@friggframework/devtools 2.0.0--canary.474.6a0bba7.0 → 2.0.0--canary.474.ca45ad3.0

package/infrastructure/domains/health/domain/services/property-mutability-config.js

@@ -0,0 +1,382 @@
+/**
+ * Property Mutability Configuration
+ *
+ * Defines which CloudFormation resource properties are immutable (require replacement),
+ * mutable (can be updated), or conditional (depends on other properties).
+ *
+ * Based on AWS CloudFormation documentation "Update requires" behavior:
+ * - IMMUTABLE: "Replacement" - Cannot be changed without replacing the resource
+ * - MUTABLE: "No interruption" or "Some interruptions" - Can be updated in place
+ * - CONDITIONAL: Depends on other property values or specific conditions
+ *
+ * References:
+ * - AWS CloudFormation Template Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/
+ * - Each resource type has "Update requires" documentation for each property
+ */
+
+const PropertyMutability = require('../value-objects/property-mutability');
+
+/**
+ * Property mutability configuration by resource type
+ *
+ * Key: CloudFormation resource type (e.g., 'AWS::Lambda::Function')
+ * Value: Object mapping property paths to PropertyMutability instances
+ *
+ * Property paths match AWS drift detection format (without 'Properties.' prefix):
+ * - Simple: 'BucketName'
+ * - Nested: 'VpcConfig.SubnetIds'
+ */
+const PROPERTY_MUTABILITY_CONFIG = {
+    //
+    // AWS::EC2::* Resources
+    //
+
+    'AWS::EC2::VPC': {
+        // Immutable properties
+        'CidrBlock': PropertyMutability.IMMUTABLE, // Replacement required
+        'InstanceTenancy': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'EnableDnsSupport': PropertyMutability.MUTABLE, // No interruption
+        'EnableDnsHostnames': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    'AWS::EC2::Subnet': {
+        // Immutable properties
+        'VpcId': PropertyMutability.IMMUTABLE, // Replacement required
+        'CidrBlock': PropertyMutability.IMMUTABLE, // Replacement required
+        'AvailabilityZone': PropertyMutability.IMMUTABLE, // Replacement required
+        'AvailabilityZoneId': PropertyMutability.IMMUTABLE, // Replacement required
+        'Ipv4IpamPoolId': PropertyMutability.IMMUTABLE, // Replacement required
+        'Ipv4NetmaskLength': PropertyMutability.IMMUTABLE, // Replacement required
+        'Ipv6IpamPoolId': PropertyMutability.IMMUTABLE, // Replacement required
+        'Ipv6Native': PropertyMutability.IMMUTABLE, // Replacement required
+        'Ipv6NetmaskLength': PropertyMutability.IMMUTABLE, // Replacement required
+        'OutpostArn': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'AssignIpv6AddressOnCreation': PropertyMutability.MUTABLE, // No interruption
+        'EnableDns64': PropertyMutability.MUTABLE, // No interruption
+        'EnableLniAtDeviceIndex': PropertyMutability.MUTABLE, // No interruption
+        'Ipv6CidrBlock': PropertyMutability.MUTABLE, // Some interruptions
+        'MapPublicIpOnLaunch': PropertyMutability.MUTABLE, // No interruption
+        'PrivateDnsNameOptionsOnLaunch': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    'AWS::EC2::SecurityGroup': {
+        // Immutable properties
+        'VpcId': PropertyMutability.IMMUTABLE, // Replacement required
+        'GroupName': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'GroupDescription': PropertyMutability.MUTABLE, // No interruption
+        'SecurityGroupIngress': PropertyMutability.MUTABLE, // No interruption
+        'SecurityGroupEgress': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    'AWS::EC2::RouteTable': {
+        // Immutable properties
+        'VpcId': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    'AWS::EC2::Instance': {
+        // Immutable properties
+        'ImageId': PropertyMutability.IMMUTABLE, // Replacement required
+        'InstanceType': PropertyMutability.IMMUTABLE, // Replacement required
+        'KeyName': PropertyMutability.IMMUTABLE, // Replacement required
+        'AvailabilityZone': PropertyMutability.IMMUTABLE, // Replacement required
+        'PlacementGroupName': PropertyMutability.IMMUTABLE, // Replacement required
+        'PrivateIpAddress': PropertyMutability.IMMUTABLE, // Replacement required
+        'SubnetId': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'SecurityGroupIds': PropertyMutability.MUTABLE, // No interruption (VPC instances)
+        'SecurityGroups': PropertyMutability.MUTABLE, // No interruption
+        'UserData': PropertyMutability.MUTABLE, // Some interruptions
+        'IamInstanceProfile': PropertyMutability.MUTABLE, // No interruption
+        'Monitoring': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+        'DisableApiTermination': PropertyMutability.MUTABLE, // No interruption
+        'EbsOptimized': PropertyMutability.MUTABLE, // Some interruptions
+    },
+
+    //
+    // AWS::Lambda::* Resources
+    //
+
+    'AWS::Lambda::Function': {
+        // Immutable properties
+        'FunctionName': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'Code': PropertyMutability.MUTABLE, // No interruption
+        'Runtime': PropertyMutability.MUTABLE, // No interruption
+        'Handler': PropertyMutability.MUTABLE, // No interruption
+        'Role': PropertyMutability.MUTABLE, // No interruption
+        'Description': PropertyMutability.MUTABLE, // No interruption
+        'Timeout': PropertyMutability.MUTABLE, // No interruption
+        'MemorySize': PropertyMutability.MUTABLE, // No interruption
+        'Environment': PropertyMutability.MUTABLE, // No interruption
+        'Environment.Variables': PropertyMutability.MUTABLE, // No interruption
+        'VpcConfig': PropertyMutability.MUTABLE, // No interruption
+        'VpcConfig.SubnetIds': PropertyMutability.MUTABLE, // No interruption
+        'VpcConfig.SecurityGroupIds': PropertyMutability.MUTABLE, // No interruption
+        'VpcConfig.Ipv6AllowedForDualStack': PropertyMutability.MUTABLE, // No interruption
+        'DeadLetterConfig': PropertyMutability.MUTABLE, // No interruption
+        'TracingConfig': PropertyMutability.MUTABLE, // No interruption
+        'KMSKeyArn': PropertyMutability.MUTABLE, // No interruption
+        'Layers': PropertyMutability.MUTABLE, // No interruption
+        'ReservedConcurrentExecutions': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+        'FileSystemConfigs': PropertyMutability.MUTABLE, // No interruption
+        'Architectures': PropertyMutability.MUTABLE, // No interruption
+        'EphemeralStorage': PropertyMutability.MUTABLE, // No interruption
+        'SnapStart': PropertyMutability.MUTABLE, // No interruption
+        'RuntimeManagementConfig': PropertyMutability.MUTABLE, // No interruption
+        'LoggingConfig': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    //
+    // AWS::RDS::* Resources
+    //
+
+    'AWS::RDS::DBInstance': {
+        // Immutable properties
+        'DBInstanceIdentifier': PropertyMutability.IMMUTABLE, // Replacement required
+        'Engine': PropertyMutability.IMMUTABLE, // Replacement required
+        'DBName': PropertyMutability.IMMUTABLE, // Replacement required (for some engines)
+        'AvailabilityZone': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'AllocatedStorage': PropertyMutability.MUTABLE, // No interruption
+        'DBInstanceClass': PropertyMutability.MUTABLE, // Some interruptions
+        'EngineVersion': PropertyMutability.MUTABLE, // Some interruptions
+        'MasterUsername': PropertyMutability.MUTABLE, // No interruption (can't actually change)
+        'MasterUserPassword': PropertyMutability.MUTABLE, // No interruption
+        'BackupRetentionPeriod': PropertyMutability.MUTABLE, // No interruption
+        'DBSecurityGroups': PropertyMutability.MUTABLE, // No interruption
+        'VPCSecurityGroups': PropertyMutability.MUTABLE, // No interruption
+        'MultiAZ': PropertyMutability.MUTABLE, // No interruption
+        'PubliclyAccessible': PropertyMutability.MUTABLE, // No interruption
+        'StorageEncrypted': PropertyMutability.MUTABLE, // Some interruptions
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    'AWS::RDS::DBCluster': {
+        // Immutable properties
+        'DBClusterIdentifier': PropertyMutability.IMMUTABLE, // Replacement required
+        'Engine': PropertyMutability.IMMUTABLE, // Replacement required
+        'DatabaseName': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'EngineVersion': PropertyMutability.MUTABLE, // No interruption
+        'MasterUsername': PropertyMutability.MUTABLE, // No interruption (can't actually change)
+        'MasterUserPassword': PropertyMutability.MUTABLE, // No interruption
+        'BackupRetentionPeriod': PropertyMutability.MUTABLE, // No interruption
+        'PreferredBackupWindow': PropertyMutability.MUTABLE, // No interruption
+        'PreferredMaintenanceWindow': PropertyMutability.MUTABLE, // No interruption
+        'VpcSecurityGroupIds': PropertyMutability.MUTABLE, // No interruption
+        'DBSubnetGroupName': PropertyMutability.MUTABLE, // Some interruptions
+        'StorageEncrypted': PropertyMutability.MUTABLE, // Some interruptions
+        'KmsKeyId': PropertyMutability.MUTABLE, // Some interruptions
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    //
+    // AWS::S3::* Resources
+    //
+
+    'AWS::S3::Bucket': {
+        // Immutable properties
+        'BucketName': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'AccelerateConfiguration': PropertyMutability.MUTABLE, // No interruption
+        'AccessControl': PropertyMutability.MUTABLE, // No interruption
+        'AnalyticsConfigurations': PropertyMutability.MUTABLE, // No interruption
+        'BucketEncryption': PropertyMutability.MUTABLE, // No interruption
+        'CorsConfiguration': PropertyMutability.MUTABLE, // No interruption
+        'IntelligentTieringConfigurations': PropertyMutability.MUTABLE, // No interruption
+        'InventoryConfigurations': PropertyMutability.MUTABLE, // No interruption
+        'LifecycleConfiguration': PropertyMutability.MUTABLE, // No interruption
+        'LoggingConfiguration': PropertyMutability.MUTABLE, // No interruption
+        'MetricsConfigurations': PropertyMutability.MUTABLE, // No interruption
+        'NotificationConfiguration': PropertyMutability.MUTABLE, // No interruption
+        'ObjectLockConfiguration': PropertyMutability.MUTABLE, // No interruption
+        'ObjectLockEnabled': PropertyMutability.MUTABLE, // No interruption
+        'OwnershipControls': PropertyMutability.MUTABLE, // No interruption
+        'PublicAccessBlockConfiguration': PropertyMutability.MUTABLE, // No interruption
+        'ReplicationConfiguration': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+        'VersioningConfiguration': PropertyMutability.MUTABLE, // No interruption
+        'WebsiteConfiguration': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    //
+    // AWS::KMS::* Resources
+    //
+
+    'AWS::KMS::Key': {
+        // All KMS key properties are mutable (updates don't require replacement)
+        'Description': PropertyMutability.MUTABLE, // No interruption
+        'Enabled': PropertyMutability.MUTABLE, // No interruption
+        'EnableKeyRotation': PropertyMutability.MUTABLE, // No interruption
+        'KeyPolicy': PropertyMutability.MUTABLE, // No interruption
+        'KeyUsage': PropertyMutability.MUTABLE, // No interruption
+        'MultiRegion': PropertyMutability.MUTABLE, // No interruption
+        'PendingWindowInDays': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    //
+    // AWS::DynamoDB::* Resources
+    //
+
+    'AWS::DynamoDB::Table': {
+        // Immutable properties
+        'TableName': PropertyMutability.IMMUTABLE, // Replacement required
+        'KeySchema': PropertyMutability.IMMUTABLE, // Replacement required
+        'AttributeDefinitions': PropertyMutability.CONDITIONAL, // Some changes require replacement
+
+        // Mutable properties
+        'BillingMode': PropertyMutability.MUTABLE, // No interruption
+        'ProvisionedThroughput': PropertyMutability.MUTABLE, // No interruption
+        'GlobalSecondaryIndexes': PropertyMutability.MUTABLE, // No interruption
+        'LocalSecondaryIndexes': PropertyMutability.IMMUTABLE, // Replacement required
+        'StreamSpecification': PropertyMutability.MUTABLE, // No interruption
+        'SSESpecification': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+        'TimeToLiveSpecification': PropertyMutability.MUTABLE, // No interruption
+        'PointInTimeRecoverySpecification': PropertyMutability.MUTABLE, // No interruption
+        'ContributorInsightsSpecification': PropertyMutability.MUTABLE, // No interruption
+        'KinesisStreamSpecification': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    //
+    // AWS::SQS::* Resources
+    //
+
+    'AWS::SQS::Queue': {
+        // Immutable properties
+        'QueueName': PropertyMutability.IMMUTABLE, // Replacement required
+        'FifoQueue': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'ContentBasedDeduplication': PropertyMutability.MUTABLE, // No interruption
+        'DeduplicationScope': PropertyMutability.MUTABLE, // No interruption
+        'DelaySeconds': PropertyMutability.MUTABLE, // No interruption
+        'FifoThroughputLimit': PropertyMutability.MUTABLE, // No interruption
+        'KmsMasterKeyId': PropertyMutability.MUTABLE, // No interruption
+        'KmsDataKeyReusePeriodSeconds': PropertyMutability.MUTABLE, // No interruption
+        'MaximumMessageSize': PropertyMutability.MUTABLE, // No interruption
+        'MessageRetentionPeriod': PropertyMutability.MUTABLE, // No interruption
+        'ReceiveMessageWaitTimeSeconds': PropertyMutability.MUTABLE, // No interruption
+        'RedrivePolicy': PropertyMutability.MUTABLE, // No interruption
+        'RedriveAllowPolicy': PropertyMutability.MUTABLE, // No interruption
+        'SqsManagedSseEnabled': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+        'VisibilityTimeout': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    //
+    // AWS::SNS::* Resources
+    //
+
+    'AWS::SNS::Topic': {
+        // Immutable properties
+        'TopicName': PropertyMutability.IMMUTABLE, // Replacement required
+        'FifoTopic': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'ContentBasedDeduplication': PropertyMutability.MUTABLE, // No interruption
+        'DataProtectionPolicy': PropertyMutability.MUTABLE, // No interruption
+        'DisplayName': PropertyMutability.MUTABLE, // No interruption
+        'KmsMasterKeyId': PropertyMutability.MUTABLE, // No interruption
+        'SignatureVersion': PropertyMutability.MUTABLE, // No interruption
+        'Subscription': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+        'TracingConfig': PropertyMutability.MUTABLE, // No interruption
+    },
+
+    //
+    // AWS::IAM::* Resources
+    //
+
+    'AWS::IAM::Role': {
+        // Immutable properties
+        'RoleName': PropertyMutability.IMMUTABLE, // Replacement required
+
+        // Mutable properties
+        'AssumeRolePolicyDocument': PropertyMutability.MUTABLE, // No interruption
+        'Description': PropertyMutability.MUTABLE, // No interruption
+        'ManagedPolicyArns': PropertyMutability.MUTABLE, // No interruption
+        'MaxSessionDuration': PropertyMutability.MUTABLE, // No interruption
+        'Path': PropertyMutability.MUTABLE, // No interruption
+        'PermissionsBoundary': PropertyMutability.MUTABLE, // No interruption
+        'Policies': PropertyMutability.MUTABLE, // No interruption
+        'Tags': PropertyMutability.MUTABLE, // No interruption
+    },
+};
+
+/**
+ * Get property mutability for a given resource type and property path
+ *
+ * @param {string} resourceType - CloudFormation resource type (e.g., 'AWS::Lambda::Function')
+ * @param {string} propertyPath - Property path from drift detection (e.g., 'VpcConfig.SubnetIds')
+ * @returns {PropertyMutability} Property mutability (defaults to MUTABLE if not found)
+ */
+function getPropertyMutability(resourceType, propertyPath) {
+    // Check if resource type has configuration
+    if (!PROPERTY_MUTABILITY_CONFIG[resourceType]) {
+        // Unknown resource type - default to MUTABLE (safe, allows reconciliation attempt)
+        return PropertyMutability.MUTABLE;
+    }
+
+    const resourceConfig = PROPERTY_MUTABILITY_CONFIG[resourceType];
+
+    // Check exact property path match
+    if (resourceConfig[propertyPath]) {
+        return resourceConfig[propertyPath];
+    }
+
+    // Check parent property for nested paths (e.g., 'VpcConfig' for 'VpcConfig.SubnetIds')
+    const parentPath = propertyPath.split('.')[0];
+    if (resourceConfig[parentPath]) {
+        return resourceConfig[parentPath];
+    }
+
+    // Property not found in config - default to MUTABLE
+    return PropertyMutability.MUTABLE;
+}
+
+/**
+ * Check if a resource type is supported in the configuration
+ *
+ * @param {string} resourceType - CloudFormation resource type
+ * @returns {boolean} True if resource type is configured
+ */
+function isResourceTypeConfigured(resourceType) {
+    return resourceType in PROPERTY_MUTABILITY_CONFIG;
+}
+
+/**
+ * Get all configured resource types
+ *
+ * @returns {string[]} Array of resource type names
+ */
+function getConfiguredResourceTypes() {
+    return Object.keys(PROPERTY_MUTABILITY_CONFIG);
+}
+
+module.exports = {
+    PROPERTY_MUTABILITY_CONFIG,
+    getPropertyMutability,
+    isResourceTypeConfigured,
+    getConfiguredResourceTypes,
+};

package/infrastructure/domains/health/domain/services/update-progress-monitor.js

@@ -0,0 +1,192 @@
+/**
+ * UpdateProgressMonitor - Monitor CloudFormation Update Operation Progress
+ *
+ * Domain Layer - Service
+ *
+ * Monitors CloudFormation UPDATE operations by polling stack events and tracking
+ * resource update progress. Provides real-time progress callbacks and detects
+ * failures, rollbacks, and timeouts.
+ *
+ * Responsibilities:
+ * - Poll CloudFormation stack events during update
+ * - Track progress per resource (IN_PROGRESS, COMPLETE, FAILED)
+ * - Detect stack rollback states
+ * - Timeout after 5 minutes
+ * - Provide progress callbacks for UI updates
+ */
+
+class UpdateProgressMonitor {
+  /**
+   * Create progress monitor with CloudFormation repository dependency
+   *
+   * @param {Object} params
+   * @param {Object} params.cloudFormationRepository - CloudFormation operations
+   */
+  constructor({ cloudFormationRepository }) {
+    if (!cloudFormationRepository) {
+      throw new Error('cloudFormationRepository is required');
+    }
+    this.cfRepo = cloudFormationRepository;
+  }
+
+  /**
+   * Monitor update operation progress
+   *
+   * Polls CloudFormation stack events every 2 seconds to track resource update progress.
+   * Calls onProgress callback with status updates for each resource.
+   * Detects failures, rollbacks, and timeouts.
+   *
+   * @param {Object} params
+   * @param {Object} params.stackIdentifier - Stack identifier { stackName, region }
+   * @param {Array<string>} params.resourceLogicalIds - Logical IDs to track
+   * @param {Function} params.onProgress - Progress callback function
+   * @returns {Promise<Object>} Update result
+   */
+  async monitorUpdate({ stackIdentifier, resourceLogicalIds, onProgress }) {
+    // If no resources to track, return immediately
+    if (!resourceLogicalIds || resourceLogicalIds.length === 0) {
+      return {
+        success: true,
+        updatedCount: 0,
+        failedCount: 0,
+        failedResources: [],
+      };
+    }
+
+    const updatedResources = new Set();
+    const failedResources = [];
+    const processedEvents = new Set(); // Track processed events by timestamp + logicalId
+    let elapsedTime = 0; // Track elapsed time manually for fake timers compatibility
+    const TIMEOUT_MS = 300000; // 5 minutes
+    const POLL_INTERVAL_MS = 2000; // 2 seconds
+
+    // Continue polling until all resources are complete or failed
+    while (
+      updatedResources.size + failedResources.length <
+      resourceLogicalIds.length
+    ) {
+      // Wait 2 seconds before polling
+      await this._delay(POLL_INTERVAL_MS);
+      elapsedTime += POLL_INTERVAL_MS;
+
+      // Check for timeout
+      if (elapsedTime > TIMEOUT_MS) {
+        throw new Error('Update operation timed out');
+      }
+
+      // Get stack events
+      const events = await this.cfRepo.getStackEvents({
+        stackIdentifier,
+      });
+
+      // Sort events by timestamp (oldest first) for consistent processing
+      const sortedEvents = [...events].sort(
+        (a, b) => new Date(a.Timestamp) - new Date(b.Timestamp)
+      );
+
+      // Process events for tracked resources
+      for (const event of sortedEvents) {
+        const logicalId = event.LogicalResourceId;
+
+        // Skip if not a tracked resource
+        if (!resourceLogicalIds.includes(logicalId)) {
+          continue;
+        }
+
+        // Create unique event key to avoid duplicate processing
+        const eventKey = `${event.Timestamp.toISOString()}_${logicalId}_${event.ResourceStatus}`;
+
+        // Skip if already processed
+        if (processedEvents.has(eventKey)) {
+          continue;
+        }
+
+        processedEvents.add(eventKey);
+
+        // Handle different resource statuses
+        if (event.ResourceStatus === 'UPDATE_IN_PROGRESS') {
+          // Call progress callback with IN_PROGRESS status
+          if (onProgress) {
+            onProgress({
+              logicalId,
+              status: 'IN_PROGRESS',
+            });
+          }
+        } else if (event.ResourceStatus === 'UPDATE_COMPLETE') {
+          // Mark resource as updated
+          updatedResources.add(logicalId);
+
+          // Call progress callback with COMPLETE status
+          if (onProgress) {
+            onProgress({
+              logicalId,
+              status: 'COMPLETE',
+              progress: updatedResources.size,
+              total: resourceLogicalIds.length,
+            });
+          }
+        } else if (event.ResourceStatus === 'UPDATE_FAILED') {
+          // Add to failed resources
+          const reason = event.ResourceStatusReason || 'Unknown error';
+          failedResources.push({
+            logicalId,
+            reason,
+          });
+
+          // Call progress callback with FAILED status
+          if (onProgress) {
+            onProgress({
+              logicalId,
+              status: 'FAILED',
+              reason,
+            });
+          }
+        }
+      }
+
+      // Check if all resources are now accounted for
+      const allResourcesProcessed =
+        updatedResources.size + failedResources.length >=
+        resourceLogicalIds.length;
+
+      // If all resources processed, exit loop to return result
+      if (allResourcesProcessed) {
+        break;
+      }
+
+      // Check stack status AFTER processing events - if rollback in progress, throw
+      const stackStatus = await this.cfRepo.getStackStatus(stackIdentifier);
+      if (
+        stackStatus.includes('ROLLBACK') &&
+        stackStatus !== 'UPDATE_ROLLBACK_COMPLETE'
+      ) {
+        throw new Error('Update operation failed and rolled back');
+      }
+    }
+
+    // Check final stack status before returning
+    const finalStackStatus = await this.cfRepo.getStackStatus(stackIdentifier);
+
+    // Return result (success = no failures)
+    const success = failedResources.length === 0;
+    return {
+      success,
+      updatedCount: updatedResources.size,
+      failedCount: failedResources.length,
+      failedResources,
+    };
+  }
+
+  /**
+   * Delay helper for polling intervals
+   *
+   * @param {number} ms - Milliseconds to delay
+   * @returns {Promise<void>}
+   * @private
+   */
+  async _delay(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+  }
+}
+
+module.exports = { UpdateProgressMonitor };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.474.6a0bba7.0",
+  "version": "2.0.0--canary.474.ca45ad3.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.474.6a0bba7.0",
-    "@friggframework/test": "2.0.0--canary.474.6a0bba7.0",
+    "@friggframework/schemas": "2.0.0--canary.474.ca45ad3.0",
+    "@friggframework/test": "2.0.0--canary.474.ca45ad3.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.474.6a0bba7.0",
-    "@friggframework/prettier-config": "2.0.0--canary.474.6a0bba7.0",
+    "@friggframework/eslint-config": "2.0.0--canary.474.ca45ad3.0",
+    "@friggframework/prettier-config": "2.0.0--canary.474.ca45ad3.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -67,5 +67,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "6a0bba7b2074339687448fa7eba7d377c3870bea"
+  "gitHead": "ca45ad3b737f85241453177ba87eb05fba6d389e"
 }