@go-to-k/cdkd 0.230.28 → 0.230.29

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { A as withErrorHandling, B as generateResourceName, C as StackHasActiveImportsError, F as getLiveRenderer, H as withSkipPrefix, I as PATTERN_B_NAME_OPTIONS, L as PATTERN_B_NAME_PROPERTIES, M as getLogger, P as runStackBuffered, R as PATTERN_B_RESOURCE_TYPES, S as ResourceUpdateNotSupportedError, U as withStackName, V as generateResourceNameWithFallback, _ as MissingCdkCliError, a as assertRegionMatch, b as ProvisioningError, f as LocalInvokeBuildError$1, i as resolveExplicitPhysicalId, k as normalizeAwsError, l as CdkdError, m as LocalStartServiceError, n as matchesCdkPath, o as disableInstanceApiTermination, p as LocalMigrateError, r as normalizeAwsTagsToCfn, s as isTerminationProtectionPropagationError, t as CDK_PATH_TAG, v as NestedStackChildDirectDestroyError, w as StackTerminationProtectionError, x as ResourceTimeoutError, y as PartialFailureError } from "./import-helpers-DayvBD4T.js";
 import { a as setAwsClients, i as resetAwsClients, r as getAwsClients, t as AwsClients } from "./aws-clients-pjPwZz1r.js";
-import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-DhL8rX8u.js";
+import { $ as resolveStateBucketWithDefaultAndSource, A as TemplateParser, B as getDockerCmd, C as findActionableSilentDrops, D as applyRoleArnIfSet, E as cfnRefValueFromPhysicalId, F as AssetPublisher, G as Synthesizer, H as runDockerStreaming, I as stringifyValue, J as getLegacyStateBucketName, K as synthesisStatusMessage, L as WorkGraph, M as S3StateBackend, N as rebuildClientForBucketRegion, O as DiffCalculator, P as shouldRetainResource, Q as resolveStateBucketWithDefault, R as buildDockerImage, S as ProviderRegistry, T as IntrinsicFunctionResolver, U as AssetManifestLoader, V as runDockerForeground, W as getDockerImageBySourceHash, X as resolveCaptureObservedState, Y as resolveApp, Z as resolveSkipPrefix, _ as green, a as withRetry, at as uploadCfnTemplate, b as IAMRoleProvider, c as computeImplicitDeleteEdges, ct as resolveBucketRegion, d as isStatefulRecreateTargetSync, et as warnDeprecatedNoPrefixCliFlag, f as renderStatefulReason, g as gray, h as cyan, i as withResourceDeadline, it as findLargeInlineResources, j as LockManager, k as DagBuilder, l as extractDeploymentEventError, m as bold, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nt as CFN_TEMPLATE_URL_LIMIT, o as isRetryableTransientError, ot as AssemblyReader, p as formatResourceLine, q as getDefaultStateBucketName, r as DeployEngine, rt as MIGRATE_TMP_PREFIX, s as IMPLICIT_DELETE_DEPENDENCIES, t as DEFAULT_RESOURCE_TIMEOUT_MS, tt as CFN_TEMPLATE_BODY_LIMIT, u as MULTI_REGION_RECREATE_BLOCKED_TYPES, v as red, w as CloudControlProvider, x as collectInlinePolicyNamesManagedBySiblings, y as yellow, z as formatDockerLoginError } from "./deploy-engine-pdCBIFCK.js";
 import { t as ASGProvider } from "./asg-provider-Dgj3loIG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -1445,7 +1445,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.230.28";
+	return "0.230.29";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -55430,7 +55430,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.28");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.230.29");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());

package/dist/{deploy-engine-DhL8rX8u.js → deploy-engine-pdCBIFCK.js}

@@ -5203,48 +5203,126 @@ var ReplacementRulesRegistry = class {
 */
 const createOnlyPropertiesCache = /* @__PURE__ */ new Map();
 /**
-* Resolve the TOP-LEVEL create-only (immutable) property names for a resource
-* type.
+* Resolve the create-only (immutable) property PATHS for a resource type,
+* each as the segment array after `/properties/` (e.g.
+* `['Name']`, `['SourceParameters', 'KinesisStreamParameters',
+* 'StartingPosition']`).
+*
+* Full paths — not top-level reductions — because reducing a NESTED
+* createOnly entry to its top-level container over-approximates: for
+* `AWS::Pipes::Pipe`, `SourceParameters` itself is mutable and only
+* stream-source sub-paths under it are createOnly, so an SQS pipe's
+* `SourceParameters.SqsQueueParameters.BatchSize` change (CFn: "No
+* interruption") was mis-classified as a replacement (issue #960). The diff
+* consults {@link createOnlyChangeRequiresReplacement} to compare at the
+* schema's actual path granularity.
 *
 * Never throws: a DescribeType failure logs a warning and resolves to an empty
-* set (graceful fallback to the registry-only classification). Only SUCCESSFUL
+* list (graceful fallback to the registry-only classification). Only SUCCESSFUL
 * lookups are cached per resource type for the process lifetime; a failed
 * lookup is NOT cached, so a later call for the same type retries DescribeType
 * (a transient throttle must not poison the deploy's replacement detection).
 */
-function getTopLevelCreateOnlyProperties(resourceType) {
+function getCreateOnlyPropertyPaths(resourceType) {
 	const cached = createOnlyPropertiesCache.get(resourceType);
 	if (cached) return cached;
-	const entry = fetchTopLevelCreateOnlyProperties(resourceType).catch((error) => {
+	const entry = fetchCreateOnlyPropertyPaths(resourceType).catch((error) => {
 		createOnlyPropertiesCache.delete(resourceType);
 		const message = error instanceof Error ? error.message : String(error);
 		getLogger().child("CreateOnlyProperties").warn(`Failed to resolve create-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to the registry-only replacement classification for this resource — an immutable-property change may be mis-classified as an in-place update. Grant cloudformation:DescribeType to enable schema-driven replacement detection.`);
-		return /* @__PURE__ */ new Set();
+		return [];
 	});
 	createOnlyPropertiesCache.set(resourceType, entry);
 	return entry;
 }
 /**
-* Fetch + parse the type's create-only properties. THROWS on a DescribeType
-* failure — the caller ({@link getTopLevelCreateOnlyProperties}) catches,
-* warns, and declines to cache so the lookup can be retried later.
+* Decide whether a change to top-level property `topLevelKey` requires
+* replacement per the schema's createOnly paths.
+*
+* - A length-1 path (`['Name']`) marks the whole property createOnly — any
+*   change replaces (the pre-#960 behavior).
+* - A nested path (`['SourceParameters', ..., 'StartingPosition']`) replaces
+*   ONLY when the value AT that nested path differs between old and new —
+*   sibling sub-properties stay in-place-updatable, matching CloudFormation's
+*   per-path "Update requires: Replacement" annotations.
+* - A path that cannot be resolved against the values (an array or scalar
+*   where an object was expected, or a `*` wildcard segment) is treated
+*   conservatively as changed — replacement — since we cannot prove the
+*   immutable part stayed equal.
+*
+* Pure and synchronous so it is unit-testable without the DescribeType
+* plumbing; `valuesEqual` is injected by the diff calculator so nested
+* comparisons use the same equality as the top-level diff.
+*/
+function createOnlyChangeRequiresReplacement(createOnlyPaths, topLevelKey, oldValue, newValue, valuesEqual) {
+	for (const path of createOnlyPaths) {
+		if (path[0] !== topLevelKey) continue;
+		if (path.length === 1) return true;
+		const oldSub = valueAtPath(oldValue, path.slice(1));
+		const newSub = valueAtPath(newValue, path.slice(1));
+		if (!oldSub.resolved || !newSub.resolved) return true;
+		if (!valuesEqual(oldSub.value, newSub.value)) return true;
+	}
+	return false;
+}
+/**
+* Walk `value` along `segments` of plain-object keys.
+*
+* An absent container (`undefined` / `null`) RESOLVES to `undefined` — that
+* is the load-bearing case: an SQS pipe has no `DynamoDBStreamParameters`
+* subtree on either side, so its stream-source createOnly paths compare
+* `undefined === undefined` and do not force a replacement. Only shapes we
+* cannot meaningfully traverse (arrays / scalars where an object is
+* expected, `*` wildcard segments) report unresolved, which the caller
+* treats conservatively.
+*/
+function valueAtPath(value, segments) {
+	let current = value;
+	for (const segment of segments) {
+		if (segment === "*") return { resolved: false };
+		if (current === void 0 || current === null) return {
+			resolved: true,
+			value: void 0
+		};
+		if (typeof current !== "object" || Array.isArray(current)) return { resolved: false };
+		if (isIntrinsicShaped(current)) return { resolved: false };
+		current = current[segment];
+	}
+	return {
+		resolved: true,
+		value: current
+	};
+}
+/**
+* True for a single-key object whose key is `Ref` or `Fn::*` — the shape of
+* an unresolved CloudFormation intrinsic.
+*/
+function isIntrinsicShaped(value) {
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+/**
+* Fetch + parse the type's create-only property paths. THROWS on a
+* DescribeType failure — the caller ({@link getCreateOnlyPropertyPaths})
+* catches, warns, and declines to cache so the lookup can be retried later.
 */
-async function fetchTopLevelCreateOnlyProperties(resourceType) {
+async function fetchCreateOnlyPropertyPaths(resourceType) {
 	const logger = getLogger().child("CreateOnlyProperties");
 	const response = await getAwsClients().cloudFormation.send(new DescribeTypeCommand({
 		Type: "RESOURCE",
 		TypeName: resourceType
 	}));
-	const result = /* @__PURE__ */ new Set();
+	const result = [];
 	if (response.Schema) {
 		const createOnly = JSON.parse(response.Schema).createOnlyProperties;
 		if (Array.isArray(createOnly)) for (const path of createOnly) {
 			if (typeof path !== "string") continue;
-			const match = /^\/properties\/([^/]+)/.exec(path);
-			if (match?.[1]) result.add(unescapeJsonPointerSegment$1(match[1]));
+			if (!path.startsWith("/properties/")) continue;
+			const segments = path.slice(12).split("/").map(unescapeJsonPointerSegment$1).filter((segment) => segment.length > 0);
+			if (segments.length > 0) result.push(segments);
 		}
 	}
-	logger.debug(`Resolved ${result.size} top-level create-only properties for ${resourceType}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
+	logger.debug(`Resolved ${result.length} create-only property paths for ${resourceType}` + (result.length > 0 ? `: ${result.map((p) => p.join(".")).join(", ")}` : ""));
 	return result;
 }
 /**
@@ -5639,7 +5717,7 @@ var DiffCalculator = class DiffCalculator {
 		const allKeys = new Set([...Object.keys(currentProperties), ...Object.keys(desiredProperties)]);
 		const ignoredProperties = /* @__PURE__ */ new Set();
 		if (resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::")) ignoredProperties.add("Timestamp");
-		let createOnlyProps;
+		let createOnlyPaths;
 		for (const key of allKeys) {
 			if (ignoredProperties.has(key)) continue;
 			const oldValue = currentProperties[key];
@@ -5647,10 +5725,10 @@ var DiffCalculator = class DiffCalculator {
 			if (!this.valuesEqual(oldValue, newValue)) {
 				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue);
 				if (!requiresReplacement && !this.replacementRules.isClassified(resourceType, key)) {
-					if (createOnlyProps === void 0) createOnlyProps = await getTopLevelCreateOnlyProperties(resourceType);
-					if (createOnlyProps.has(key)) {
+					if (createOnlyPaths === void 0) createOnlyPaths = await getCreateOnlyPropertyPaths(resourceType);
+					if (createOnlyChangeRequiresReplacement(createOnlyPaths, key, oldValue, newValue, (a, b) => this.valuesEqual(a, b))) {
 						requiresReplacement = true;
-						this.logger.debug(`Property ${key} of ${resourceType} is createOnly per the CFn schema — requires replacement`);
+						this.logger.debug(`Property ${key} of ${resourceType} changed a createOnly path per the CFn schema — requires replacement`);
 					}
 				}
 				changes.push({
@@ -14287,4 +14365,4 @@ var DeployEngine = class {
 
 //#endregion
 export { resolveStateBucketWithDefaultAndSource as $, TemplateParser as A, getDockerCmd as B, findActionableSilentDrops as C, applyRoleArnIfSet as D, cfnRefValueFromPhysicalId as E, AssetPublisher as F, Synthesizer as G, runDockerStreaming as H, stringifyValue as I, getLegacyStateBucketName as J, synthesisStatusMessage as K, WorkGraph as L, S3StateBackend as M, rebuildClientForBucketRegion as N, DiffCalculator as O, shouldRetainResource as P, resolveStateBucketWithDefault as Q, buildDockerImage as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, AssetManifestLoader as U, runDockerForeground as V, getDockerImageBySourceHash as W, resolveCaptureObservedState as X, resolveApp as Y, resolveSkipPrefix as Z, green as _, withRetry as a, uploadCfnTemplate as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveBucketRegion as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, findLargeInlineResources as it, LockManager as j, DagBuilder as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_URL_LIMIT as nt, isRetryableTransientError as o, AssemblyReader as ot, formatResourceLine as p, getDefaultStateBucketName as q, DeployEngine as r, MIGRATE_TMP_PREFIX as rt, IMPLICIT_DELETE_DEPENDENCIES as s, clearBucketRegionCache as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CFN_TEMPLATE_BODY_LIMIT as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, formatDockerLoginError as z };
-//# sourceMappingURL=deploy-engine-DhL8rX8u.js.map
+//# sourceMappingURL=deploy-engine-pdCBIFCK.js.map