@go-to-k/cdkd 0.230.28 → 0.230.30

package/dist/{deploy-engine-DhL8rX8u.js → deploy-engine-ByCHAN3p.js}

@@ -5203,48 +5203,126 @@ var ReplacementRulesRegistry = class {
 */
 const createOnlyPropertiesCache = /* @__PURE__ */ new Map();
 /**
-* Resolve the TOP-LEVEL create-only (immutable) property names for a resource
-* type.
+* Resolve the create-only (immutable) property PATHS for a resource type,
+* each as the segment array after `/properties/` (e.g.
+* `['Name']`, `['SourceParameters', 'KinesisStreamParameters',
+* 'StartingPosition']`).
+*
+* Full paths — not top-level reductions — because reducing a NESTED
+* createOnly entry to its top-level container over-approximates: for
+* `AWS::Pipes::Pipe`, `SourceParameters` itself is mutable and only
+* stream-source sub-paths under it are createOnly, so an SQS pipe's
+* `SourceParameters.SqsQueueParameters.BatchSize` change (CFn: "No
+* interruption") was mis-classified as a replacement (issue #960). The diff
+* consults {@link createOnlyChangeRequiresReplacement} to compare at the
+* schema's actual path granularity.
 *
 * Never throws: a DescribeType failure logs a warning and resolves to an empty
-* set (graceful fallback to the registry-only classification). Only SUCCESSFUL
+* list (graceful fallback to the registry-only classification). Only SUCCESSFUL
 * lookups are cached per resource type for the process lifetime; a failed
 * lookup is NOT cached, so a later call for the same type retries DescribeType
 * (a transient throttle must not poison the deploy's replacement detection).
 */
-function getTopLevelCreateOnlyProperties(resourceType) {
+function getCreateOnlyPropertyPaths(resourceType) {
 	const cached = createOnlyPropertiesCache.get(resourceType);
 	if (cached) return cached;
-	const entry = fetchTopLevelCreateOnlyProperties(resourceType).catch((error) => {
+	const entry = fetchCreateOnlyPropertyPaths(resourceType).catch((error) => {
 		createOnlyPropertiesCache.delete(resourceType);
 		const message = error instanceof Error ? error.message : String(error);
 		getLogger().child("CreateOnlyProperties").warn(`Failed to resolve create-only properties for ${resourceType} via cloudformation:DescribeType (${message}). Falling back to the registry-only replacement classification for this resource — an immutable-property change may be mis-classified as an in-place update. Grant cloudformation:DescribeType to enable schema-driven replacement detection.`);
-		return /* @__PURE__ */ new Set();
+		return [];
 	});
 	createOnlyPropertiesCache.set(resourceType, entry);
 	return entry;
 }
 /**
-* Fetch + parse the type's create-only properties. THROWS on a DescribeType
-* failure — the caller ({@link getTopLevelCreateOnlyProperties}) catches,
-* warns, and declines to cache so the lookup can be retried later.
+* Decide whether a change to top-level property `topLevelKey` requires
+* replacement per the schema's createOnly paths.
+*
+* - A length-1 path (`['Name']`) marks the whole property createOnly — any
+*   change replaces (the pre-#960 behavior).
+* - A nested path (`['SourceParameters', ..., 'StartingPosition']`) replaces
+*   ONLY when the value AT that nested path differs between old and new —
+*   sibling sub-properties stay in-place-updatable, matching CloudFormation's
+*   per-path "Update requires: Replacement" annotations.
+* - A path that cannot be resolved against the values (an array or scalar
+*   where an object was expected, or a `*` wildcard segment) is treated
+*   conservatively as changed — replacement — since we cannot prove the
+*   immutable part stayed equal.
+*
+* Pure and synchronous so it is unit-testable without the DescribeType
+* plumbing; `valuesEqual` is injected by the diff calculator so nested
+* comparisons use the same equality as the top-level diff.
+*/
+function createOnlyChangeRequiresReplacement(createOnlyPaths, topLevelKey, oldValue, newValue, valuesEqual) {
+	for (const path of createOnlyPaths) {
+		if (path[0] !== topLevelKey) continue;
+		if (path.length === 1) return true;
+		const oldSub = valueAtPath(oldValue, path.slice(1));
+		const newSub = valueAtPath(newValue, path.slice(1));
+		if (!oldSub.resolved || !newSub.resolved) return true;
+		if (!valuesEqual(oldSub.value, newSub.value)) return true;
+	}
+	return false;
+}
+/**
+* Walk `value` along `segments` of plain-object keys.
+*
+* An absent container (`undefined` / `null`) RESOLVES to `undefined` — that
+* is the load-bearing case: an SQS pipe has no `DynamoDBStreamParameters`
+* subtree on either side, so its stream-source createOnly paths compare
+* `undefined === undefined` and do not force a replacement. Only shapes we
+* cannot meaningfully traverse (arrays / scalars where an object is
+* expected, `*` wildcard segments) report unresolved, which the caller
+* treats conservatively.
+*/
+function valueAtPath(value, segments) {
+	let current = value;
+	for (const segment of segments) {
+		if (segment === "*") return { resolved: false };
+		if (current === void 0 || current === null) return {
+			resolved: true,
+			value: void 0
+		};
+		if (typeof current !== "object" || Array.isArray(current)) return { resolved: false };
+		if (isIntrinsicShaped(current)) return { resolved: false };
+		current = current[segment];
+	}
+	return {
+		resolved: true,
+		value: current
+	};
+}
+/**
+* True for a single-key object whose key is `Ref` or `Fn::*` — the shape of
+* an unresolved CloudFormation intrinsic.
+*/
+function isIntrinsicShaped(value) {
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+/**
+* Fetch + parse the type's create-only property paths. THROWS on a
+* DescribeType failure — the caller ({@link getCreateOnlyPropertyPaths})
+* catches, warns, and declines to cache so the lookup can be retried later.
 */
-async function fetchTopLevelCreateOnlyProperties(resourceType) {
+async function fetchCreateOnlyPropertyPaths(resourceType) {
 	const logger = getLogger().child("CreateOnlyProperties");
 	const response = await getAwsClients().cloudFormation.send(new DescribeTypeCommand({
 		Type: "RESOURCE",
 		TypeName: resourceType
 	}));
-	const result = /* @__PURE__ */ new Set();
+	const result = [];
 	if (response.Schema) {
 		const createOnly = JSON.parse(response.Schema).createOnlyProperties;
 		if (Array.isArray(createOnly)) for (const path of createOnly) {
 			if (typeof path !== "string") continue;
-			const match = /^\/properties\/([^/]+)/.exec(path);
-			if (match?.[1]) result.add(unescapeJsonPointerSegment$1(match[1]));
+			if (!path.startsWith("/properties/")) continue;
+			const segments = path.slice(12).split("/").map(unescapeJsonPointerSegment$1).filter((segment) => segment.length > 0);
+			if (segments.length > 0) result.push(segments);
 		}
 	}
-	logger.debug(`Resolved ${result.size} top-level create-only properties for ${resourceType}` + (result.size > 0 ? `: ${[...result].join(", ")}` : ""));
+	logger.debug(`Resolved ${result.length} create-only property paths for ${resourceType}` + (result.length > 0 ? `: ${result.map((p) => p.join(".")).join(", ")}` : ""));
 	return result;
 }
 /**
@@ -5639,7 +5717,7 @@ var DiffCalculator = class DiffCalculator {
 		const allKeys = new Set([...Object.keys(currentProperties), ...Object.keys(desiredProperties)]);
 		const ignoredProperties = /* @__PURE__ */ new Set();
 		if (resourceType === "AWS::CloudFormation::CustomResource" || resourceType.startsWith("Custom::")) ignoredProperties.add("Timestamp");
-		let createOnlyProps;
+		let createOnlyPaths;
 		for (const key of allKeys) {
 			if (ignoredProperties.has(key)) continue;
 			const oldValue = currentProperties[key];
@@ -5647,10 +5725,10 @@ var DiffCalculator = class DiffCalculator {
 			if (!this.valuesEqual(oldValue, newValue)) {
 				let requiresReplacement = this.replacementRules.requiresReplacement(resourceType, key, oldValue, newValue);
 				if (!requiresReplacement && !this.replacementRules.isClassified(resourceType, key)) {
-					if (createOnlyProps === void 0) createOnlyProps = await getTopLevelCreateOnlyProperties(resourceType);
-					if (createOnlyProps.has(key)) {
+					if (createOnlyPaths === void 0) createOnlyPaths = await getCreateOnlyPropertyPaths(resourceType);
+					if (createOnlyChangeRequiresReplacement(createOnlyPaths, key, oldValue, newValue, (a, b) => this.valuesEqual(a, b))) {
 						requiresReplacement = true;
-						this.logger.debug(`Property ${key} of ${resourceType} is createOnly per the CFn schema — requires replacement`);
+						this.logger.debug(`Property ${key} of ${resourceType} changed a createOnly path per the CFn schema — requires replacement`);
 					}
 				}
 				changes.push({
@@ -7729,7 +7807,6 @@ const NON_PROVISIONABLE_TYPES = new Set([
 	"AWS::CloudFormation::WaitConditionHandle",
 	"AWS::CloudFront::StreamingDistribution",
 	"AWS::CloudWatch::AnomalyDetector",
-	"AWS::CloudWatch::InsightRule",
 	"AWS::CodeBuild::ReportGroup",
 	"AWS::CodeBuild::SourceCredential",
 	"AWS::CodeCommit::Repository",
@@ -7737,7 +7814,6 @@ const NON_PROVISIONABLE_TYPES = new Set([
 	"AWS::Config::ConfigurationRecorder",
 	"AWS::Config::DeliveryChannel",
 	"AWS::Config::OrganizationConfigRule",
-	"AWS::Config::RemediationConfiguration",
 	"AWS::DAX::Cluster",
 	"AWS::DAX::ParameterGroup",
 	"AWS::DAX::SubnetGroup",
@@ -7770,7 +7846,6 @@ const NON_PROVISIONABLE_TYPES = new Set([
 	"AWS::FSx::Volume",
 	"AWS::Glue::Classifier",
 	"AWS::Glue::CustomEntityType",
-	"AWS::Glue::DataCatalogEncryptionSettings",
 	"AWS::Glue::DataQualityRuleset",
 	"AWS::Glue::DevEndpoint",
 	"AWS::Glue::MLTransform",
@@ -7792,7 +7867,6 @@ const NON_PROVISIONABLE_TYPES = new Set([
 	"AWS::Greengrass::ResourceDefinitionVersion",
 	"AWS::Greengrass::SubscriptionDefinition",
 	"AWS::Greengrass::SubscriptionDefinitionVersion",
-	"AWS::GuardDuty::ThreatEntitySet",
 	"AWS::IAM::AccessKey",
 	"AWS::IoT::PolicyPrincipalAttachment",
 	"AWS::IoT::ThingPrincipalAttachment",
@@ -7852,6 +7926,7 @@ const NON_PROVISIONABLE_TYPES = new Set([
 	"AWS::Route53::RecordSetGroup",
 	"AWS::SageMaker::CodeRepository",
 	"AWS::SageMaker::EndpointConfig",
+	"AWS::SageMaker::ModelCardExportJob",
 	"AWS::SageMaker::NotebookInstance",
 	"AWS::SageMaker::NotebookInstanceLifecycleConfig",
 	"AWS::SageMaker::Workteam",
@@ -10997,6 +11072,22 @@ const PROPERTY_COVERAGE_BY_TYPE = new Map([
 		]),
 		silentDrop: /* @__PURE__ */ new Map()
 	}],
+	["AWS::Scheduler::Schedule", {
+		handled: new Set([
+			"Description",
+			"EndDate",
+			"FlexibleTimeWindow",
+			"GroupName",
+			"KmsKeyArn",
+			"Name",
+			"ScheduleExpression",
+			"ScheduleExpressionTimezone",
+			"StartDate",
+			"State",
+			"Target"
+		]),
+		silentDrop: /* @__PURE__ */ new Map()
+	}],
 	["AWS::SecretsManager::Secret", {
 		handled: new Set([
 			"Description",
@@ -11250,6 +11341,28 @@ function findActionableSilentDrops(resourceType, templateProperties, allowedKeys
 * Tier 1 types whose SDK Provider declares `handledProperties` and where
 * Cloud Control is guaranteed to be a viable alternative.
 */
+/**
+* Types exempt from the sticky `provisionedBy: 'cc-api'` routing rule.
+*
+* The sticky rule exists to avoid physical-ID churn when an SDK provider is
+* backfilled for a type Cloud Control was already managing fine. These types
+* are different: their CLOUD CONTROL ROUTING IS BROKEN, so keeping existing
+* state pinned to cc-api would keep the bug alive for every pre-existing
+* resource. Only add a type here when BOTH hold:
+*
+* 1. the CC handler cannot correctly manage the resource (not a perf choice),
+* 2. the SDK provider uses the SAME physicalId the CC path stored, so the
+*    re-route is churn-free and the record flips to `provisionedBy: 'sdk'`
+*    transparently on its next state write.
+*
+* - AWS::Scheduler::Schedule (issue #961): a schedule in a custom
+*   ScheduleGroup is unaddressable via CC (the handlers resolve the bare-Name
+*   identifier against the DEFAULT group) — CC UPDATE fails NotFound and CC
+*   DELETE silently no-ops, orphaning a live schedule. Both paths stored the
+*   bare schedule name as physicalId, and the state properties carry
+*   GroupName, so the SDK provider addresses existing records correctly.
+*/
+const STICKY_CC_MIGRATION_EXEMPT = new Set(["AWS::Scheduler::Schedule"]);
 var ProviderRegistry = class {
 	logger = getLogger().child("ProviderRegistry");
 	providers = /* @__PURE__ */ new Map();
@@ -11344,7 +11457,7 @@ var ProviderRegistry = class {
 				provisionedBy: "sdk"
 			};
 		}
-		if (provisionedBy === "cc-api") {
+		if (provisionedBy === "cc-api" && !STICKY_CC_MIGRATION_EXEMPT.has(resourceType)) {
 			this.logger.debug(`Routing ${resourceType} via Cloud Control (state-recorded provisionedBy=cc-api)`);
 			return {
 				provider: this.cloudControlProvider,
@@ -14287,4 +14400,4 @@ var DeployEngine = class {
 
 //#endregion
 export { resolveStateBucketWithDefaultAndSource as $, TemplateParser as A, getDockerCmd as B, findActionableSilentDrops as C, applyRoleArnIfSet as D, cfnRefValueFromPhysicalId as E, AssetPublisher as F, Synthesizer as G, runDockerStreaming as H, stringifyValue as I, getLegacyStateBucketName as J, synthesisStatusMessage as K, WorkGraph as L, S3StateBackend as M, rebuildClientForBucketRegion as N, DiffCalculator as O, shouldRetainResource as P, resolveStateBucketWithDefault as Q, buildDockerImage as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, AssetManifestLoader as U, runDockerForeground as V, getDockerImageBySourceHash as W, resolveCaptureObservedState as X, resolveApp as Y, resolveSkipPrefix as Z, green as _, withRetry as a, uploadCfnTemplate as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, resolveBucketRegion as ct, isStatefulRecreateTargetSync as d, warnDeprecatedNoPrefixCliFlag as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, findLargeInlineResources as it, LockManager as j, DagBuilder as k, extractDeploymentEventError as l, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, CFN_TEMPLATE_URL_LIMIT as nt, isRetryableTransientError as o, AssemblyReader as ot, formatResourceLine as p, getDefaultStateBucketName as q, DeployEngine as r, MIGRATE_TMP_PREFIX as rt, IMPLICIT_DELETE_DEPENDENCIES as s, clearBucketRegionCache as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, CFN_TEMPLATE_BODY_LIMIT as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, formatDockerLoginError as z };
-//# sourceMappingURL=deploy-engine-DhL8rX8u.js.map
+//# sourceMappingURL=deploy-engine-ByCHAN3p.js.map