@go-to-k/cdkd 0.230.27 → 0.230.29

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-BERaDgMo.js";
+import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-pdCBIFCK.js";
 import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -1445,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.230.27";
+	return "0.230.29";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -55430,7 +55430,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.27");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.29");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());

package/dist/{deploy-engine-BERaDgMo.js → deploy-engine-pdCBIFCK.js}

@@ -5203,48 +5203,126 @@ var ReplacementRulesRegistry = class {
 */
 const createOnlyPropertiesCache = /* @__PURE__ */ new Map();
 /**
-* Resolve the TOP-LEVEL create-only (immutable) property names for a resource
-* type.
+* Resolve the create-only (immutable) property PATHS for a resource type,
+* each as the segment array after `/properties/` (e.g.
+* `['Name']`, `['SourceParameters', 'KinesisStreamParameters',
+* 'StartingPosition']`).
+*
+* Full paths — not top-level reductions — because reducing a NESTED
+* createOnly entry to its top-level container over-approximates: for
+* `AWS::Pipes::Pipe`, `SourceParameters` itself is mutable and only
+* stream-source sub-paths under it are createOnly, so an SQS pipe's
+* `SourceParameters.SqsQueueParameters.BatchSize` change (CFn: "No
+* interruption") was mis-classified as a replacement (issue #960). The diff
+* consults {@link createOnlyChangeRequiresReplacement} to compare at the
+* schema's actual path granularity.
 *
 * Never throws: a DescribeType failure logs a warning and resolves to an empty
-* set (graceful fallback to the registry-only classification). Only SUCCESSFUL
+* list (graceful fallback to the registry-only classification). Only SUCCESSFUL
 * lookups are cached per resource type for the process lifetime; a failed
 * lookup is NOT cached, so a later call for the same type retries DescribeType
 * (a transient throttle must not poison the deploy's replacement detection).
 */
-function getTopLevelCreateOnlyProperties(resourceType) {
+function getCreateOnlyPropertyPaths(resourceType) {
 	const cached = createOnlyPropertiesCache.get(resourceType);
 	if (cached) return cached;
-	const entry = fetchTopLevelCreateOnlyProperties(resourceType).catch((error) => {
+	const entry = fetchCreateOnlyPropertyPaths(resourceType).catch((error) => {
 		createOnlyPropertiesCache.delete(resourceType);
 		const message = error instanceof Error ? error.message : String(error);
 		getLogger().child("CreateOnlyProperties").warn(`Failed to resolve create-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to the registry-only replacement classification for this resource — an immutable-property change may be mis-classified as an in-place update. Grant cloudformation:DescribeType to enable schema-driven replacement detection.`);
-		return /* @__PURE__ */ new Set();
+		return [];
 	});
 	createOnlyPropertiesCache.set(resourceType, entry);
 	return entry;
 }
 /**
-* Fetch + parse the type's create-only properties. THROWS on a DescribeType
-* failure — the caller ({@link getTopLevelCreateOnlyProperties}) catches,
-* warns, and declines to cache so the lookup can be retried later.
+* Decide whether a change to top-level property `topLevelKey` requires
+* replacement per the schema's createOnly paths.
+*
+* - A length-1 path (`['Name']`) marks the whole property createOnly — any
+*   change replaces (the pre-#960 behavior).
+* - A nested path (`['SourceParameters', ..., 'StartingPosition']`) replaces
+*   ONLY when the value AT that nested path differs between old and new —
+*   sibling sub-properties stay in-place-updatable, matching CloudFormation's
+*   per-path "Update requires: Replacement" annotations.
+* - A path that cannot be resolved against the values (an array or scalar
+*   where an object was expected, or a `*` wildcard segment) is treated
+*   conservatively as changed — replacement — since we cannot prove the
+*   immutable part stayed equal.
+*
+* Pure and synchronous so it is unit-testable without the DescribeType
+* plumbing; `valuesEqual` is injected by the diff calculator so nested
+* comparisons use the same equality as the top-level diff.
+*/
+function createOnlyChangeRequiresReplacement(createOnlyPaths, topLevelKey, oldValue, newValue, valuesEqual) {
+	for (const path of createOnlyPaths) {
+		if (path[0] !== topLevelKey) continue;
+		if (path.length === 1) return true;
+		const oldSub = valueAtPath(oldValue, path.slice(1));
+		const newSub = valueAtPath(newValue, path.slice(1));
+		if (!oldSub.resolved || !newSub.resolved) return true;
+		if (!valuesEqual(oldSub.value, newSub.value)) return true;
+	}
+	return false;
+}
+/**
+* Walk `value` along `segments` of plain-object keys.
+*
+* An absent container (`undefined` / `null`) RESOLVES to `undefined` — that
+* is the load-bearing case: an SQS pipe has no `DynamoDBStreamParameters`
+* subtree on either side, so its stream-source createOnly paths compare
+* `undefined === undefined` and do not force a replacement. Only shapes we
+* cannot meaningfully traverse (arrays / scalars where an object is
+* expected, `*` wildcard segments) report unresolved, which the caller
+* treats conservatively.
+*/
+function valueAtPath(value, segments) {
+	let current = value;
+	for (const segment of segments) {
+		if (segment === "*") return { resolved: false };
+		if (current === void 0 || current === null) return {
+			resolved: true,
+			value: void 0
+		};
+		if (typeof current !== "object" || Array.isArray(current)) return { resolved: false };
+		if (isIntrinsicShaped(current)) return { resolved: false };
+		current = current[segment];
+	}
+	return {
+		resolved: true,
+		value: current
+	};
+}
+/**
+* True for a single-key object whose key is `Ref` or `Fn::*` — the shape of
+* an unresolved CloudFormation intrinsic.
+*/
+function isIntrinsicShaped(value) {
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+/**
+* Fetch + parse the type's create-only property paths. THROWS on a
+* DescribeType failure — the caller ({@link getCreateOnlyPropertyPaths})
+* catches, warns, and declines to cache so the lookup can be retried later.
 */
-async function fetchTopLevelCreateOnlyProperties(resourceType) {
+async function fetchCreateOnlyPropertyPaths(resourceType) {
 	const logger = getLogger().child("CreateOnlyProperties");
 	const response = await getAwsClients().cloudFormation.send(new DescribeTypeCommand({
 		Type: "RESOURCE",
 		TypeName: resourceType
 	}));
-	const result = /* @__PURE__ */ new Set();
+	const result = [];
 	if (response.Schema) {
 		const createOnly = JSON.parse(response.Schema).createOnlyProperties;
 		if (Array.isArray(createOnly)) for (const path of createOnly) {
 			if (typeof path !== "string") continue;
-			const match = /^\/properties\/([^/]+)/.exec(path);
-			if (match?.[1]) result.add(unescapeJsonPointerSegment$1(match[1]));
+			if (!path.startsWith("/properties/")) continue;
+			const segments = path.slice(12).split("/").map(unescapeJsonPointerSegment$1).filter((segment) => segment.length > 0);
+			if (segments.length > 0) result.push(segments);
 		}
 	}
-	logger.debug(`Resolved ${result.size} top-level create-only properties for ${resourceType}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
+	logger.debug(`Resolved ${result.length} create-only property paths for ${resourceType}` + (result.length > 0 ? `: ${result.map((p) => p.join(".")).join(", ")}` : ""));
 	return result;
 }
 /**
@@ -5639,7 +5717,7 @@ var DiffCalculator = class DiffCalculator {
 		const allKeys = new Set([...Object.keys(currentProperties), ...Object.keys(desiredProperties)]);
 		const ignoredProperties = /* @__PURE__ */ new Set();
 		if (resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::")) ignoredProperties.add("Timestamp");
-		let createOnlyProps;
+		let createOnlyPaths;
 		for (const key of allKeys) {
 			if (ignoredProperties.has(key)) continue;
 			const oldValue = currentProperties[key];
@@ -5647,10 +5725,10 @@ var DiffCalculator = class DiffCalculator {
 			if (!this.valuesEqual(oldValue, newValue)) {
 				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue);
 				if (!requiresReplacement && !this.replacementRules.isClassified(resourceType, key)) {
-					if (createOnlyProps === void 0) createOnlyProps = await getTopLevelCreateOnlyProperties(resourceType);
-					if (createOnlyProps.has(key)) {
+					if (createOnlyPaths === void 0) createOnlyPaths = await getCreateOnlyPropertyPaths(resourceType);
+					if (createOnlyChangeRequiresReplacement(createOnlyPaths, key, oldValue, newValue, (a, b) => this.valuesEqual(a, b))) {
 						requiresReplacement = true;
-						this.logger.debug(`Property ${key} of ${resourceType} is createOnly per the CFn schema — requires replacement`);
+						this.logger.debug(`Property ${key} of ${resourceType} changed a createOnly path per the CFn schema — requires replacement`);
 					}
 				}
 				changes.push({
@@ -7956,6 +8034,28 @@ function stripNullValues(obj) {
 	}
 	return obj;
 }
+/**
+* Thrown when a Cloud Control operation's async progress event reports
+* FAILED. Carries the handler-reported `ErrorCode` and the operation kind so
+* the CREATE path can distinguish "our CreateResource materialized a resource
+* and then failed stabilization" (the remnant must be deleted or every outer
+* retry collides with AlreadyExists — surfaced by AWS::Synthetics::Canary,
+* whose create materializes the canary before the IAM-propagation race lands
+* it in ERROR state) from "the resource already existed before this create"
+* (`ErrorCode: AlreadyExists` — deleting by that identifier would destroy a
+* pre-existing user resource, so it is never cleaned up).
+*/
+var CloudControlOperationFailedError = class CloudControlOperationFailedError extends ProvisioningError {
+	ccErrorCode;
+	ccOperation;
+	constructor(message, resourceType, logicalId, physicalId, ccErrorCode, ccOperation) {
+		super(message, resourceType, logicalId, physicalId);
+		this.ccErrorCode = ccErrorCode;
+		this.ccOperation = ccOperation;
+		this.name = "CloudControlOperationFailedError";
+		Object.setPrototypeOf(this, CloudControlOperationFailedError.prototype);
+	}
+};
 var CloudControlProvider = class {
 	cloudControlClient;
 	logger = getLogger().child("CloudControlProvider");
@@ -7990,10 +8090,54 @@ var CloudControlProvider = class {
 			result.attributes = await this.enrichResourceAttributes(resourceType, progressEvent.Identifier, result.attributes || {});
 			return result;
 		} catch (error) {
+			await this.cleanupFailedCreateRemnant(error, resourceType, logicalId);
 			this.handleError(error, "CREATE", resourceType, logicalId);
 		}
 	}
 	/**
+	* Best-effort deletion of the physical resource a FAILED async CREATE left
+	* behind.
+	*
+	* Some Cloud Control create handlers materialize the resource first and
+	* stabilize it afterwards (e.g. `AWS::Synthetics::Canary` creates the canary
+	* entity, then builds its backing Lambda). When stabilization fails — most
+	* commonly the just-created-IAM-role propagation race cdkd's fast path is
+	* prone to — the FAILED progress event carries the materialized resource's
+	* `Identifier`, but the half-created remnant keeps occupying the name. The
+	* deploy engine's outer `withRetry` then re-invokes `create()` (the
+	* stabilization message matches the transient-error patterns) and every
+	* retry fails with `AlreadyExists` instead of recovering, and the remnant is
+	* ALSO invisible to rollback (the create never returned, so it is not in
+	* state) — an orphan CloudFormation would have deleted on rollback.
+	*
+	* Deleting the remnant here restores both behaviors: the next retry starts
+	* with a free name (and succeeds once AWS stabilizes), and a final failure
+	* leaves nothing behind.
+	*
+	* Safety: never fires when the handler reported `ErrorCode: AlreadyExists`
+	* — there the identifier names a resource that pre-dates this create (our
+	* CreateCanary repro's SECOND attempt reported exactly that shape), and
+	* deleting it would destroy a user's pre-existing resource. Handlers may
+	* also stuff a speculative identifier into a FAILED event without having
+	* materialized anything (observed on `AWS::CodeDeploy::DeploymentGroup`);
+	* the delete then no-ops via the NotFound-idempotent path. Cleanup failures
+	* are warned, not thrown — the original create error must surface.
+	*/
+	async cleanupFailedCreateRemnant(error, resourceType, logicalId) {
+		if (!(error instanceof CloudControlOperationFailedError)) return;
+		if (error.ccOperation !== "CREATE" || !error.physicalId) return;
+		if (error.ccErrorCode === "AlreadyExists") return;
+		if (error.ccErrorCode === "ResourceConflict") return;
+		this.logger.info(`CREATE of ${logicalId} failed after materializing ${error.physicalId}; deleting the remnant so a retry can re-create it`);
+		try {
+			await this.delete(logicalId, error.physicalId, resourceType);
+			this.logger.debug(`Removed failed-create remnant ${error.physicalId} for ${logicalId}`);
+		} catch (cleanupError) {
+			const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+			this.logger.warn(`Failed to delete the remnant ${error.physicalId} left by the failed CREATE of ${logicalId}: ${message} — a retry may fail with AlreadyExists until it is removed manually`);
+		}
+	}
+	/**
 	* Update a resource using Cloud Control API
 	*/
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -8113,7 +8257,7 @@ var CloudControlProvider = class {
 			this.logger.debug(`${operation} ${logicalId}: ${progressEvent.OperationStatus} (attempt ${attempts}, next poll ${pollInterval}ms)`);
 			switch (progressEvent.OperationStatus) {
 				case "SUCCESS": return progressEvent;
-				case "FAILED": throw new ProvisioningError(`${operation} failed for ${logicalId}: ${progressEvent.StatusMessage || "Unknown error"}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier);
+				case "FAILED": throw new CloudControlOperationFailedError(`${operation} failed for ${logicalId}: ${progressEvent.StatusMessage || "Unknown error"}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier, progressEvent.ErrorCode, operation);
 				case "CANCEL_COMPLETE": throw new ProvisioningError(`${operation} cancelled for ${logicalId}`, progressEvent.TypeName || "Unknown", logicalId, progressEvent.Identifier);
 				case "IN_PROGRESS":
 				case "PENDING":
@@ -14221,4 +14365,4 @@ var DeployEngine = class {
 
 //#endregion
 export { resolveStateBucketWithDefaultAndSource as $, TemplateParser as A, getDockerCmd as B, findActionableSilentDrops as C, applyRoleArnIfSet as D, cfnRefValueFromPhysicalId as E, AssetPublisher as F, Synthesizer as G, runDockerStreaming as H, stringifyValue as I, getLegacyStateBucketName as J, synthesisStatusMessage as K, WorkGraph as L, S3StateBackend as M, rebuildClientForBucketRegion as N, DiffCalculator as O, shouldRetainResource as P, resolveStateBucketWithDefault as Q, buildDockerImage as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, AssetManifestLoader as U, runDockerForeground as V, getDockerImageBySourceHash as W, resolveCaptureObservedState as X, resolveApp as Y, resolveSkipPrefix as Z, green as _, withRetry as a, uploadCfnTemplate as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveBucketRegion as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, findLargeInlineResources as it, LockManager as j, DagBuilder as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_URL_LIMIT as nt, isRetryableTransientError as o, AssemblyReader as ot, formatResourceLine as p, getDefaultStateBucketName as q, DeployEngine as r, MIGRATE_TMP_PREFIX as rt, IMPLICIT_DELETE_DEPENDENCIES as s, clearBucketRegionCache as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CFN_TEMPLATE_BODY_LIMIT as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, formatDockerLoginError as z };
-//# sourceMappingURL=deploy-engine-BERaDgMo.js.map
+//# sourceMappingURL=deploy-engine-pdCBIFCK.js.map