@go-to-k/cdkd 0.229.8 → 0.230.0

package/dist/{deploy-engine-rMH9694Q.js → deploy-engine-_N5kVjZN.js}

@@ -1,4 +1,4 @@
-import { E as SynthesisError, F as getLiveRenderer, M as getLogger, T as StateError, U as withStackName, V as generateResourceNameWithFallback, a as assertRegionMatch, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as resolveExplicitPhysicalId, k as normalizeAwsError, n as matchesCdkPath, o as disableInstanceApiTermination, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, x as ResourceTimeoutError, z as applyDefaultNameForFallback } from "./import-helpers-DayvBD4T.js";
+import { E as SynthesisError, F as getLiveRenderer, M as getLogger, S as ResourceUpdateNotSupportedError, T as StateError, U as withStackName, V as generateResourceNameWithFallback, a as assertRegionMatch, b as ProvisioningError, c as AssetError, d as DependencyError, g as MacroExpansionError, h as LockError, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, n as matchesCdkPath, o as disableInstanceApiTermination, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, x as ResourceTimeoutError, z as applyDefaultNameForFallback } from "./import-helpers-DayvBD4T.js";
 import { r as getAwsClients } from "./aws-clients-pjPwZz1r.js";
 import { randomUUID } from "node:crypto";
 import { DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectsV2Command, NoSuchKey, PutObjectCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -11669,6 +11669,140 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/stateful-types.ts
+/**
+* Stateful-resource guard list (issue [#615]).
+*
+* `--recreate-via-cc-api <LogicalId>` destroys + recreates the named
+* resource in one deploy so a previously-silent-dropped top-level CFn
+* property reaches AWS via Cloud Control API. For most types this is
+* safe — destroying + recreating an IAM Role or a Lambda Function
+* loses no user data — but for **data-bearing** types the destroy
+* cycle loses everything in the resource: rows in a DynamoDB table,
+* objects in an S3 bucket, log lines in a LogGroup, images in an ECR
+* repository, etc.
+*
+* To avoid an accidental data-loss footgun, cdkd refuses to recreate
+* any resource whose type is in {@link STATEFUL_TYPES} unless the user
+* ALSO passes `--force-stateful-recreation`. The two-flag protection
+* mirrors `--remove-protection`'s pattern (see
+* `src/cli/commands/destroy-runner.ts`).
+*
+* The list is hand-curated and intentionally **conservative**: every
+* type here carries user data that the AWS service does NOT
+* automatically migrate to the replacement resource. Types that the
+* AWS service treats as ephemeral (e.g. Lambda Function, IAM Role)
+* are NOT in this list — recreate is cheap.
+*
+* Two entries are **conditionally stateful** — they only count when
+* the resource actually contains data:
+*
+*   - `AWS::S3::Bucket`: empty buckets are safe to recreate. The
+*     deploy engine probes `s3:ListObjectsV2` at plan time and only
+*     refuses when the bucket has at least one object.
+*   - `AWS::Logs::LogGroup`: a log group with `RetentionInDays`
+*     undefined or zero is functionally ephemeral. The deploy engine
+*     refuses only when `RetentionInDays > 0`.
+*
+* Both conditional checks live in {@link isStatefulRecreateTarget};
+* the bare {@link STATEFUL_TYPES} set is the type-only first-cut.
+*/
+const STATEFUL_TYPES = new Set([
+	"AWS::RDS::DBInstance",
+	"AWS::RDS::DBCluster",
+	"AWS::DocDB::DBInstance",
+	"AWS::DocDB::DBCluster",
+	"AWS::Neptune::DBInstance",
+	"AWS::Neptune::DBCluster",
+	"AWS::DynamoDB::Table",
+	"AWS::DynamoDB::GlobalTable",
+	"AWS::EFS::FileSystem",
+	"AWS::S3::Bucket",
+	"AWS::ECR::Repository",
+	"AWS::Kinesis::Stream",
+	"AWS::Elasticsearch::Domain",
+	"AWS::OpenSearchService::Domain",
+	"AWS::Cognito::UserPool",
+	"AWS::SecretsManager::Secret",
+	"AWS::SSM::Parameter",
+	"AWS::Glue::Database",
+	"AWS::Glue::Table",
+	"AWS::Logs::LogGroup",
+	"AWS::CloudFront::Distribution"
+]);
+/**
+* Multi-region resource types — `--recreate-via-cc-api` refuses these
+* outright in v1 regardless of `--force-stateful-recreation`. Design
+* doc §8 calls these "out of scope": the destroy + recreate cycle
+* across replica regions is more involved than a single-region
+* destroy-and-create (replica regions, automated backups, eventual
+* consistency across the replication mesh, etc.).
+*
+* Distinct from {@link STATEFUL_TYPES} — STATEFUL_TYPES gates on data
+* loss (bypassable with `--force-stateful-recreation`); this set is
+* an out-of-scope refusal (no bypass).
+*/
+const MULTI_REGION_RECREATE_BLOCKED_TYPES = new Set(["AWS::DynamoDB::GlobalTable"]);
+/**
+* Cheap, synchronous read of the resource's recorded properties only.
+* For `AWS::S3::Bucket` this returns `null` — the live `ListObjectsV2`
+* probe to distinguish empty buckets (safe to recreate) from
+* non-empty (data loss) lives in
+* `src/deployment/recreate-targets.ts#probeStatefulRecreateTargetsAsync`
+* (issue [#648]) and runs after this sync first-cut. Sync callers can
+* still treat `null` as "not stateful" — the deploy command does both
+* passes back-to-back; only callers that explicitly opt out of the
+* async probe need to assume conservative "stateful" semantics.
+*
+* Returns the {@link StatefulReason} when the type is stateful (or
+* `null` for non-stateful types).
+*/
+function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
+	if (!STATEFUL_TYPES.has(resourceType)) return null;
+	if (resourceType === "AWS::Logs::LogGroup") {
+		const retention = recordedProperties?.["RetentionInDays"];
+		if (typeof retention === "number" && retention > 0) return "has-retention";
+		return null;
+	}
+	if (resourceType === "AWS::S3::Bucket") return null;
+	return "always";
+}
+/**
+* Conservative variant for the `cdkd deploy --replace` mid-deploy guard.
+*
+* `--replace` catches a provider's immutable-update rejection while the deploy
+* is already in flight, so — unlike the `--recreate-via-*` pre-flight, which
+* runs {@link probeStatefulRecreateTargetsAsync} (`s3:ListObjectVersions`) —
+* there is no opportunity to probe an `AWS::S3::Bucket`'s object count. The
+* sync check returns `null` for S3 (it defers to that async probe), which would
+* let a NON-EMPTY bucket be DELETE + CREATEd (data loss) without
+* `--force-stateful-recreation`. To stay fail-safe, treat a deferred S3 bucket
+* as stateful here: the user must pass `--force-stateful-recreation` to replace
+* ANY S3 bucket via `--replace`, empty or not. Every other type matches
+* {@link isStatefulRecreateTargetSync} exactly (the LogGroup retention check is
+* fully resolvable from recorded properties, so no conservatism is needed there).
+*/
+function isStatefulRecreateTargetForReplace(resourceType, recordedProperties) {
+	const sync = isStatefulRecreateTargetSync(resourceType, recordedProperties);
+	if (sync) return sync;
+	if (resourceType === "AWS::S3::Bucket") return "has-objects";
+	return null;
+}
+/**
+* Human-readable rendering of {@link StatefulReason} for error
+* messages. Used by the pre-flight guard's "X resources require
+* --force-stateful-recreation" listing.
+*/
+function renderStatefulReason(reason) {
+	switch (reason) {
+		case "always": return "destroy loses all data in the resource";
+		case "has-objects": return "S3 bucket is non-empty";
+		case "has-retention": return "log group retains data (RetentionInDays > 0)";
+		case null: return "(not stateful)";
+	}
+}
+
 //#endregion
 //#region src/deployment/dag-executor.ts
 /**
@@ -13248,7 +13382,13 @@ var DeployEngine = class {
 						result = await this.withRetry(() => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps), logicalId, void 0, void 0, updateProvider);
 					} catch (updateError) {
 						const msg = updateError instanceof Error ? updateError.message : String(updateError);
-						if (msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE")) {
+						const ccUnsupported = msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE");
+						const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && this.options.replace === true;
+						if (ccUnsupported || replaceOptIn) {
+							if (replaceOptIn) {
+								const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
+								if (statefulReason && this.options.forceStatefulRecreation !== true) throw new CdkdError(`--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED");
+							}
 							this.logger.info(`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 							try {
 								await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, { expectedRegion: this.stackRegion });
@@ -13523,5 +13663,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { findLargeInlineResources as $, shouldRetainResource as A, getDockerImageBySourceHash as B, applyRoleArnIfSet as C, LockManager as D, TemplateParser as E, formatDockerLoginError as F, resolveCaptureObservedState as G, getDefaultStateBucketName as H, getDockerCmd as I, resolveStateBucketWithDefaultAndSource as J, resolveSkipPrefix as K, runDockerForeground as L, stringifyValue as M, WorkGraph as N, S3StateBackend as O, buildDockerImage as P, MIGRATE_TMP_PREFIX as Q, runDockerStreaming as R, IntrinsicFunctionResolver as S, DagBuilder as T, getLegacyStateBucketName as U, Synthesizer as V, resolveApp as W, CFN_TEMPLATE_BODY_LIMIT as X, warnDeprecatedNoPrefixCliFlag as Y, CFN_TEMPLATE_URL_LIMIT as Z, IAMRoleProvider as _, withRetry as a, findActionableSilentDrops as b, computeImplicitDeleteEdges as c, bold as d, uploadCfnTemplate as et, cyan as f, yellow as g, red as h, withResourceDeadline as i, AssetPublisher as j, rebuildClientForBucketRegion as k, extractDeploymentEventError as l, green as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, clearBucketRegionCache as nt, isRetryableTransientError as o, gray as p, resolveStateBucketWithDefault as q, DeployEngine as r, resolveBucketRegion as rt, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, AssemblyReader as tt, formatResourceLine as u, collectInlinePolicyNamesManagedBySiblings as v, DiffCalculator as w, CloudControlProvider as x, ProviderRegistry as y, AssetManifestLoader as z };
-//# sourceMappingURL=deploy-engine-rMH9694Q.js.map
+export { CFN_TEMPLATE_BODY_LIMIT as $, LockManager as A, runDockerForeground as B, findActionableSilentDrops as C, DiffCalculator as D, applyRoleArnIfSet as E, stringifyValue as F, getDefaultStateBucketName as G, AssetManifestLoader as H, WorkGraph as I, resolveCaptureObservedState as J, getLegacyStateBucketName as K, buildDockerImage as L, rebuildClientForBucketRegion as M, shouldRetainResource as N, DagBuilder as O, AssetPublisher as P, warnDeprecatedNoPrefixCliFlag as Q, formatDockerLoginError as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, getDockerImageBySourceHash as U, runDockerStreaming as V, Synthesizer as W, resolveStateBucketWithDefault as X, resolveSkipPrefix as Y, resolveStateBucketWithDefaultAndSource as Z, green as _, withRetry as a, clearBucketRegionCache as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, isStatefulRecreateTargetSync as d, CFN_TEMPLATE_URL_LIMIT as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, AssemblyReader as it, S3StateBackend as j, TemplateParser as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, findLargeInlineResources as nt, isRetryableTransientError as o, resolveBucketRegion as ot, formatResourceLine as p, resolveApp as q, DeployEngine as r, uploadCfnTemplate as rt, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, MIGRATE_TMP_PREFIX as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, getDockerCmd as z };
+//# sourceMappingURL=deploy-engine-_N5kVjZN.js.map