, PutAutoTerminationPolicyCommand, PutManagedScalingPolicyCommand, RemoveAutoScalingPolicyCommand, RemoveAutoTerminationPolicyCommand, RemoveManagedScalingPolicyCommand, RemoveTagsCommand as RemoveTagsCommand$1, RunJobFlowCommand, SetTerminationProtectionCommand, SetVisibleToAllUsersCommand, TerminateJobFlowsCommand } from "@aws-sdk/client-emr";
 import { CreateDeliveryStreamCommand, DeleteDeliveryStreamCommand, DescribeDeliveryStreamCommand, FirehoseClient, ListDeliveryStreamsCommand, ListTagsForDeliveryStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, TagDeliveryStreamCommand, UntagDeliveryStreamCommand, UpdateDestinationCommand } from "@aws-sdk/client-firehose";
 import { AddTagsCommand as AddTagsCommand$2, CloudTrailClient, CreateTrailCommand, DeleteTrailCommand, GetEventSelectorsCommand, GetInsightSelectorsCommand, GetTrailCommand, GetTrailStatusCommand, ListTagsCommand as ListTagsCommand$1, ListTrailsCommand, PutEventSelectorsCommand, PutInsightSelectorsCommand, RemoveTagsCommand as RemoveTagsCommand$2, StartLoggingCommand, StopLoggingCommand, TrailNotFoundException, UpdateTrailCommand } from "@aws-sdk/client-cloudtrail";
 import { BatchGetProjectsCommand, CodeBuildClient, CreateProjectCommand, DeleteProjectCommand, ListProjectsCommand, ResourceNotFoundException as ResourceNotFoundException$11, UpdateProjectCommand } from "@aws-sdk/client-codebuild";
@@ -1888,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.249.0";
+	return "0.251.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -34410,8 +34410,8 @@ var EFSProvider = class {
 * storage-capacity growth and deletes can take substantially longer —
 * mirror the Custom Resource provider's 1-hour ceiling.
 */
-const DEFAULT_MAX_WAIT_MS$1 = 3600 * 1e3;
-const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
+const DEFAULT_MAX_WAIT_MS$3 = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS$3 = 15e3;
 /**
 * Lustre sub-properties that `UpdateFileSystem` accepts (the mutable
 * subset of the CFn `LustreConfiguration` block). Everything else in the
@@ -34494,6 +34494,11 @@ const VARIANT_CONFIG_KEY = {
 	ONTAP: "OntapConfiguration",
 	OPENZFS: "OpenZFSConfiguration"
 };
+/**
+* Exported so a unit test can assert every declared-mutable sub-property has
+* a matching `apply*UpdateField` case — the invariant the unreachable
+* `default:` guard enforces at runtime.
+*/
 const VARIANT_MUTABLE_SUBPROPS = {
 	LustreConfiguration: LUSTRE_MUTABLE_SUBPROPS,
 	WindowsConfiguration: WINDOWS_MUTABLE_SUBPROPS,
@@ -34501,6 +34506,21 @@ const VARIANT_MUTABLE_SUBPROPS = {
 	OpenZFSConfiguration: OPENZFS_MUTABLE_SUBPROPS
 };
 /**
+* Copy `value` into `target[key]` only when AWS actually returned it, so the
+* snapshot carries no `undefined`-valued keys.
+*
+* The drift comparator walks the BASELINE's keys (`observedProperties`, or
+* `properties` when a resource predates observed-capture), not the AWS side —
+* so an omitted key here is not itself phantom drift. It matters because this
+* snapshot BECOMES the next baseline: `deploy-engine` stores it as
+* `observedProperties`, and an explicit `Foo: undefined` would then be walked
+* as a real key on every later comparison. Omitting is also what keeps the
+* emitted shape a faithful subset of the CFn input shape.
+*/
+const putIfDefined = (target, key, value) => {
+	if (value !== void 0) target[key] = value;
+};
+/**
 * Compute the Add/Remove route-table-id deltas an ONTAP / OpenZFS
 * `UpdateFileSystem` needs from the previous vs. next `RouteTableIds` list.
 * Route table membership is an unordered set, so a pure reorder yields no
@@ -34530,7 +34550,7 @@ const TOP_LEVEL_IMMUTABLE_PROPS = [
 	"KmsKeyId",
 	"BackupId"
 ];
-const toNumber$1 = (v) => v === void 0 ? void 0 : Number(v);
+const toNumber$3 = (v) => v === void 0 ? void 0 : Number(v);
 const toBoolean$1 = (v) => {
 	if (v === void 0) return void 0;
 	if (typeof v === "string") return v === "true";
@@ -34581,8 +34601,8 @@ var FSxFileSystemProvider = class {
 	pollIntervalMs;
 	maxWaitMs;
 	constructor(options) {
-		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$1;
-		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$1;
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$3;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$3;
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::FSx::FileSystem", /* @__PURE__ */ new Set([
 		"BackupId",
@@ -34635,7 +34655,7 @@ var FSxFileSystemProvider = class {
 			SecurityGroupIds: properties["SecurityGroupIds"],
 			KmsKeyId: properties["KmsKeyId"],
 			StorageType: properties["StorageType"],
-			StorageCapacity: toNumber$1(properties["StorageCapacity"]),
+			StorageCapacity: toNumber$3(properties["StorageCapacity"]),
 			FileSystemTypeVersion: properties["FileSystemTypeVersion"],
 			NetworkType: properties["NetworkType"],
 			LustreConfiguration: this.toCreateLustreConfiguration(properties["LustreConfiguration"]),
@@ -34691,24 +34711,24 @@ var FSxFileSystemProvider = class {
 			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
 			ImportPath: config["ImportPath"],
 			ExportPath: config["ExportPath"],
-			ImportedFileChunkSize: toNumber$1(config["ImportedFileChunkSize"]),
+			ImportedFileChunkSize: toNumber$3(config["ImportedFileChunkSize"]),
 			DeploymentType: config["DeploymentType"],
 			AutoImportPolicy: config["AutoImportPolicy"],
-			PerUnitStorageThroughput: toNumber$1(config["PerUnitStorageThroughput"]),
+			PerUnitStorageThroughput: toNumber$3(config["PerUnitStorageThroughput"]),
 			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
-			AutomaticBackupRetentionDays: toNumber$1(config["AutomaticBackupRetentionDays"]),
+			AutomaticBackupRetentionDays: toNumber$3(config["AutomaticBackupRetentionDays"]),
 			CopyTagsToBackups: toBoolean$1(config["CopyTagsToBackups"]),
 			DriveCacheType: config["DriveCacheType"],
 			DataCompressionType: config["DataCompressionType"],
 			EfaEnabled: toBoolean$1(config["EfaEnabled"]),
-			ThroughputCapacity: toNumber$1(config["ThroughputCapacity"]),
+			ThroughputCapacity: toNumber$3(config["ThroughputCapacity"]),
 			MetadataConfiguration: metadata ? {
 				Mode: metadata["Mode"],
-				Iops: toNumber$1(metadata["Iops"])
+				Iops: toNumber$3(metadata["Iops"])
 			} : void 0,
 			DataReadCacheConfiguration: readCache ? {
 				SizingMode: readCache["SizingMode"],
-				SizeGiB: toNumber$1(readCache["SizeGiB"])
+				SizeGiB: toNumber$3(readCache["SizeGiB"])
 			} : void 0
 		};
 	}
@@ -34720,10 +34740,10 @@ var FSxFileSystemProvider = class {
 			SelfManagedActiveDirectoryConfiguration: this.toSelfManagedAdConfiguration(config["SelfManagedActiveDirectoryConfiguration"]),
 			DeploymentType: config["DeploymentType"],
 			PreferredSubnetId: config["PreferredSubnetId"],
-			ThroughputCapacity: toNumber$1(config["ThroughputCapacity"]),
+			ThroughputCapacity: toNumber$3(config["ThroughputCapacity"]),
 			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
 			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
-			AutomaticBackupRetentionDays: toNumber$1(config["AutomaticBackupRetentionDays"]),
+			AutomaticBackupRetentionDays: toNumber$3(config["AutomaticBackupRetentionDays"]),
 			CopyTagsToBackups: toBoolean$1(config["CopyTagsToBackups"]),
 			Aliases: config["Aliases"],
 			AuditLogConfiguration: this.toWindowsAuditLogConfiguration(config["AuditLogConfiguration"]),
@@ -34735,7 +34755,7 @@ var FSxFileSystemProvider = class {
 	toCreateOntapConfiguration(config) {
 		if (!config) return void 0;
 		return {
-			AutomaticBackupRetentionDays: toNumber$1(config["AutomaticBackupRetentionDays"]),
+			AutomaticBackupRetentionDays: toNumber$3(config["AutomaticBackupRetentionDays"]),
 			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
 			DeploymentType: config["DeploymentType"],
 			EndpointIpAddressRange: config["EndpointIpAddressRange"],
@@ -34743,10 +34763,10 @@ var FSxFileSystemProvider = class {
 			DiskIopsConfiguration: this.toDiskIopsConfiguration(config["DiskIopsConfiguration"]),
 			PreferredSubnetId: config["PreferredSubnetId"],
 			RouteTableIds: config["RouteTableIds"],
-			ThroughputCapacity: toNumber$1(config["ThroughputCapacity"]),
+			ThroughputCapacity: toNumber$3(config["ThroughputCapacity"]),
 			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
-			HAPairs: toNumber$1(config["HAPairs"]),
-			ThroughputCapacityPerHAPair: toNumber$1(config["ThroughputCapacityPerHAPair"]),
+			HAPairs: toNumber$3(config["HAPairs"]),
+			ThroughputCapacityPerHAPair: toNumber$3(config["ThroughputCapacityPerHAPair"]),
 			EndpointIpv6AddressRange: config["EndpointIpv6AddressRange"]
 		};
 	}
@@ -34754,12 +34774,12 @@ var FSxFileSystemProvider = class {
 	toCreateOpenZFSConfiguration(config) {
 		if (!config) return void 0;
 		return {
-			AutomaticBackupRetentionDays: toNumber$1(config["AutomaticBackupRetentionDays"]),
+			AutomaticBackupRetentionDays: toNumber$3(config["AutomaticBackupRetentionDays"]),
 			CopyTagsToBackups: toBoolean$1(config["CopyTagsToBackups"]),
 			CopyTagsToVolumes: toBoolean$1(config["CopyTagsToVolumes"]),
 			DailyAutomaticBackupStartTime: config["DailyAutomaticBackupStartTime"],
 			DeploymentType: config["DeploymentType"],
-			ThroughputCapacity: toNumber$1(config["ThroughputCapacity"]),
+			ThroughputCapacity: toNumber$3(config["ThroughputCapacity"]),
 			WeeklyMaintenanceStartTime: config["WeeklyMaintenanceStartTime"],
 			DiskIopsConfiguration: this.toDiskIopsConfiguration(config["DiskIopsConfiguration"]),
 			RootVolumeConfiguration: this.toOpenZFSRootVolumeConfiguration(config["RootVolumeConfiguration"]),
@@ -34774,7 +34794,7 @@ var FSxFileSystemProvider = class {
 		if (!config) return void 0;
 		return {
 			Mode: config["Mode"],
-			Iops: toNumber$1(config["Iops"])
+			Iops: toNumber$3(config["Iops"])
 		};
 	}
 	toSelfManagedAdConfiguration(config) {
@@ -34821,7 +34841,7 @@ var FSxFileSystemProvider = class {
 		const nfsExports = config["NfsExports"];
 		const quotas = config["UserAndGroupQuotas"];
 		return {
-			RecordSizeKiB: toNumber$1(config["RecordSizeKiB"]),
+			RecordSizeKiB: toNumber$3(config["RecordSizeKiB"]),
 			DataCompressionType: config["DataCompressionType"],
 			NfsExports: nfsExports?.map((exp) => ({ ClientConfigurations: (exp["ClientConfigurations"] ?? []).map((cc) => ({
 				Clients: cc["Clients"],
@@ -34829,8 +34849,8 @@ var FSxFileSystemProvider = class {
 			})) })),
 			UserAndGroupQuotas: quotas?.map((q) => ({
 				Type: q["Type"],
-				Id: toNumber$1(q["Id"]),
-				StorageCapacityQuotaGiB: toNumber$1(q["StorageCapacityQuotaGiB"])
+				Id: toNumber$3(q["Id"]),
+				StorageCapacityQuotaGiB: toNumber$3(q["StorageCapacityQuotaGiB"])
 			})),
 			CopyTagsToSnapshots: toBoolean$1(config["CopyTagsToSnapshots"]),
 			ReadOnly: toBoolean$1(config["ReadOnly"])
@@ -34840,7 +34860,7 @@ var FSxFileSystemProvider = class {
 		if (!config) return void 0;
 		return {
 			SizingMode: config["SizingMode"],
-			SizeGiB: toNumber$1(config["SizeGiB"])
+			SizeGiB: toNumber$3(config["SizeGiB"])
 		};
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -34875,7 +34895,7 @@ var FSxFileSystemProvider = class {
 				const callTimeMs = Date.now();
 				const respPendingActions = ((await this.getClient().send(new UpdateFileSystemCommand$1({
 					FileSystemId: physicalId,
-					...storageCapacityChanged && { StorageCapacity: toNumber$1(properties["StorageCapacity"]) },
+					...storageCapacityChanged && { StorageCapacity: toNumber$3(properties["StorageCapacity"]) },
 					...storageTypeChanged && { StorageType: properties["StorageType"] },
 					...typeVersionChanged && { FileSystemTypeVersion: properties["FileSystemTypeVersion"] },
 					...networkTypeChanged && { NetworkType: properties["NetworkType"] },
@@ -34927,14 +34947,30 @@ var FSxFileSystemProvider = class {
 			const prevVal = prev[key];
 			if (JSON.stringify(nextVal) === JSON.stringify(prevVal)) continue;
 			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
-			if (configKey === "LustreConfiguration" ? this.applyLustreUpdateField(key, nextVal, diff) : configKey === "WindowsConfiguration" ? this.applyWindowsUpdateField(key, nextVal, diff) : configKey === "OntapConfiguration" ? this.applyOntapUpdateField(key, nextVal, prevVal, diff) : this.applyOpenZFSUpdateField(key, nextVal, prevVal, diff)) hasMutableDiff = true;
+			const ctx = {
+				resourceType,
+				logicalId,
+				configKey
+			};
+			if (configKey === "LustreConfiguration" ? this.applyLustreUpdateField(ctx, key, nextVal, diff) : configKey === "WindowsConfiguration" ? this.applyWindowsUpdateField(ctx, key, nextVal, diff) : configKey === "OntapConfiguration" ? this.applyOntapUpdateField(ctx, key, nextVal, prevVal, diff) : this.applyOpenZFSUpdateField(ctx, key, nextVal, prevVal, diff)) hasMutableDiff = true;
 		}
 		return {
 			diff,
 			hasMutableDiff
 		};
 	}
-	applyLustreUpdateField(key, next, diff) {
+	/**
+	* A sub-property listed in a `*_MUTABLE_SUBPROPS` set with no matching
+	* `apply*UpdateField` case. Reaching here is a cdkd bug, not user error:
+	* `computeVariantConfigDiff` already accepted the key as mutable, so
+	* falling through would issue a no-op `UpdateFileSystem` (`hasMutableDiff`
+	* true, empty diff) and silently drop the user's change. Fail loudly
+	* instead so the missing mapping surfaces the moment it is added.
+	*/
+	unmappedMutableSubprop(ctx, key) {
+		throw new ProvisioningError(`AWS FSx FileSystem ${ctx.configKey}.${key} is declared mutable but has no UpdateFileSystem mapping in cdkd. This is a cdkd bug — please report it at https://github.com/go-to-k/cdkd/issues`, ctx.resourceType, ctx.logicalId);
+	}
+	applyLustreUpdateField(ctx, key, next, diff) {
 		const out = diff;
 		switch (key) {
 			case "WeeklyMaintenanceStartTime":
@@ -34944,7 +34980,7 @@ var FSxFileSystemProvider = class {
 			case "AutomaticBackupRetentionDays":
 			case "PerUnitStorageThroughput":
 			case "ThroughputCapacity":
-				diff[key] = toNumber$1(next);
+				diff[key] = toNumber$3(next);
 				break;
 			case "AutoImportPolicy":
 			case "DataCompressionType":
@@ -34954,7 +34990,7 @@ var FSxFileSystemProvider = class {
 				const metadata = next;
 				out.MetadataConfiguration = metadata ? {
 					Mode: metadata["Mode"],
-					Iops: toNumber$1(metadata["Iops"])
+					Iops: toNumber$3(metadata["Iops"])
 				} : void 0;
 				break;
 			}
@@ -34962,14 +34998,15 @@ var FSxFileSystemProvider = class {
 				const readCache = next;
 				out.DataReadCacheConfiguration = readCache ? {
 					SizingMode: readCache["SizingMode"],
-					SizeGiB: toNumber$1(readCache["SizeGiB"])
+					SizeGiB: toNumber$3(readCache["SizeGiB"])
 				} : void 0;
 				break;
 			}
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
-	applyWindowsUpdateField(key, next, diff) {
+	applyWindowsUpdateField(ctx, key, next, diff) {
 		const out = diff;
 		switch (key) {
 			case "WeeklyMaintenanceStartTime":
@@ -34978,7 +35015,7 @@ var FSxFileSystemProvider = class {
 				break;
 			case "AutomaticBackupRetentionDays":
 			case "ThroughputCapacity":
-				diff[key] = toNumber$1(next);
+				diff[key] = toNumber$3(next);
 				break;
 			case "SelfManagedActiveDirectoryConfiguration":
 				out.SelfManagedActiveDirectoryConfiguration = this.toSelfManagedAdConfigurationUpdates(next);
@@ -34992,10 +35029,11 @@ var FSxFileSystemProvider = class {
 			case "FsrmConfiguration":
 				out.FsrmConfiguration = this.toWindowsFsrmConfiguration(next);
 				break;
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
-	applyOntapUpdateField(key, next, prev, diff) {
+	applyOntapUpdateField(ctx, key, next, prev, diff) {
 		const out = diff;
 		switch (key) {
 			case "DailyAutomaticBackupStartTime":
@@ -35008,7 +35046,7 @@ var FSxFileSystemProvider = class {
 			case "ThroughputCapacity":
 			case "ThroughputCapacityPerHAPair":
 			case "HAPairs":
-				diff[key] = toNumber$1(next);
+				diff[key] = toNumber$3(next);
 				break;
 			case "DiskIopsConfiguration":
 				out.DiskIopsConfiguration = this.toDiskIopsConfiguration(next);
@@ -35019,10 +35057,11 @@ var FSxFileSystemProvider = class {
 				if (remove) out.RemoveRouteTableIds = remove;
 				return add !== void 0 || remove !== void 0;
 			}
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
-	applyOpenZFSUpdateField(key, next, prev, diff) {
+	applyOpenZFSUpdateField(ctx, key, next, prev, diff) {
 		const out = diff;
 		switch (key) {
 			case "DailyAutomaticBackupStartTime":
@@ -35036,7 +35075,7 @@ var FSxFileSystemProvider = class {
 				break;
 			case "AutomaticBackupRetentionDays":
 			case "ThroughputCapacity":
-				diff[key] = toNumber$1(next);
+				diff[key] = toNumber$3(next);
 				break;
 			case "DiskIopsConfiguration":
 				out.DiskIopsConfiguration = this.toDiskIopsConfiguration(next);
@@ -35050,6 +35089,7 @@ var FSxFileSystemProvider = class {
 				if (remove) out.RemoveRouteTableIds = remove;
 				return add !== void 0 || remove !== void 0;
 			}
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
@@ -35223,28 +35263,122 @@ var FSxFileSystemProvider = class {
 			default: return;
 		}
 	}
+	/** Map the read-side `WindowsConfiguration` back to CFn input shape. */
+	readWindowsConfiguration(windows) {
+		const config = {};
+		putIfDefined(config, "ActiveDirectoryId", windows.ActiveDirectoryId);
+		putIfDefined(config, "DeploymentType", windows.DeploymentType);
+		putIfDefined(config, "PreferredSubnetId", windows.PreferredSubnetId);
+		putIfDefined(config, "ThroughputCapacity", windows.ThroughputCapacity);
+		putIfDefined(config, "WeeklyMaintenanceStartTime", windows.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", windows.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "AutomaticBackupRetentionDays", windows.AutomaticBackupRetentionDays);
+		putIfDefined(config, "CopyTagsToBackups", windows.CopyTagsToBackups);
+		if (windows.Aliases !== void 0) config["Aliases"] = windows.Aliases.map((alias) => alias.Name).filter((name) => name !== void 0);
+		if (windows.SelfManagedActiveDirectoryConfiguration) {
+			const ad = windows.SelfManagedActiveDirectoryConfiguration;
+			const adConfig = {};
+			putIfDefined(adConfig, "DomainName", ad.DomainName);
+			putIfDefined(adConfig, "OrganizationalUnitDistinguishedName", ad.OrganizationalUnitDistinguishedName);
+			putIfDefined(adConfig, "FileSystemAdministratorsGroup", ad.FileSystemAdministratorsGroup);
+			putIfDefined(adConfig, "UserName", ad.UserName);
+			putIfDefined(adConfig, "DnsIps", ad.DnsIps ? [...ad.DnsIps] : void 0);
+			putIfDefined(adConfig, "DomainJoinServiceAccountSecret", ad.DomainJoinServiceAccountSecret);
+			if (Object.keys(adConfig).length > 0) config["SelfManagedActiveDirectoryConfiguration"] = adConfig;
+		}
+		if (windows.AuditLogConfiguration) {
+			const audit = {};
+			putIfDefined(audit, "FileAccessAuditLogLevel", windows.AuditLogConfiguration.FileAccessAuditLogLevel);
+			putIfDefined(audit, "FileShareAccessAuditLogLevel", windows.AuditLogConfiguration.FileShareAccessAuditLogLevel);
+			putIfDefined(audit, "AuditLogDestination", windows.AuditLogConfiguration.AuditLogDestination);
+			if (Object.keys(audit).length > 0) config["AuditLogConfiguration"] = audit;
+		}
+		const diskIops = this.readDiskIopsConfiguration(windows.DiskIopsConfiguration);
+		if (diskIops) config["DiskIopsConfiguration"] = diskIops;
+		if (windows.FsrmConfiguration) {
+			const fsrm = {};
+			putIfDefined(fsrm, "FsrmServiceEnabled", windows.FsrmConfiguration.FsrmServiceEnabled);
+			putIfDefined(fsrm, "EventLogDestination", windows.FsrmConfiguration.EventLogDestination);
+			if (Object.keys(fsrm).length > 0) config["FsrmConfiguration"] = fsrm;
+		}
+		return config;
+	}
+	/** Map the read-side `OntapConfiguration` back to CFn input shape. */
+	readOntapConfiguration(ontap) {
+		const config = {};
+		putIfDefined(config, "DeploymentType", ontap.DeploymentType);
+		putIfDefined(config, "AutomaticBackupRetentionDays", ontap.AutomaticBackupRetentionDays);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", ontap.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "WeeklyMaintenanceStartTime", ontap.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "EndpointIpAddressRange", ontap.EndpointIpAddressRange);
+		putIfDefined(config, "PreferredSubnetId", ontap.PreferredSubnetId);
+		putIfDefined(config, "ThroughputCapacity", ontap.ThroughputCapacity);
+		putIfDefined(config, "ThroughputCapacityPerHAPair", ontap.ThroughputCapacityPerHAPair);
+		putIfDefined(config, "HAPairs", ontap.HAPairs);
+		putIfDefined(config, "RouteTableIds", ontap.RouteTableIds ? [...ontap.RouteTableIds] : void 0);
+		putIfDefined(config, "EndpointIpv6AddressRange", ontap.EndpointIpv6AddressRange);
+		const diskIops = this.readDiskIopsConfiguration(ontap.DiskIopsConfiguration);
+		if (diskIops) config["DiskIopsConfiguration"] = diskIops;
+		return config;
+	}
+	/** Map the read-side `OpenZFSConfiguration` back to CFn input shape. */
+	readOpenZFSConfiguration(openzfs) {
+		const config = {};
+		putIfDefined(config, "DeploymentType", openzfs.DeploymentType);
+		putIfDefined(config, "AutomaticBackupRetentionDays", openzfs.AutomaticBackupRetentionDays);
+		putIfDefined(config, "CopyTagsToBackups", openzfs.CopyTagsToBackups);
+		putIfDefined(config, "CopyTagsToVolumes", openzfs.CopyTagsToVolumes);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", openzfs.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "WeeklyMaintenanceStartTime", openzfs.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "ThroughputCapacity", openzfs.ThroughputCapacity);
+		putIfDefined(config, "PreferredSubnetId", openzfs.PreferredSubnetId);
+		putIfDefined(config, "EndpointIpAddressRange", openzfs.EndpointIpAddressRange);
+		putIfDefined(config, "RouteTableIds", openzfs.RouteTableIds ? [...openzfs.RouteTableIds] : void 0);
+		putIfDefined(config, "EndpointIpv6AddressRange", openzfs.EndpointIpv6AddressRange);
+		const diskIops = this.readDiskIopsConfiguration(openzfs.DiskIopsConfiguration);
+		if (diskIops) config["DiskIopsConfiguration"] = diskIops;
+		if (openzfs.ReadCacheConfiguration) {
+			const readCache = {};
+			putIfDefined(readCache, "SizingMode", openzfs.ReadCacheConfiguration.SizingMode);
+			putIfDefined(readCache, "SizeGiB", openzfs.ReadCacheConfiguration.SizeGiB);
+			if (Object.keys(readCache).length > 0) config["ReadCacheConfiguration"] = readCache;
+		}
+		return config;
+	}
+	/** Shared `DiskIopsConfiguration` reverse-mapper (Windows / ONTAP / OpenZFS). */
+	readDiskIopsConfiguration(diskIops) {
+		if (!diskIops) return void 0;
+		const out = {};
+		putIfDefined(out, "Mode", diskIops.Mode);
+		putIfDefined(out, "Iops", diskIops.Iops);
+		return Object.keys(out).length > 0 ? out : void 0;
+	}
 	/**
 	* State property paths this provider cannot read back from AWS:
 	*  - `SecurityGroupIds` — `DescribeFileSystems` returns network
 	*    interface ids, never the original security group list.
 	*  - `BackupId` — creation-source input, not surfaced on the deployed
 	*    file system.
-	*  - `WindowsConfiguration` / `OntapConfiguration` / `OpenZFSConfiguration`
-	*    — `readCurrentState` maps only the Lustre block back to CFn shape
-	*    today, so drift on the non-Lustre variant blocks is not yet computed;
-	*    marking them unknown avoids a guaranteed false positive on every run
-	*    (variant-config drift is a follow-up). Only the block matching the
-	*    file system's type is ever present in state, so listing all three is
-	*    harmless.
+	*  - `WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password`
+	*    / `OntapConfiguration.FsxAdminPassword` — write-only credentials; the
+	*    API never echoes them back.
+	*  - `OpenZFSConfiguration.RootVolumeConfiguration` — configured on the
+	*    root VOLUME, not the file system; `DescribeFileSystems` returns only
+	*    `RootVolumeId`, so reading it back would need a separate
+	*    `DescribeVolumes` call (out of scope here).
+	*
+	* The whole-block `WindowsConfiguration` / `OntapConfiguration` /
+	* `OpenZFSConfiguration` entries are gone as of the variant reverse-mappers
+	* — only the individually-unreadable leaves above stay unknown.
 	*/
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType !== "AWS::FSx::FileSystem") return [];
 		return [
 			"SecurityGroupIds",
 			"BackupId",
-			"WindowsConfiguration",
-			"OntapConfiguration",
-			"OpenZFSConfiguration"
+			"WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password",
+			"OntapConfiguration.FsxAdminPassword",
+			"OpenZFSConfiguration.RootVolumeConfiguration"
 		];
 	}
 	/**
@@ -35252,7 +35386,11 @@ var FSxFileSystemProvider = class {
 	* via `DescribeFileSystems`. Lustre data-repository fields (`ImportPath`
 	* / `ExportPath` / `AutoImportPolicy` / `ImportedFileChunkSize`) are
 	* mapped back from the nested `DataRepositoryConfiguration` the API
-	* returns. Returns `undefined` when the file system is gone.
+	* returns. The Windows / ONTAP / OpenZFS variant blocks are reverse-mapped
+	* by their respective `read*Configuration` helpers; the few inputs AWS
+	* never returns stay listed in {@link getDriftUnknownPaths}. At most one
+	* variant block is ever present (they key off `FileSystemType`).
+	* Returns `undefined` when the file system is gone.
 	*/
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		if (resourceType !== "AWS::FSx::FileSystem") return void 0;
@@ -35265,47 +35403,59 @@ var FSxFileSystemProvider = class {
 		}
 		if (!fs) return void 0;
 		const result = {};
-		if (fs.FileSystemType !== void 0) result["FileSystemType"] = fs.FileSystemType;
-		if (fs.StorageCapacity !== void 0) result["StorageCapacity"] = fs.StorageCapacity;
-		if (fs.StorageType !== void 0) result["StorageType"] = fs.StorageType;
-		if (fs.SubnetIds !== void 0) result["SubnetIds"] = [...fs.SubnetIds];
-		if (fs.KmsKeyId !== void 0) result["KmsKeyId"] = fs.KmsKeyId;
-		if (fs.FileSystemTypeVersion !== void 0) result["FileSystemTypeVersion"] = fs.FileSystemTypeVersion;
-		if (fs.NetworkType !== void 0) result["NetworkType"] = fs.NetworkType;
+		putIfDefined(result, "FileSystemType", fs.FileSystemType);
+		putIfDefined(result, "StorageCapacity", fs.StorageCapacity);
+		putIfDefined(result, "StorageType", fs.StorageType);
+		putIfDefined(result, "SubnetIds", fs.SubnetIds ? [...fs.SubnetIds] : void 0);
+		putIfDefined(result, "KmsKeyId", fs.KmsKeyId);
+		putIfDefined(result, "FileSystemTypeVersion", fs.FileSystemTypeVersion);
+		putIfDefined(result, "NetworkType", fs.NetworkType);
 		const lustre = fs.LustreConfiguration;
 		if (lustre) {
 			const config = {};
-			if (lustre.WeeklyMaintenanceStartTime !== void 0) config["WeeklyMaintenanceStartTime"] = lustre.WeeklyMaintenanceStartTime;
-			if (lustre.DeploymentType !== void 0) config["DeploymentType"] = lustre.DeploymentType;
-			if (lustre.PerUnitStorageThroughput !== void 0) config["PerUnitStorageThroughput"] = lustre.PerUnitStorageThroughput;
-			if (lustre.DailyAutomaticBackupStartTime !== void 0) config["DailyAutomaticBackupStartTime"] = lustre.DailyAutomaticBackupStartTime;
-			if (lustre.AutomaticBackupRetentionDays !== void 0) config["AutomaticBackupRetentionDays"] = lustre.AutomaticBackupRetentionDays;
-			if (lustre.CopyTagsToBackups !== void 0) config["CopyTagsToBackups"] = lustre.CopyTagsToBackups;
-			if (lustre.DriveCacheType !== void 0) config["DriveCacheType"] = lustre.DriveCacheType;
-			if (lustre.DataCompressionType !== void 0) config["DataCompressionType"] = lustre.DataCompressionType;
-			if (lustre.EfaEnabled !== void 0) config["EfaEnabled"] = lustre.EfaEnabled;
-			if (lustre.ThroughputCapacity !== void 0) config["ThroughputCapacity"] = lustre.ThroughputCapacity;
+			putIfDefined(config, "WeeklyMaintenanceStartTime", lustre.WeeklyMaintenanceStartTime);
+			putIfDefined(config, "DeploymentType", lustre.DeploymentType);
+			putIfDefined(config, "PerUnitStorageThroughput", lustre.PerUnitStorageThroughput);
+			putIfDefined(config, "DailyAutomaticBackupStartTime", lustre.DailyAutomaticBackupStartTime);
+			putIfDefined(config, "AutomaticBackupRetentionDays", lustre.AutomaticBackupRetentionDays);
+			putIfDefined(config, "CopyTagsToBackups", lustre.CopyTagsToBackups);
+			putIfDefined(config, "DriveCacheType", lustre.DriveCacheType);
+			putIfDefined(config, "DataCompressionType", lustre.DataCompressionType);
+			putIfDefined(config, "EfaEnabled", lustre.EfaEnabled);
+			putIfDefined(config, "ThroughputCapacity", lustre.ThroughputCapacity);
 			if (lustre.MetadataConfiguration) {
 				const metadata = {};
-				if (lustre.MetadataConfiguration.Mode !== void 0) metadata["Mode"] = lustre.MetadataConfiguration.Mode;
-				if (lustre.MetadataConfiguration.Iops !== void 0) metadata["Iops"] = lustre.MetadataConfiguration.Iops;
+				putIfDefined(metadata, "Mode", lustre.MetadataConfiguration.Mode);
+				putIfDefined(metadata, "Iops", lustre.MetadataConfiguration.Iops);
 				if (Object.keys(metadata).length > 0) config["MetadataConfiguration"] = metadata;
 			}
 			if (lustre.DataReadCacheConfiguration) {
 				const readCache = {};
-				if (lustre.DataReadCacheConfiguration.SizingMode !== void 0) readCache["SizingMode"] = lustre.DataReadCacheConfiguration.SizingMode;
-				if (lustre.DataReadCacheConfiguration.SizeGiB !== void 0) readCache["SizeGiB"] = lustre.DataReadCacheConfiguration.SizeGiB;
+				putIfDefined(readCache, "SizingMode", lustre.DataReadCacheConfiguration.SizingMode);
+				putIfDefined(readCache, "SizeGiB", lustre.DataReadCacheConfiguration.SizeGiB);
 				if (Object.keys(readCache).length > 0) config["DataReadCacheConfiguration"] = readCache;
 			}
 			const dataRepo = lustre.DataRepositoryConfiguration;
 			if (dataRepo) {
-				if (dataRepo.ImportPath !== void 0) config["ImportPath"] = dataRepo.ImportPath;
-				if (dataRepo.ExportPath !== void 0) config["ExportPath"] = dataRepo.ExportPath;
-				if (dataRepo.AutoImportPolicy !== void 0) config["AutoImportPolicy"] = dataRepo.AutoImportPolicy;
-				if (dataRepo.ImportedFileChunkSize !== void 0) config["ImportedFileChunkSize"] = dataRepo.ImportedFileChunkSize;
+				putIfDefined(config, "ImportPath", dataRepo.ImportPath);
+				putIfDefined(config, "ExportPath", dataRepo.ExportPath);
+				putIfDefined(config, "AutoImportPolicy", dataRepo.AutoImportPolicy);
+				putIfDefined(config, "ImportedFileChunkSize", dataRepo.ImportedFileChunkSize);
 			}
 			if (Object.keys(config).length > 0) result["LustreConfiguration"] = config;
 		}
+		if (fs.WindowsConfiguration) {
+			const config = this.readWindowsConfiguration(fs.WindowsConfiguration);
+			if (Object.keys(config).length > 0) result["WindowsConfiguration"] = config;
+		}
+		if (fs.OntapConfiguration) {
+			const config = this.readOntapConfiguration(fs.OntapConfiguration);
+			if (Object.keys(config).length > 0) result["OntapConfiguration"] = config;
+		}
+		if (fs.OpenZFSConfiguration) {
+			const config = this.readOpenZFSConfiguration(fs.OpenZFSConfiguration);
+			if (Object.keys(config).length > 0) result["OpenZFSConfiguration"] = config;
+		}
 		result["Tags"] = normalizeAwsTagsToCfn(fs.Tags);
 		return result;
 	}
@@ -35353,8 +35503,8 @@ var FSxFileSystemProvider = class {
 * FSx providers' 1-hour ceiling so the slowest realistic create/terminate
 * still fits inside the per-resource deadline.
 */
-const DEFAULT_MAX_WAIT_MS = 3600 * 1e3;
-const DEFAULT_POLL_INTERVAL_MS = 15e3;
+const DEFAULT_MAX_WAIT_MS$2 = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS$2 = 15e3;
 /** Cluster states that mean "create succeeded, the cluster is up". */
 const CREATE_READY_STATES = /* @__PURE__ */ new Set(["WAITING", "RUNNING"]);
 /**
@@ -35388,7 +35538,7 @@ const MUTABLE_TOP_LEVEL_PROPS = /* @__PURE__ */ new Set([
 	"ManagedScalingPolicy",
 	"AutoTerminationPolicy"
 ]);
-const toNumber = (v) => {
+const toNumber$2 = (v) => {
 	if (v === void 0) return void 0;
 	const n = Number(v);
 	return Number.isNaN(n) ? void 0 : n;
@@ -35398,7 +35548,7 @@ const toBoolean = (v) => {
 	if (typeof v === "string") return v === "true";
 	return Boolean(v);
 };
-const jsonEqual = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+const jsonEqual$2 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
 /**
 * SDK Provider for `AWS::EMR::Cluster` (EMR on EC2).
 *
@@ -35444,8 +35594,8 @@ var EMRClusterProvider = class {
 	pollIntervalMs;
 	maxWaitMs;
 	constructor(options) {
-		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$2;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$2;
 	}
 	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::Cluster", /* @__PURE__ */ new Set([
 		"AdditionalInfo",
@@ -35517,10 +35667,10 @@ var EMRClusterProvider = class {
 				CustomAmiId: properties["CustomAmiId"],
 				OSReleaseLabel: properties["OSReleaseLabel"],
 				SecurityConfiguration: properties["SecurityConfiguration"],
-				EbsRootVolumeSize: toNumber(properties["EbsRootVolumeSize"]),
-				EbsRootVolumeIops: toNumber(properties["EbsRootVolumeIops"]),
-				EbsRootVolumeThroughput: toNumber(properties["EbsRootVolumeThroughput"]),
-				StepConcurrencyLevel: toNumber(properties["StepConcurrencyLevel"]),
+				EbsRootVolumeSize: toNumber$2(properties["EbsRootVolumeSize"]),
+				EbsRootVolumeIops: toNumber$2(properties["EbsRootVolumeIops"]),
+				EbsRootVolumeThroughput: toNumber$2(properties["EbsRootVolumeThroughput"]),
+				StepConcurrencyLevel: toNumber$2(properties["StepConcurrencyLevel"]),
 				VisibleToAllUsers: toBoolean(properties["VisibleToAllUsers"]),
 				Applications: properties["Applications"],
 				Configurations: properties["Configurations"],
@@ -35609,7 +35759,7 @@ var EMRClusterProvider = class {
 		return {
 			InstanceRole: role,
 			InstanceType: raw["InstanceType"],
-			InstanceCount: toNumber(raw["InstanceCount"]),
+			InstanceCount: toNumber$2(raw["InstanceCount"]),
 			Name: raw["Name"],
 			Market: raw["Market"],
 			BidPrice: raw["BidPrice"],
@@ -35623,8 +35773,8 @@ var EMRClusterProvider = class {
 		return {
 			InstanceFleetType: type,
 			Name: raw["Name"],
-			TargetOnDemandCapacity: toNumber(raw["TargetOnDemandCapacity"]),
-			TargetSpotCapacity: toNumber(raw["TargetSpotCapacity"]),
+			TargetOnDemandCapacity: toNumber$2(raw["TargetOnDemandCapacity"]),
+			TargetSpotCapacity: toNumber$2(raw["TargetSpotCapacity"]),
 			InstanceTypeConfigs: raw["InstanceTypeConfigs"],
 			LaunchSpecifications: raw["LaunchSpecifications"],
 			ResizeSpecifications: raw["ResizeSpecifications"]
@@ -35637,28 +35787,28 @@ var EMRClusterProvider = class {
 		return {
 			ComputeLimits: {
 				UnitType: limits["UnitType"],
-				MinimumCapacityUnits: toNumber(limits["MinimumCapacityUnits"]),
-				MaximumCapacityUnits: toNumber(limits["MaximumCapacityUnits"]),
-				MaximumOnDemandCapacityUnits: toNumber(limits["MaximumOnDemandCapacityUnits"]),
-				MaximumCoreCapacityUnits: toNumber(limits["MaximumCoreCapacityUnits"])
+				MinimumCapacityUnits: toNumber$2(limits["MinimumCapacityUnits"]),
+				MaximumCapacityUnits: toNumber$2(limits["MaximumCapacityUnits"]),
+				MaximumOnDemandCapacityUnits: toNumber$2(limits["MaximumOnDemandCapacityUnits"]),
+				MaximumCoreCapacityUnits: toNumber$2(limits["MaximumCoreCapacityUnits"])
 			},
-			UtilizationPerformanceIndex: toNumber(config["UtilizationPerformanceIndex"]),
+			UtilizationPerformanceIndex: toNumber$2(config["UtilizationPerformanceIndex"]),
 			ScalingStrategy: config["ScalingStrategy"]
 		};
 	}
 	toAutoTerminationPolicy(config) {
 		if (!config) return void 0;
-		return { IdleTimeout: toNumber(config["IdleTimeout"]) };
+		return { IdleTimeout: toNumber$2(config["IdleTimeout"]) };
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
-		const changed = (key) => !jsonEqual(properties[key], previousProperties[key]);
+		const changed = (key) => !jsonEqual$2(properties[key], previousProperties[key]);
 		const nextInstances = properties["Instances"] ?? {};
 		const prevInstances = previousProperties["Instances"] ?? {};
 		let terminationProtectedChanged = false;
 		if (changed("Instances")) {
 			const instanceKeys = /* @__PURE__ */ new Set([...Object.keys(nextInstances), ...Object.keys(prevInstances)]);
 			for (const key of instanceKeys) {
-				if (jsonEqual(nextInstances[key], prevInstances[key])) continue;
+				if (jsonEqual$2(nextInstances[key], prevInstances[key])) continue;
 				if (key === "TerminationProtected") {
 					terminationProtectedChanged = true;
 					continue;
@@ -35698,7 +35848,7 @@ var EMRClusterProvider = class {
 			}));
 			if (stepConcurrencyChanged) await this.getClient().send(new ModifyClusterCommand({
 				ClusterId: physicalId,
-				StepConcurrencyLevel: toNumber(properties["StepConcurrencyLevel"])
+				StepConcurrencyLevel: toNumber$2(properties["StepConcurrencyLevel"])
 			}));
 			if (managedScalingChanged) {
 				const next = this.toManagedScalingPolicy(properties["ManagedScalingPolicy"]);
@@ -36150,6 +36300,570 @@ var EMRClusterProvider = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/providers/emr-instance-group-config-provider.ts
+/**
+* Default polling budget for an instance group reaching RUNNING. Adding a
+* group to an already-WAITING cluster provisions + bootstraps its EC2
+* instances (typically 2-6 minutes); a resize settles faster. Reuse the
+* EMR Cluster provider's 1-hour ceiling so the slowest realistic add still
+* fits inside the per-resource deadline.
+*/
+const DEFAULT_MAX_WAIT_MS$1 = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS$1 = 15e3;
+/** Instance-group state that means "the group is up and idle/serving". */
+const READY_STATES$1 = /* @__PURE__ */ new Set(["RUNNING"]);
+/**
+* Instance-group states that mean "the group is gone / failed" — a hard
+* error during a create/resize wait (an ARRESTED group failed to provision;
+* TERMINATED/ENDED mean it will never reach RUNNING).
+*/
+const FAILED_STATES$1 = /* @__PURE__ */ new Set([
+	"ARRESTED",
+	"TERMINATED",
+	"ENDED"
+]);
+const toNumber$1 = (v) => {
+	if (v === void 0) return void 0;
+	const n = Number(v);
+	return Number.isNaN(n) ? void 0 : n;
+};
+const jsonEqual$1 = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+/**
+* SDK Provider for `AWS::EMR::InstanceGroupConfig` (issue #1070).
+*
+* This type adds a standalone instance group (MASTER / CORE / TASK) to an
+* EXISTING EMR cluster (referenced by `JobFlowId`), rather than declaring the
+* group inline in `AWS::EMR::Cluster.Instances`. It is
+* `ProvisioningType: NON_PROVISIONABLE` in the CFn registry, so Cloud Control
+* cannot handle it — pre-flight would otherwise reject it via
+* `unsupported-types.generated.ts`.
+*
+* Lifecycle:
+*  - `create` → `AddInstanceGroups` (one group per call) + poll
+*    `ListInstanceGroups` until the new group is `RUNNING`. A failed terminal
+*    (`ARRESTED` / `TERMINATED` / `ENDED`) during the wait is a hard error.
+*  - `update` → only the two AWS-mutable properties: `InstanceCount`
+*    (`ModifyInstanceGroups`, resize; polled until settled) and
+*    `AutoScalingPolicy` (`PutAutoScalingPolicy` / `RemoveAutoScalingPolicy`).
+*    Every other property is registry-createOnly → routed through
+*    DELETE+CREATE by the replacement-detection layer; a createOnly change
+*    that reaches `update()` anyway is refused with a `--replace` pointer.
+*  - `delete` → **no standalone AWS API exists.** EMR cannot remove an
+*    instance group from a running cluster; a group's only lifecycle end is
+*    cluster termination. In the normal `cdkd destroy` the parent
+*    `AWS::EMR::Cluster` is terminated in the same run (its `TerminateJobFlows`
+*    releases every group + its EC2 instances), so this delete is a no-op that
+*    just drops cdkd state — leaving ZERO orphans. As a best effort for the
+*    less common "delete only the group, keep the cluster" case, a TASK group
+*    is scaled to 0 instances (`ModifyInstanceGroups InstanceCount: 0`) to
+*    release its instances; MASTER/CORE groups cannot be scaled to 0 and are a
+*    pure no-op. Never blocks the destroy (warn-and-continue).
+*
+* `getMinResourceTimeoutMs()` lifts the deploy engine's per-resource deadline
+* to the polling ceiling (mirrors `EMRClusterProvider`) so a slow add/resize
+* does not require `--resource-timeout`.
+*/
+var EMRInstanceGroupConfigProvider = class {
+	/**
+	* Cloud Control has NO handlers for this type
+	* (`ProvisioningType: NON_PROVISIONABLE`), so the deploy engine's #614
+	* silent-drop auto-route MUST NOT send an unhandled-property template to CC
+	* — it would fail at provisioning time with an opaque
+	* UnsupportedActionException. With this opt-out the ProviderRegistry rejects
+	* such templates pre-flight with a clear error instead.
+	*/
+	disableCcApiFallback = true;
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("EMRInstanceGroupConfigProvider");
+	pollIntervalMs;
+	maxWaitMs;
+	constructor(options) {
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS$1;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS$1;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::InstanceGroupConfig", /* @__PURE__ */ new Set([
+		"AutoScalingPolicy",
+		"BidPrice",
+		"Configurations",
+		"CustomAmiId",
+		"EbsConfiguration",
+		"InstanceCount",
+		"InstanceRole",
+		"InstanceType",
+		"JobFlowId",
+		"Market",
+		"Name"
+	])]]);
+	getClient() {
+		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	getMinResourceTimeoutMs() {
+		return this.maxWaitMs + this.pollIntervalMs;
+	}
+	async create(logicalId, resourceType, properties) {
+		if (resourceType !== "AWS::EMR::InstanceGroupConfig") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		const jobFlowId = properties["JobFlowId"];
+		if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} is missing JobFlowId (the parent cluster id)`, resourceType, logicalId);
+		this.logger.debug(`Adding EMR instance group ${logicalId} to cluster ${jobFlowId}`);
+		try {
+			const group = this.toInstanceGroupConfig(properties);
+			const groupId = (await this.getClient().send(new AddInstanceGroupsCommand({
+				JobFlowId: jobFlowId,
+				InstanceGroups: [group]
+			}))).InstanceGroupIds?.[0];
+			if (!groupId) throw new ProvisioningError(`EMR AddInstanceGroups for ${logicalId} returned no instance group id`, resourceType, logicalId);
+			await this.waitForGroupReady(jobFlowId, groupId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
+			this.logger.debug(`Successfully added EMR instance group ${logicalId}: ${groupId}`);
+			return {
+				physicalId: groupId,
+				attributes: { Id: groupId }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	toInstanceGroupConfig(properties) {
+		return {
+			InstanceRole: properties["InstanceRole"],
+			InstanceType: properties["InstanceType"],
+			InstanceCount: toNumber$1(properties["InstanceCount"]),
+			Name: properties["Name"],
+			Market: properties["Market"],
+			BidPrice: properties["BidPrice"],
+			Configurations: properties["Configurations"],
+			EbsConfiguration: properties["EbsConfiguration"],
+			AutoScalingPolicy: properties["AutoScalingPolicy"],
+			CustomAmiId: properties["CustomAmiId"]
+		};
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		const changed = (key) => !jsonEqual$1(properties[key], previousProperties[key]);
+		const MUTABLE = /* @__PURE__ */ new Set(["InstanceCount", "AutoScalingPolicy"]);
+		for (const key of Object.keys({
+			...properties,
+			...previousProperties
+		})) {
+			if (!changed(key)) continue;
+			if (!MUTABLE.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR InstanceGroupConfig ${key} is immutable on AWS — it is fixed when the instance group is created. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+		}
+		const instanceCountChanged = changed("InstanceCount");
+		const autoScalingChanged = changed("AutoScalingPolicy");
+		if (!instanceCountChanged && !autoScalingChanged) {
+			this.logger.debug(`No mutable diff for EMR instance group ${logicalId}, skipping update`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		}
+		const jobFlowId = properties["JobFlowId"];
+		this.logger.debug(`Updating EMR instance group ${logicalId}: ${physicalId}`);
+		try {
+			if (instanceCountChanged) {
+				await this.getClient().send(new ModifyInstanceGroupsCommand({
+					...jobFlowId && { ClusterId: jobFlowId },
+					InstanceGroups: [{
+						InstanceGroupId: physicalId,
+						InstanceCount: toNumber$1(properties["InstanceCount"])
+					}]
+				}));
+				if (jobFlowId) await this.waitForGroupReady(jobFlowId, physicalId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
+			}
+			if (autoScalingChanged) {
+				if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} AutoScalingPolicy update needs JobFlowId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
+				const policy = properties["AutoScalingPolicy"];
+				if (policy) await this.getClient().send(new PutAutoScalingPolicyCommand({
+					ClusterId: jobFlowId,
+					InstanceGroupId: physicalId,
+					AutoScalingPolicy: policy
+				}));
+				else await this.getClient().send(new RemoveAutoScalingPolicyCommand({
+					ClusterId: jobFlowId,
+					InstanceGroupId: physicalId
+				}));
+			}
+			this.logger.debug(`Successfully updated EMR instance group ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: { Id: physicalId }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		const role = properties?.["InstanceRole"];
+		const jobFlowId = properties?.["JobFlowId"];
+		if (role === "TASK" && jobFlowId) {
+			try {
+				await this.getClient().send(new ModifyInstanceGroupsCommand({
+					ClusterId: jobFlowId,
+					InstanceGroups: [{
+						InstanceGroupId: physicalId,
+						InstanceCount: 0
+					}]
+				}));
+				this.logger.debug(`Scaled EMR TASK instance group ${physicalId} to 0 to release its instances (no standalone delete API exists)`);
+			} catch (error) {
+				if (error instanceof InvalidRequestException) {
+					assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(`EMR instance group ${physicalId} scale-to-0 skipped (cluster/group gone): ${error.message}`);
+				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance group ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
+			}
+			return;
+		}
+		this.logger.debug(`EMR instance group ${physicalId} (role ${role ?? "unknown"}) has no standalone delete API; its instances are released when the parent cluster terminates. Removing cdkd state only.`);
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "Id") return physicalId;
+	}
+	/**
+	* Poll until the group is `RUNNING` AND its `RunningInstanceCount` equals
+	* `expectedCount`. The count check is load-bearing on a resize: right after
+	* `ModifyInstanceGroups` the group is still in the PRE-resize `RUNNING`
+	* state (EMR has not flipped it to `RESIZING` yet), so a State-only wait
+	* would return before the resize even starts. Waiting on the running count
+	* reaching the requested target settles both create (0 -> N provisioning)
+	* and resize (M -> N add/remove) correctly.
+	*/
+	async waitForGroupReady(clusterId, groupId, logicalId, resourceType, expectedCount) {
+		const startTime = Date.now();
+		const transientState = { count: 0 };
+		while (Date.now() - startTime < this.maxWaitMs) {
+			const group = await this.findGroupForPoll(clusterId, groupId, transientState);
+			const state = group?.Status?.State;
+			if (state && READY_STATES$1.has(state) && group?.RunningInstanceCount === expectedCount) return;
+			if (state && FAILED_STATES$1.has(state)) throw new ProvisioningError(`EMR instance group ${groupId} entered failed state ${state}: ${group?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, groupId);
+			this.logger.debug(`EMR instance group ${groupId} state: ${state ?? "unknown"}, running ${group?.RunningInstanceCount ?? "?"}/${expectedCount}, waiting...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(`Timed out waiting for EMR instance group ${groupId} to reach RUNNING with ${expectedCount} instance(s) (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, groupId);
+	}
+	/**
+	* `ListInstanceGroups` (paginated) for the cluster, returning the single
+	* group whose `Id` matches. Absorbs up to `maxConsecutiveTransient`
+	* consecutive transient errors (throttle / 5xx / reset) so a single blip
+	* during a 10-minute poll does not spuriously fail the create.
+	*/
+	async findGroupForPoll(clusterId, groupId, transientState, maxConsecutiveTransient = 5) {
+		try {
+			let marker;
+			do {
+				const resp = await this.getClient().send(new ListInstanceGroupsCommand({
+					ClusterId: clusterId,
+					...marker && { Marker: marker }
+				}));
+				const found = (resp.InstanceGroups ?? []).find((g) => g.Id === groupId);
+				if (found) {
+					transientState.count = 0;
+					return found;
+				}
+				marker = resp.Marker;
+			} while (marker);
+			transientState.count = 0;
+			return;
+		} catch (error) {
+			const name = error instanceof Error ? error.name : "";
+			const msg = error instanceof Error ? error.message : String(error);
+			if ((name === "ThrottlingException" || name === "InternalServerException" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|throttl|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
+				transientState.count += 1;
+				this.logger.debug(`Transient ListInstanceGroups error while polling ${groupId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
+				return;
+			}
+			throw error;
+		}
+	}
+};
+
+//#endregion
+//#region src/provisioning/providers/emr-instance-fleet-config-provider.ts
+/**
+* Default polling budget for an instance fleet reaching RUNNING. Adding a
+* fleet to an already-WAITING cluster provisions + bootstraps its EC2
+* instances (typically 2-6 minutes); a resize settles faster. Reuse the
+* EMR Cluster provider's 1-hour ceiling so the slowest realistic add still
+* fits inside the per-resource deadline.
+*/
+const DEFAULT_MAX_WAIT_MS = 3600 * 1e3;
+const DEFAULT_POLL_INTERVAL_MS = 15e3;
+/** Instance-fleet state that means "the fleet is up and idle/serving". */
+const READY_STATES = /* @__PURE__ */ new Set(["RUNNING"]);
+/**
+* Instance-fleet states that mean "the fleet is gone" — a hard error during a
+* create/resize wait (it will never reach RUNNING).
+*/
+const FAILED_STATES = /* @__PURE__ */ new Set(["TERMINATED"]);
+const toNumber = (v) => {
+	if (v === void 0) return void 0;
+	const n = Number(v);
+	return Number.isNaN(n) ? void 0 : n;
+};
+const jsonEqual = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+/**
+* SDK Provider for `AWS::EMR::InstanceFleetConfig` (issue #1070).
+*
+* This type adds a standalone instance fleet (MASTER / CORE / TASK) to an
+* EXISTING EMR cluster (referenced by `ClusterId`), rather than declaring the
+* fleet inline in `AWS::EMR::Cluster.Instances`. It is
+* `ProvisioningType: NON_PROVISIONABLE` in the CFn registry, so Cloud Control
+* cannot handle it — pre-flight would otherwise reject it via
+* `unsupported-types.generated.ts`.
+*
+* Lifecycle:
+*  - `create` → `AddInstanceFleet` + poll `ListInstanceFleets` until the new
+*    fleet is `RUNNING`. A `TERMINATED` terminal during the wait is a hard
+*    error.
+*  - `update` → only the AWS-mutable properties: `TargetOnDemandCapacity`,
+*    `TargetSpotCapacity`, `ResizeSpecifications`, and `InstanceTypeConfigs`
+*    (all via `ModifyInstanceFleet`; the resize is polled until settled).
+*    `Name` / `LaunchSpecifications` / `InstanceFleetType` are
+*    registry-createOnly → routed through DELETE+CREATE by the
+*    replacement-detection layer; a createOnly change that reaches `update()`
+*    anyway is refused with a `--replace` pointer.
+*  - `delete` → **no standalone AWS API exists.** EMR cannot remove an
+*    instance fleet from a running cluster; a fleet's only lifecycle end is
+*    cluster termination. In the normal `cdkd destroy` the parent
+*    `AWS::EMR::Cluster` is terminated in the same run (its `TerminateJobFlows`
+*    releases every fleet + its EC2 instances), so this delete is a no-op that
+*    just drops cdkd state — leaving ZERO orphans. As a best effort for the
+*    less common "delete only the fleet, keep the cluster" case, a TASK fleet
+*    is scaled to 0 target capacity (`ModifyInstanceFleet`) to release its
+*    instances; MASTER/CORE fleets cannot be scaled to 0 and are a pure no-op.
+*    Never blocks the destroy (warn-and-continue).
+*
+* `getMinResourceTimeoutMs()` lifts the deploy engine's per-resource deadline
+* to the polling ceiling (mirrors `EMRClusterProvider`) so a slow add/resize
+* does not require `--resource-timeout`.
+*/
+var EMRInstanceFleetConfigProvider = class {
+	/**
+	* Cloud Control has NO handlers for this type
+	* (`ProvisioningType: NON_PROVISIONABLE`), so the deploy engine's #614
+	* silent-drop auto-route MUST NOT send an unhandled-property template to CC
+	* — it would fail at provisioning time with an opaque
+	* UnsupportedActionException. With this opt-out the ProviderRegistry rejects
+	* such templates pre-flight with a clear error instead.
+	*/
+	disableCcApiFallback = true;
+	client;
+	providerRegion = process.env["AWS_REGION"];
+	logger = getLogger().child("EMRInstanceFleetConfigProvider");
+	pollIntervalMs;
+	maxWaitMs;
+	constructor(options) {
+		this.pollIntervalMs = options?.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
+		this.maxWaitMs = options?.maxWaitMs ?? DEFAULT_MAX_WAIT_MS;
+	}
+	handledProperties = /* @__PURE__ */ new Map([["AWS::EMR::InstanceFleetConfig", /* @__PURE__ */ new Set([
+		"ClusterId",
+		"InstanceFleetType",
+		"InstanceTypeConfigs",
+		"LaunchSpecifications",
+		"Name",
+		"ResizeSpecifications",
+		"TargetOnDemandCapacity",
+		"TargetSpotCapacity"
+	])]]);
+	getClient() {
+		if (!this.client) this.client = new EMRClient(this.providerRegion ? { region: this.providerRegion } : {});
+		return this.client;
+	}
+	getMinResourceTimeoutMs() {
+		return this.maxWaitMs + this.pollIntervalMs;
+	}
+	async create(logicalId, resourceType, properties) {
+		if (resourceType !== "AWS::EMR::InstanceFleetConfig") throw new ProvisioningError(`Unsupported resource type: ${resourceType}`, resourceType, logicalId);
+		const clusterId = properties["ClusterId"];
+		if (!clusterId) throw new ProvisioningError(`EMR InstanceFleetConfig ${logicalId} is missing ClusterId (the parent cluster id)`, resourceType, logicalId);
+		this.logger.debug(`Adding EMR instance fleet ${logicalId} to cluster ${clusterId}`);
+		try {
+			const fleet = this.toInstanceFleetConfig(properties);
+			const fleetId = (await this.getClient().send(new AddInstanceFleetCommand({
+				ClusterId: clusterId,
+				InstanceFleet: fleet
+			}))).InstanceFleetId;
+			if (!fleetId) throw new ProvisioningError(`EMR AddInstanceFleet for ${logicalId} returned no instance fleet id`, resourceType, logicalId);
+			await this.waitForFleetReady(clusterId, fleetId, logicalId, resourceType, this.targetCapacity(properties), true);
+			this.logger.debug(`Successfully added EMR instance fleet ${logicalId}: ${fleetId}`);
+			return {
+				physicalId: fleetId,
+				attributes: { Id: fleetId }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+		}
+	}
+	toInstanceFleetConfig(properties) {
+		return {
+			InstanceFleetType: properties["InstanceFleetType"],
+			Name: properties["Name"],
+			TargetOnDemandCapacity: toNumber(properties["TargetOnDemandCapacity"]),
+			TargetSpotCapacity: toNumber(properties["TargetSpotCapacity"]),
+			InstanceTypeConfigs: properties["InstanceTypeConfigs"],
+			LaunchSpecifications: properties["LaunchSpecifications"],
+			ResizeSpecifications: properties["ResizeSpecifications"]
+		};
+	}
+	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
+		const changed = (key) => !jsonEqual(properties[key], previousProperties[key]);
+		const MUTABLE = /* @__PURE__ */ new Set([
+			"TargetOnDemandCapacity",
+			"TargetSpotCapacity",
+			"ResizeSpecifications",
+			"InstanceTypeConfigs"
+		]);
+		for (const key of Object.keys({
+			...properties,
+			...previousProperties
+		})) {
+			if (!changed(key)) continue;
+			if (!MUTABLE.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS EMR InstanceFleetConfig ${key} is immutable on AWS — it is fixed when the instance fleet is created. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
+		}
+		if (![...MUTABLE].some((k) => changed(k))) {
+			this.logger.debug(`No mutable diff for EMR instance fleet ${logicalId}, skipping update`);
+			return {
+				physicalId,
+				wasReplaced: false
+			};
+		}
+		const clusterId = properties["ClusterId"];
+		if (!clusterId) throw new ProvisioningError(`EMR InstanceFleetConfig ${logicalId} update needs ClusterId (the cluster id), which is absent`, resourceType, logicalId, physicalId);
+		this.logger.debug(`Updating EMR instance fleet ${logicalId}: ${physicalId}`);
+		try {
+			const modify = {
+				InstanceFleetId: physicalId,
+				TargetOnDemandCapacity: toNumber(properties["TargetOnDemandCapacity"]),
+				TargetSpotCapacity: toNumber(properties["TargetSpotCapacity"]),
+				ResizeSpecifications: properties["ResizeSpecifications"],
+				InstanceTypeConfigs: properties["InstanceTypeConfigs"]
+			};
+			await this.getClient().send(new ModifyInstanceFleetCommand({
+				ClusterId: clusterId,
+				InstanceFleet: modify
+			}));
+			const newTarget = this.targetCapacity(properties);
+			const prevTarget = this.targetCapacity(previousProperties);
+			await this.waitForFleetReady(clusterId, physicalId, logicalId, resourceType, newTarget, newTarget >= prevTarget);
+			this.logger.debug(`Successfully updated EMR instance fleet ${logicalId}`);
+			return {
+				physicalId,
+				wasReplaced: false,
+				attributes: { Id: physicalId }
+			};
+		} catch (error) {
+			if (error instanceof ProvisioningError || error instanceof ResourceUpdateNotSupportedError) throw error;
+			const cause = error instanceof Error ? error : void 0;
+			throw new ProvisioningError(`Failed to update EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
+		}
+	}
+	async delete(logicalId, physicalId, resourceType, properties, context) {
+		const fleetType = properties?.["InstanceFleetType"];
+		const clusterId = properties?.["ClusterId"];
+		if (fleetType === "TASK" && clusterId) {
+			try {
+				await this.getClient().send(new ModifyInstanceFleetCommand({
+					ClusterId: clusterId,
+					InstanceFleet: {
+						InstanceFleetId: physicalId,
+						TargetOnDemandCapacity: 0,
+						TargetSpotCapacity: 0
+					}
+				}));
+				this.logger.debug(`Scaled EMR TASK instance fleet ${physicalId} to 0 to release its instances (no standalone delete API exists)`);
+			} catch (error) {
+				if (error instanceof InvalidRequestException) {
+					assertRegionMatch(await this.getClient().config.region(), context?.expectedRegion, resourceType, logicalId, physicalId);
+					this.logger.debug(`EMR instance fleet ${physicalId} scale-to-0 skipped (cluster/fleet gone): ${error.message}`);
+				} else this.logger.warn(`Best-effort scale-to-0 of EMR instance fleet ${physicalId} failed: ${error instanceof Error ? error.message : String(error)} — its instances are released when the parent cluster terminates`);
+			}
+			return;
+		}
+		this.logger.debug(`EMR instance fleet ${physicalId} (type ${fleetType ?? "unknown"}) has no standalone delete API; its instances are released when the parent cluster terminates. Removing cdkd state only.`);
+	}
+	async getAttribute(physicalId, _resourceType, attributeName) {
+		if (attributeName === "Id") return physicalId;
+	}
+	/** Total target capacity (On-Demand + Spot) requested for the fleet. */
+	targetCapacity(properties) {
+		return (toNumber(properties["TargetOnDemandCapacity"]) ?? 0) + (toNumber(properties["TargetSpotCapacity"]) ?? 0);
+	}
+	/**
+	* Poll until the fleet is `RUNNING` AND its provisioned capacity
+	* (On-Demand + Spot) has settled at `targetCapacity`. The capacity check is
+	* load-bearing on a resize: right after `ModifyInstanceFleet` the fleet is
+	* still in the PRE-resize `RUNNING` state, so a State-only wait would return
+	* before the resize even starts.
+	*
+	* `atLeast` selects the settle direction:
+	*  - `true` (create / scale-UP): ready when `provisioned >= targetCapacity`
+	*    (`>=`, not `==`, because a weighted-capacity allocation may overshoot).
+	*  - `false` (scale-DOWN): ready when `provisioned <= targetCapacity` — the
+	*    stale pre-resize provisioned capacity is ABOVE the new lower target, so
+	*    an `>=` check would return instantly before instances drain.
+	*
+	* A `targetCapacity` of 0 on the up path (never valid for a real create —
+	* at least one target must be > 0) degrades to a State-only wait.
+	*/
+	async waitForFleetReady(clusterId, fleetId, logicalId, resourceType, targetCapacity, atLeast) {
+		const startTime = Date.now();
+		const transientState = { count: 0 };
+		while (Date.now() - startTime < this.maxWaitMs) {
+			const fleet = await this.findFleetForPoll(clusterId, fleetId, transientState);
+			const state = fleet?.Status?.State;
+			const provisioned = (fleet?.ProvisionedOnDemandCapacity ?? 0) + (fleet?.ProvisionedSpotCapacity ?? 0);
+			const capacityReady = atLeast ? provisioned >= targetCapacity : provisioned <= targetCapacity;
+			if (state && READY_STATES.has(state) && capacityReady) return;
+			if (state && FAILED_STATES.has(state)) throw new ProvisioningError(`EMR instance fleet ${fleetId} entered failed state ${state}: ${fleet?.Status?.StateChangeReason?.Message ?? "no state-change reason reported"}`, resourceType, logicalId, fleetId);
+			this.logger.debug(`EMR instance fleet ${fleetId} state: ${state ?? "unknown"}, provisioned ${provisioned}/${targetCapacity}, waiting...`);
+			await new Promise((resolve) => setTimeout(resolve, this.pollIntervalMs));
+		}
+		throw new ProvisioningError(`Timed out waiting for EMR instance fleet ${fleetId} to reach RUNNING with capacity ${targetCapacity} (${Math.round(this.maxWaitMs / 6e4)} min)`, resourceType, logicalId, fleetId);
+	}
+	/**
+	* `ListInstanceFleets` (paginated) for the cluster, returning the single
+	* fleet whose `Id` matches. Absorbs up to `maxConsecutiveTransient`
+	* consecutive transient errors (throttle / 5xx / reset) so a single blip
+	* during a 10-minute poll does not spuriously fail the create.
+	*/
+	async findFleetForPoll(clusterId, fleetId, transientState, maxConsecutiveTransient = 5) {
+		try {
+			let marker;
+			do {
+				const resp = await this.getClient().send(new ListInstanceFleetsCommand({
+					ClusterId: clusterId,
+					...marker && { Marker: marker }
+				}));
+				const found = (resp.InstanceFleets ?? []).find((f) => f.Id === fleetId);
+				if (found) {
+					transientState.count = 0;
+					return found;
+				}
+				marker = resp.Marker;
+			} while (marker);
+			transientState.count = 0;
+			return;
+		} catch (error) {
+			const name = error instanceof Error ? error.name : "";
+			const msg = error instanceof Error ? error.message : String(error);
+			if ((name === "ThrottlingException" || name === "InternalServerException" || name === "InternalServerError" || name === "TimeoutError" || /rate exceeded|too many requests|throttl|timed? ?out|ECONNRESET|EPIPE|socket hang up/i.test(msg)) && transientState.count < maxConsecutiveTransient) {
+				transientState.count += 1;
+				this.logger.debug(`Transient ListInstanceFleets error while polling ${fleetId} (${transientState.count}/${maxConsecutiveTransient}): ${msg} — retrying`);
+				return;
+			}
+			throw error;
+		}
+	}
+};
+
 //#endregion
 //#region src/provisioning/providers/firehose-provider.ts
 /**
@@ -41762,6 +42476,8 @@ function registerAllProviders(registry) {
 	registry.register("AWS::EFS::AccessPoint", efsProvider);
 	registry.register("AWS::FSx::FileSystem", new FSxFileSystemProvider());
 	registry.register("AWS::EMR::Cluster", new EMRClusterProvider());
+	registry.register("AWS::EMR::InstanceGroupConfig", new EMRInstanceGroupConfigProvider());
+	registry.register("AWS::EMR::InstanceFleetConfig", new EMRInstanceFleetConfigProvider());
 	registry.register("AWS::KinesisFirehose::DeliveryStream", new FirehoseProvider());
 	registry.register("AWS::CloudTrail::Trail", new CloudTrailProvider());
 	registry.register("AWS::CodeBuild::Project", new CodeBuildProvider());
@@ -61042,7 +61758,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.249.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.251.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());