@go-to-k/cdkd 0.230.16 → 0.230.17

package/dist/{deploy-engine-BqUZUty9.js → deploy-engine-CAG2RhWS.js}

@@ -4867,6 +4867,24 @@ var ReplacementRulesRegistry = class {
 		return false;
 	}
 	/**
+	* Whether the registry has an EXPLICIT opinion about a property's
+	* replacement behavior — i.e. the type has a rule AND the property is listed
+	* in its `replacementProperties`, `updateableProperties`, OR
+	* `conditionalReplacements`. Returns false for an unknown type, or for a
+	* known type whose rule does not mention the property (the "default to
+	* updateable" fall-through inside {@link requiresReplacement}).
+	*
+	* The diff calculator uses this to decide whether the CFn-schema
+	* `createOnlyProperties` fallback may apply: the schema only fills the GAP
+	* where the registry has no opinion, so a deliberate `updateableProperties`
+	* (or conditional) classification is never overridden by the fallback.
+	*/
+	isClassified(resourceType, propertyPath) {
+		const rule = this.rules.get(resourceType);
+		if (!rule) return false;
+		return rule.replacementProperties.has(propertyPath) || (rule.updateableProperties?.has(propertyPath) ?? false) || (rule.conditionalReplacements?.has(propertyPath) ?? false);
+	}
+	/**
 	* Initialize replacement rules for common AWS resource types
 	*/
 	initializeRules() {
@@ -5117,6 +5135,98 @@ var ReplacementRulesRegistry = class {
 	}
 };
 
+//#endregion
+//#region src/provisioning/create-only-properties.ts
+/**
+* Create-only (immutable) property resolution for replacement detection.
+*
+* CloudFormation marks some properties "Update requires: Replacement" — the
+* resource type's registry schema lists them under `createOnlyProperties`.
+* Changing such a property cannot be an in-place UPDATE; CloudFormation
+* transparently DELETE+CREATEs the resource. cdkd's diff classifier
+* (`ReplacementRulesRegistry`) only knows the ~25 types with a hand-authored
+* rule, so for every other type an immutable-property change was previously
+* mis-classified as an in-place UPDATE (the provider's `update()` then either
+* rejected it with a typed error — at best — or silently dropped it).
+*
+* This module resolves each resource type's `createOnlyProperties` from the
+* CloudFormation registry schema via `cloudformation:DescribeType`, reduced to
+* the TOP-LEVEL containing property names (a nested path like
+* `/properties/Foo/Bar` strips to `Foo`) so the diff's top-level property keys
+* match. The diff calculator consults it as a fallback for any property the
+* registry does not explicitly classify, so a createOnly change on ANY type now
+* correctly drives a replacement.
+*
+* Caching / failure semantics are identical to {@link
+* ./write-only-properties.ts} (the sibling DescribeType-backed resolver): only
+* SUCCESSFUL lookups are cached per resource type for the process (deploy)
+* lifetime — `cloudformation:DescribeType` is throttled per-account and the
+* schema cannot change mid-deploy. A FAILED lookup (missing IAM permission,
+* transient throttle / 5xx) is logged as a warning and resolves to an empty set
+* WITHOUT poisoning the cache, so the caller gracefully falls back to the
+* registry-only classification for THIS resource while a later resource of the
+* same type retries. A caller permanently without `cloudformation:DescribeType`
+* simply keeps the pre-existing registry-only behavior — no regression.
+*/
+/**
+* Per-type cache of SUCCESSFUL lookups only. The value is the in-flight (or
+* settled) promise so concurrent diffs of the same resource type share a
+* single DescribeType call. A failed lookup removes its own entry so a later
+* call retries instead of being permanently poisoned by a transient throttle.
+*/
+const createOnlyPropertiesCache = /* @__PURE__ */ new Map();
+/**
+* Resolve the TOP-LEVEL create-only (immutable) property names for a resource
+* type.
+*
+* Never throws: a DescribeType failure logs a warning and resolves to an empty
+* set (graceful fallback to the registry-only classification). Only SUCCESSFUL
+* lookups are cached per resource type for the process lifetime; a failed
+* lookup is NOT cached, so a later call for the same type retries DescribeType
+* (a transient throttle must not poison the deploy's replacement detection).
+*/
+function getTopLevelCreateOnlyProperties(resourceType) {
+	const cached = createOnlyPropertiesCache.get(resourceType);
+	if (cached) return cached;
+	const entry = fetchTopLevelCreateOnlyProperties(resourceType).catch((error) => {
+		createOnlyPropertiesCache.delete(resourceType);
+		const message = error instanceof Error ? error.message : String(error);
+		getLogger().child("CreateOnlyProperties").warn(`Failed to resolve create-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to the registry-only replacement classification for this resource — an immutable-property change may be mis-classified as an in-place update. Grant cloudformation:DescribeType to enable schema-driven replacement detection.`);
+		return /* @__PURE__ */ new Set();
+	});
+	createOnlyPropertiesCache.set(resourceType, entry);
+	return entry;
+}
+/**
+* Fetch + parse the type's create-only properties. THROWS on a DescribeType
+* failure — the caller ({@link getTopLevelCreateOnlyProperties}) catches,
+* warns, and declines to cache so the lookup can be retried later.
+*/
+async function fetchTopLevelCreateOnlyProperties(resourceType) {
+	const logger = getLogger().child("CreateOnlyProperties");
+	const response = await getAwsClients().cloudFormation.send(new DescribeTypeCommand({
+		Type: "RESOURCE",
+		TypeName: resourceType
+	}));
+	const result = /* @__PURE__ */ new Set();
+	if (response.Schema) {
+		const createOnly = JSON.parse(response.Schema).createOnlyProperties;
+		if (Array.isArray(createOnly)) for (const path of createOnly) {
+			if (typeof path !== "string") continue;
+			const match = /^\/properties\/([^/]+)/.exec(path);
+			if (match?.[1]) result.add(unescapeJsonPointerSegment$1(match[1]));
+		}
+	}
+	logger.debug(`Resolved ${result.size} top-level create-only properties for ${resourceType}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
+	return result;
+}
+/**
+* Unescape an RFC 6901 JSON Pointer segment (`~1` -> `/`, `~0` -> `~`).
+*/
+function unescapeJsonPointerSegment$1(segment) {
+	return segment.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+
 //#endregion
 //#region src/analyzer/diff-calculator.ts
 /**
@@ -5191,7 +5301,7 @@ var DiffCalculator = class DiffCalculator {
 			} else {
 				const rawDesiredProps = desiredResource.Properties || {};
 				const desiredPropsForCompare = resolveFn ? await this.resolveBestEffort(rawDesiredProps, resolveFn) : rawDesiredProps;
-				const propertyChanges = this.compareProperties(desiredResource.Type, currentResource.properties, desiredPropsForCompare);
+				const propertyChanges = await this.compareProperties(desiredResource.Type, currentResource.properties, desiredPropsForCompare);
 				const attributeChanges = this.compareAttributes(currentResource, desiredResource);
 				if (propertyChanges.length > 0 || attributeChanges.length > 0) {
 					changes.set(logicalId, {
@@ -5497,17 +5607,25 @@ var DiffCalculator = class DiffCalculator {
 	* Uses ReplacementRulesRegistry to determine which property changes require replacement.
 	* Reference: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html
 	*/
-	compareProperties(resourceType, currentProperties, desiredProperties) {
+	async compareProperties(resourceType, currentProperties, desiredProperties) {
 		const changes = [];
 		const allKeys = new Set([...Object.keys(currentProperties), ...Object.keys(desiredProperties)]);
 		const ignoredProperties = /* @__PURE__ */ new Set();
 		if (resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::")) ignoredProperties.add("Timestamp");
+		let createOnlyProps;
 		for (const key of allKeys) {
 			if (ignoredProperties.has(key)) continue;
 			const oldValue = currentProperties[key];
 			const newValue = desiredProperties[key];
 			if (!this.valuesEqual(oldValue, newValue)) {
-				const requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue);
+				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue);
+				if (!requiresReplacement && !this.replacementRules.isClassified(resourceType, key)) {
+					if (createOnlyProps === void 0) createOnlyProps = await getTopLevelCreateOnlyProperties(resourceType);
+					if (createOnlyProps.has(key)) {
+						requiresReplacement = true;
+						this.logger.debug(`Property ${key} of ${resourceType} is createOnly per the CFn schema — requires replacement`);
+					}
+				}
 				changes.push({
 					path: key,
 					oldValue,
@@ -13676,6 +13794,13 @@ var DeployEngine = class {
 				const needsReplacement = propertyDrivenReplacement || recreateFlagged;
 				const dependencies = this.extractAllDependencies(template, logicalId);
 				if (needsReplacement) {
+					if (propertyDrivenReplacement && !recreateFlagged) {
+						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
+						if (statefulReason && this.options.forceStatefulRecreation !== true) {
+							const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
+							throw new CdkdError(`${logicalId} (${resourceType}) requires replacement (immutable property changed: ${immutableProps}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED");
+						}
+					}
 					let replacementReason;
 					if (recreateViaCcApi) replacementReason = "--recreate-via-cc-api flag (mid-life SDK→CC migration)";
 					else if (recreateViaSdkProvider) replacementReason = "--recreate-via-sdk-provider flag (mid-life CC→SDK migration)";
@@ -14036,4 +14161,4 @@ var DeployEngine = class {
 
 //#endregion
 export { CFN_TEMPLATE_BODY_LIMIT as $, LockManager as A, runDockerForeground as B, findActionableSilentDrops as C, DiffCalculator as D, applyRoleArnIfSet as E, stringifyValue as F, getDefaultStateBucketName as G, AssetManifestLoader as H, WorkGraph as I, resolveCaptureObservedState as J, getLegacyStateBucketName as K, buildDockerImage as L, rebuildClientForBucketRegion as M, shouldRetainResource as N, DagBuilder as O, AssetPublisher as P, warnDeprecatedNoPrefixCliFlag as Q, formatDockerLoginError as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, getDockerImageBySourceHash as U, runDockerStreaming as V, Synthesizer as W, resolveStateBucketWithDefault as X, resolveSkipPrefix as Y, resolveStateBucketWithDefaultAndSource as Z, green as _, withRetry as a, clearBucketRegionCache as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, isStatefulRecreateTargetSync as d, CFN_TEMPLATE_URL_LIMIT as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, AssemblyReader as it, S3StateBackend as j, TemplateParser as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, findLargeInlineResources as nt, isRetryableTransientError as o, resolveBucketRegion as ot, formatResourceLine as p, resolveApp as q, DeployEngine as r, uploadCfnTemplate as rt, IMPLICIT_DELETE_DEPENDENCIES as s, DEFAULT_RESOURCE_TIMEOUT_MS as t, MIGRATE_TMP_PREFIX as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, getDockerCmd as z };
-//# sourceMappingURL=deploy-engine-BqUZUty9.js.map
+//# sourceMappingURL=deploy-engine-CAG2RhWS.js.map