@go-to-k/cdkd 0.219.6 → 0.219.8

package/dist/{deploy-engine-CwB8POpC.js → deploy-engine-Bl8wyosc.js}

@@ -9,7 +9,7 @@ import { GetFunctionUrlConfigCommand, InvokeCommand, LambdaClient, UpdateFunctio
 import { AssumeRoleCommand, GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
 import { DescribeAvailabilityZonesCommand, DescribeImagesCommand, DescribeLaunchTemplatesCommand, DescribeRouteTablesCommand, DescribeSecurityGroupsCommand, DescribeSubnetsCommand, DescribeVpcsCommand, DescribeVpnGatewaysCommand, EC2Client } from "@aws-sdk/client-ec2";
 import { DescribeTableCommand } from "@aws-sdk/client-dynamodb";
-import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, GetTemplateCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
+import { CloudFormationClient, CreateChangeSetCommand, DeleteStackCommand, DescribeChangeSetCommand, DescribeTypeCommand, GetTemplateCommand, waitUntilChangeSetCreateComplete } from "@aws-sdk/client-cloudformation";
 import { GetRestApiCommand } from "@aws-sdk/client-api-gateway";
 import { GetSecretValueCommand } from "@aws-sdk/client-secrets-manager";
 import { GetParameterCommand, SSMClient } from "@aws-sdk/client-ssm";
@@ -3763,6 +3763,22 @@ var TemplateParser = class {
 		return dependencies;
 	}
 	/**
+	* Extract resource references (Ref / Fn::GetAtt / Fn::Sub / Fn::Join /
+	* Fn::Select / Fn::Split) from an arbitrary template value.
+	*
+	* Public wrapper over the same recursive extraction `extractDependencies`
+	* uses for Properties — exposed so the diff phase can compute
+	* per-property reference edges (issue #807 replacement propagation)
+	* without duplicating the intrinsic walk. Unlike `extractDependencies`
+	* this does NOT include `DependsOn` (which is pure ordering, not a data
+	* reference — a replaced dependency carries no new value to propagate).
+	*/
+	extractReferences(value) {
+		const references = /* @__PURE__ */ new Set();
+		this.extractRefsFromValue(value, references);
+		return references;
+	}
+	/**
 	* Recursively extract Ref and Fn::GetAtt from a value
 	*/
 	extractRefsFromValue(value, dependencies) {
@@ -4585,6 +4601,7 @@ var ReplacementRulesRegistry = class {
 var DiffCalculator = class DiffCalculator {
 	logger = getLogger().child("DiffCalculator");
 	replacementRules = new ReplacementRulesRegistry();
+	parser = new TemplateParser();
 	/**
 	* Calculate changes needed to reach desired state
 	*
@@ -4674,11 +4691,103 @@ var DiffCalculator = class DiffCalculator {
 			});
 			this.logger.debug(`DELETE: ${logicalId} (${currentResource.resourceType})`);
 		}
+		this.promoteReplacementDependents(changes, desiredTemplate);
 		const summary = this.getSummary(changes);
 		this.logger.debug(`Diff calculated: ${summary.create} CREATE, ${summary.update} UPDATE, ${summary.delete} DELETE, ${summary.noChange} NO_CHANGE`);
 		return changes;
 	}
 	/**
+	* Promote transitive dependents of to-be-replaced resources from
+	* NO_CHANGE to UPDATE (issue #807).
+	*
+	* Diff-time intrinsic resolution runs against the CURRENT state, so a
+	* dependent referencing a resource that will be REPLACED (new physical
+	* ID — e.g. an `AWS::ECS::TaskDefinition` revision) compares equal and
+	* stays NO_CHANGE; the deploy engine then never re-points it at the new
+	* physical resource (for ECS: `UpdateService` is never issued and the
+	* service keeps running the old, now-deregistered revision).
+	* CloudFormation propagates the new physical ID to dependents — mirror
+	* that here by walking reverse reference edges (`Ref` / `Fn::GetAtt` /
+	* `Fn::Sub` and intrinsics nesting them — the same extraction the DAG
+	* builder uses) from every replacement-triggering UPDATE and promoting
+	* NO_CHANGE dependents to UPDATE.
+	*
+	* Promotion is safe even when speculative: the deploy engine re-resolves
+	* the promoted resource's properties against the in-flight state map
+	* (which the DAG guarantees already carries the dependency's new
+	* physical ID) and skips the provider call if nothing actually changed.
+	*
+	* Promotion is transitive: each referencing property of a promoted
+	* dependent is re-evaluated against the replacement rules, and if the
+	* dependent is itself replacement-triggering (the referencing property
+	* is immutable for its type), its own dependents are promoted in turn.
+	* The same re-evaluation also applies to dependents that already had
+	* their own (non-replacement) property changes — their referencing
+	* property gains a synthetic PropertyChange so a replacement cascade is
+	* not masked by an unrelated in-place change.
+	*/
+	promoteReplacementDependents(changes, desiredTemplate) {
+		const queue = [];
+		for (const [logicalId, change] of changes) if (change.changeType === "UPDATE" && change.propertyChanges?.some((pc) => pc.requiresReplacement)) queue.push(logicalId);
+		if (queue.length === 0) return;
+		const dependentsOf = /* @__PURE__ */ new Map();
+		for (const [logicalId, resource] of Object.entries(desiredTemplate.Resources)) {
+			if (resource.Type === "AWS::CDK::Metadata") continue;
+			for (const [propKey, propValue] of Object.entries(resource.Properties ?? {})) for (const referencedId of this.parser.extractReferences(propValue)) {
+				if (referencedId === logicalId) continue;
+				let dependents = dependentsOf.get(referencedId);
+				if (!dependents) {
+					dependents = /* @__PURE__ */ new Map();
+					dependentsOf.set(referencedId, dependents);
+				}
+				let propKeys = dependents.get(logicalId);
+				if (!propKeys) {
+					propKeys = /* @__PURE__ */ new Set();
+					dependents.set(logicalId, propKeys);
+				}
+				propKeys.add(propKey);
+			}
+		}
+		const enqueued = new Set(queue);
+		while (queue.length > 0) {
+			const replacedId = queue.shift();
+			const dependents = dependentsOf.get(replacedId);
+			if (!dependents) continue;
+			for (const [dependentId, refPropKeys] of dependents) {
+				const change = changes.get(dependentId);
+				if (!change) continue;
+				if (change.changeType !== "NO_CHANGE" && change.changeType !== "UPDATE") continue;
+				const existingPaths = new Set((change.propertyChanges ?? []).map((pc) => pc.path));
+				const syntheticChanges = [];
+				for (const propKey of refPropKeys) {
+					if (existingPaths.has(propKey)) continue;
+					const oldValue = change.currentProperties?.[propKey];
+					const newValue = change.desiredProperties?.[propKey];
+					syntheticChanges.push({
+						path: propKey,
+						oldValue,
+						newValue,
+						replacementPropagated: true,
+						requiresReplacement: this.replacementRules.requiresReplacement(change.resourceType, propKey, void 0, void 0)
+					});
+				}
+				if (syntheticChanges.length === 0) continue;
+				if (change.changeType === "NO_CHANGE") {
+					change.changeType = "UPDATE";
+					change.propertyChanges = syntheticChanges;
+					this.logger.debug(`UPDATE (promoted): ${dependentId} references replaced resource ${replacedId} via ${[...refPropKeys].join(", ")}`);
+				} else {
+					change.propertyChanges = [...change.propertyChanges ?? [], ...syntheticChanges];
+					this.logger.debug(`UPDATE (augmented): ${dependentId} references replaced resource ${replacedId} via ${[...refPropKeys].join(", ")}`);
+				}
+				if (!enqueued.has(dependentId) && change.propertyChanges.some((pc) => pc.requiresReplacement)) {
+					enqueued.add(dependentId);
+					queue.push(dependentId);
+				}
+			}
+		}
+	}
+	/**
 	* Best-effort resolution of template property intrinsics against current state.
 	*
 	* Iterates top-level properties and resolves each independently: if resolution
@@ -6388,6 +6497,100 @@ var JsonPatchGenerator = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/write-only-properties.ts
+/**
+* Write-only property resolution for Cloud Control API updates (issue #809).
+*
+* Cloud Control API applies UPDATE patch documents with read-modify-write
+* semantics: the type's read handler returns the current model, the patch is
+* applied on top, and the result becomes the desired state handed to the
+* update handler. Read handlers cannot return write-only properties, so any
+* write-only property that is not explicitly present in the patch document
+* vanishes from the desired state on every CC-routed UPDATE (e.g.
+* `AWS::ECS::Service` loses `VolumeConfigurations` and the update hard-fails;
+* for other types the loss is silent).
+*
+* This module resolves each resource type's `writeOnlyProperties` from the
+* CloudFormation registry schema via `cloudformation:DescribeType`, reduced
+* to the TOP-LEVEL containing property names (a nested path like
+* `/properties/Foo/Bar` strips to `Foo` — re-adding the whole containing
+* property is sufficient and matches terraform-provider-awscc's approach of
+* clearing write-only attribute paths in the prior state so the patch
+* generator always emits `add` ops for them).
+*
+* Only SUCCESSFUL lookups are cached per resource type for the process
+* (deploy) lifetime — `cloudformation:DescribeType` is throttled per-account,
+* and the schema cannot change mid-deploy. A FAILED lookup (missing IAM
+* permission, transient throttle / 5xx) is logged as a warning and resolves
+* to an empty set WITHOUT poisoning the cache, so the caller gracefully falls
+* back to the minimal patch for THIS update while a later update of the same
+* type retries `DescribeType`. Caching failures would let a single transient
+* throttle on the first CC-routed UPDATE silently disable write-only
+* re-inclusion for every CC-routed type for the rest of the deploy —
+* reintroducing the exact hard-fail this module fixes. No regression for
+* callers permanently without the `cloudformation:DescribeType` permission:
+* each update simply re-warns and re-falls-back.
+*/
+/**
+* Per-type cache of SUCCESSFUL lookups only. The value is the in-flight (or
+* settled) promise so that concurrent updates of the same resource type share
+* a single DescribeType call. A failed lookup removes its own entry so a
+* later call retries instead of being permanently poisoned by a transient
+* throttle / 5xx.
+*/
+const writeOnlyPropertiesCache = /* @__PURE__ */ new Map();
+/**
+* Resolve the TOP-LEVEL write-only property names for a resource type.
+*
+* Never throws: a DescribeType failure logs a warning and resolves to an
+* empty set (graceful fallback to the minimal patch). Only SUCCESSFUL
+* lookups are cached per resource type for the process lifetime; a failed
+* lookup is NOT cached, so a later call for the same type retries
+* DescribeType (a transient throttle must not poison the deploy).
+*/
+function getTopLevelWriteOnlyProperties(resourceType) {
+	const cached = writeOnlyPropertiesCache.get(resourceType);
+	if (cached) return cached;
+	const entry = fetchTopLevelWriteOnlyProperties(resourceType).catch((error) => {
+		writeOnlyPropertiesCache.delete(resourceType);
+		const message = error instanceof Error ? error.message : String(error);
+		getLogger().child("WriteOnlyProperties").warn(`Failed to resolve write-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to a minimal update patch — write-only properties (if any) may be dropped by the Cloud Control read-modify-write update. Grant cloudformation:DescribeType to enable write-only property re-inclusion.`);
+		return /* @__PURE__ */ new Set();
+	});
+	writeOnlyPropertiesCache.set(resourceType, entry);
+	return entry;
+}
+/**
+* Fetch + parse the type's write-only properties. THROWS on a DescribeType
+* failure — the caller (`getTopLevelWriteOnlyProperties`) catches, warns, and
+* declines to cache so the lookup can be retried later.
+*/
+async function fetchTopLevelWriteOnlyProperties(resourceType) {
+	const logger = getLogger().child("WriteOnlyProperties");
+	const response = await getAwsClients().cloudFormation.send(new DescribeTypeCommand({
+		Type: "RESOURCE",
+		TypeName: resourceType
+	}));
+	const result = /* @__PURE__ */ new Set();
+	if (response.Schema) {
+		const writeOnly = JSON.parse(response.Schema).writeOnlyProperties;
+		if (Array.isArray(writeOnly)) for (const path of writeOnly) {
+			if (typeof path !== "string") continue;
+			const match = /^\/properties\/([^/]+)/.exec(path);
+			if (match?.[1]) result.add(unescapeJsonPointerSegment(match[1]));
+		}
+	}
+	logger.debug(`Resolved ${result.size} top-level write-only properties for ${resourceType}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
+	return result;
+}
+/**
+* Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`).
+*/
+function unescapeJsonPointerSegment(segment) {
+	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+
 //#endregion
 //#region src/provisioning/unsupported-types.generated.ts
 /**
@@ -6700,7 +6903,7 @@ var CloudControlProvider = class {
 		try {
 			const cleanPreviousProperties = stringifyJsonProperties(resourceType, stripNullValues(previousProperties));
 			const cleanProperties = stringifyJsonProperties(resourceType, stripNullValues(properties));
-			const patch = this.patchGenerator.generatePatch(cleanPreviousProperties, cleanProperties);
+			let patch = this.patchGenerator.generatePatch(cleanPreviousProperties, cleanProperties);
 			if (patch.length === 0) {
 				this.logger.debug(`No property changes detected for ${logicalId}, skipping update`);
 				return {
@@ -6708,6 +6911,19 @@ var CloudControlProvider = class {
 					wasReplaced: false
 				};
 			}
+			const writeOnlyProperties = await getTopLevelWriteOnlyProperties(resourceType);
+			if (writeOnlyProperties.size > 0) {
+				const previousWithoutWriteOnly = { ...cleanPreviousProperties };
+				for (const propertyName of writeOnlyProperties) delete previousWithoutWriteOnly[propertyName];
+				patch = this.patchGenerator.generatePatch(previousWithoutWriteOnly, cleanProperties);
+				if (patch.length === 0) {
+					this.logger.debug(`Only removed write-only properties detected for ${logicalId}, skipping update`);
+					return {
+						physicalId,
+						wasReplaced: false
+					};
+				}
+			}
 			this.logger.debug(`Generated ${patch.length} patch operations for ${logicalId}: ${JSON.stringify(patch)}`);
 			const updateResponse = await this.cloudControlClient.send(new UpdateResourceCommand({
 				TypeName: resourceType,
@@ -12272,4 +12488,4 @@ var DeployEngine = class {
 
 //#endregion
 export { WorkGraph as A, resolveCaptureObservedState as B, DagBuilder as C, shouldRetainResource as D, S3StateBackend as E, runDockerStreaming as F, CFN_TEMPLATE_BODY_LIMIT as G, resolveStateBucketWithDefault as H, Synthesizer as I, findLargeInlineResources as J, CFN_TEMPLATE_URL_LIMIT as K, getDefaultStateBucketName as L, formatDockerLoginError as M, getDockerCmd as N, AssetPublisher as O, runDockerForeground as P, resolveBucketRegion as Q, getLegacyStateBucketName as R, DiffCalculator as S, LockManager as T, resolveStateBucketWithDefaultAndSource as U, resolveSkipPrefix as V, warnDeprecatedNoPrefixCliFlag as W, AssemblyReader as X, uploadCfnTemplate as Y, clearBucketRegionCache as Z, ProviderRegistry as _, withRetry as a, IntrinsicFunctionResolver as b, formatResourceLine as c, gray as d, green as f, collectInlinePolicyNamesManagedBySiblings as g, IAMRoleProvider as h, withResourceDeadline as i, buildDockerImage as j, stringifyValue as k, bold as l, yellow as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isRetryableTransientError as o, red as p, MIGRATE_TMP_PREFIX as q, DeployEngine as r, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, cyan as u, findActionableSilentDrops as v, TemplateParser as w, applyRoleArnIfSet as x, CloudControlProvider as y, resolveApp as z };
-//# sourceMappingURL=deploy-engine-CwB8POpC.js.map
+//# sourceMappingURL=deploy-engine-Bl8wyosc.js.map