@go-to-k/cdkd 0.231.8 → 0.231.10

package/dist/{deploy-engine-D-51YceH.js → deploy-engine-CINi8mJy.js}

@@ -5337,6 +5337,31 @@ function unescapeJsonPointerSegment$1(segment) {
 //#endregion
 //#region src/analyzer/diff-calculator.ts
 /**
+* Per-type set of computed/derived read-only attributes whose value can change
+* as a side effect of an IN-PLACE update, even though the attribute NAME never
+* appears among the type's template properties (issue #985).
+*
+* The default in-place propagation arm matches a dependent only when the GetAtt
+* attribute NAME equals a template property that CHANGED on the upstream (e.g.
+* an SSM Parameter `Value`). That arm cannot see version-style attributes: an
+* `AWS::EC2::LaunchTemplate` edit changes `LaunchTemplateData`, which bumps the
+* read-only `LatestVersionNumber` from N to N+1 — but `LatestVersionNumber` is
+* NOT a template property, so a dependent reading `Fn::GetAtt[Lt,
+* LatestVersionNumber]` (the canonical `autoscaling.AutoScalingGroup`
+* `LaunchTemplate.Version` shape) is left NO_CHANGE and stays pinned one deploy
+* behind. These attributes resolve LIVE from AWS at deploy time (see the
+* `DescribeLaunchTemplates` special case in intrinsic-function-resolver.ts), so
+* a speculative promotion is safe: the deploy engine re-resolves the dependent
+* against the fresh live value and skips the provider call if it did not move.
+*
+* Keyed by upstream resource type -> the derived attribute names that any
+* in-place UPDATE of that type may move. Kept intentionally narrow (an allow
+* list, not "every read-only attr") so unrelated computed attributes that do
+* NOT track in-place edits (e.g. a Lambda `Arn`) never trigger spurious
+* dependent promotion.
+*/
+const IN_PLACE_UPDATE_DERIVED_ATTRS = Object.freeze({ "AWS::EC2::LaunchTemplate": new Set(["LatestVersionNumber", "DefaultVersionNumber"]) });
+/**
 * Diff calculator for comparing desired state (template) with current state
 */
 var DiffCalculator = class DiffCalculator {
@@ -5541,15 +5566,24 @@ var DiffCalculator = class DiffCalculator {
 	}
 	/**
 	* Promote NO_CHANGE dependents of an IN-PLACE update whose referenced ATTRIBUTE
-	* actually changed (bug-hunt 2026-06-29).
+	* either names a changed property (bug-hunt 2026-06-29) OR is a derived
+	* read-only attribute the update side-effects (issue #985).
 	*
 	* Distinct from {@link promoteReplacementDependents}: a replacement changes the
 	* physical id, so any reference is affected. An in-place update changes only
-	* specific properties, so a dependent is affected ONLY when it reads (via
-	* `Fn::GetAtt[Up, Attr]` or `Fn::Sub`'s `${Up.Attr}`) an attribute whose NAME
-	* matches a property that changed in `Up`'s update. (`Ref` resolves to the
-	* physical id, which an in-place update never moves, so Ref-only dependents are
-	* left NO_CHANGE; likewise a GetAtt of a computed / unchanged attribute.)
+	* specific properties, so a dependent is affected in one of two ways when it
+	* reads (via `Fn::GetAtt[Up, Attr]` or `Fn::Sub`'s `${Up.Attr}`) an attribute
+	* of an updated `Up`:
+	*   1. `Attr` NAMES a property that CHANGED in `Up`'s update (e.g. an SSM
+	*      Parameter `Value` embedded in a downstream `Fn::Sub`); or
+	*   2. `Attr` is a DERIVED read-only attribute of `Up`'s type that an in-place
+	*      update side-effects even though it is not a template property — the
+	*      per-type {@link IN_PLACE_UPDATE_DERIVED_ATTRS} allow list (issue #985;
+	*      e.g. `AWS::EC2::LaunchTemplate.LatestVersionNumber`, which an
+	*      `autoscaling.AutoScalingGroup` reads for its `LaunchTemplate.Version`).
+	* (`Ref` resolves to the physical id, which an in-place update never moves, so
+	* Ref-only dependents are left NO_CHANGE; likewise a GetAtt of a computed
+	* attribute NOT in the allow list, e.g. a Lambda `Arn` on a Description edit.)
 	*
 	* Promotion is safe even when speculative: the deploy engine re-resolves the
 	* promoted resource against the in-flight state and skips the provider call
@@ -5564,12 +5598,15 @@ var DiffCalculator = class DiffCalculator {
 	*/
 	promoteInPlaceAttributeDependents(changes, desiredTemplate, rawGetAttRefs) {
 		const changedPropsByUpstream = /* @__PURE__ */ new Map();
+		const inPlaceUpdateTypeByUpstream = /* @__PURE__ */ new Map();
 		for (const [logicalId, change] of changes) {
 			if (change.changeType !== "UPDATE") continue;
-			const props = (change.propertyChanges ?? []).map((pc) => pc.path).filter((p) => typeof p === "string");
+			const propertyChanges = change.propertyChanges ?? [];
+			if (!propertyChanges.some((pc) => pc.requiresReplacement)) inPlaceUpdateTypeByUpstream.set(logicalId, change.resourceType);
+			const props = propertyChanges.map((pc) => pc.path).filter((p) => typeof p === "string");
 			if (props.length > 0) changedPropsByUpstream.set(logicalId, new Set(props));
 		}
-		if (changedPropsByUpstream.size === 0) return;
+		if (changedPropsByUpstream.size === 0 && inPlaceUpdateTypeByUpstream.size === 0) return;
 		for (const [dependentId, perProp] of rawGetAttRefs) {
 			const resource = desiredTemplate.Resources[dependentId];
 			if (!resource || resource.Type === "AWS::CDK::Metadata") continue;
@@ -5584,8 +5621,13 @@ var DiffCalculator = class DiffCalculator {
 				for (const [upstreamId, attrs] of getAttRefs) {
 					if (upstreamId === dependentId) continue;
 					const changedProps = changedPropsByUpstream.get(upstreamId);
-					if (!changedProps) continue;
-					if ([...attrs].some((attr) => changedProps.has(attr))) {
+					if (changedProps && [...attrs].some((attr) => changedProps.has(attr))) {
+						matched = true;
+						break;
+					}
+					const upstreamType = inPlaceUpdateTypeByUpstream.get(upstreamId);
+					const derivedAttrs = upstreamType ? IN_PLACE_UPDATE_DERIVED_ATTRS[upstreamType] : void 0;
+					if (derivedAttrs && [...attrs].some((attr) => derivedAttrs.has(attr))) {
 						matched = true;
 						break;
 					}
@@ -8971,11 +9013,71 @@ var CloudControlProvider = class {
 					this.logger.debug(`Failed to enrich OpenSearch Domain ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
 				}
 				break;
+			case "AWS::Backup::BackupVault":
+				if (!enriched["BackupVaultArn"]) {
+					const model = await this.readBackupResourceModel(resourceType, physicalId);
+					if (model) {
+						if (typeof model["BackupVaultArn"] === "string") enriched["BackupVaultArn"] = model["BackupVaultArn"];
+						if (!enriched["BackupVaultName"] && typeof model["BackupVaultName"] === "string") enriched["BackupVaultName"] = model["BackupVaultName"];
+						this.logger.debug(`Enriched Backup BackupVault ${physicalId} with BackupVaultArn from CC GetResource`);
+					}
+				}
+				if (!enriched["BackupVaultName"]) enriched["BackupVaultName"] = physicalId;
+				break;
+			case "AWS::Backup::BackupPlan":
+				if (!enriched["BackupPlanArn"] || !enriched["VersionId"]) {
+					const model = await this.readBackupResourceModel(resourceType, physicalId);
+					if (model) {
+						if (!enriched["BackupPlanArn"] && typeof model["BackupPlanArn"] === "string") enriched["BackupPlanArn"] = model["BackupPlanArn"];
+						if (!enriched["VersionId"] && typeof model["VersionId"] === "string") enriched["VersionId"] = model["VersionId"];
+						if (!enriched["BackupPlanId"] && typeof model["BackupPlanId"] === "string") enriched["BackupPlanId"] = model["BackupPlanId"];
+						this.logger.debug(`Enriched Backup BackupPlan ${physicalId} with BackupPlanArn/VersionId from CC GetResource`);
+					}
+				}
+				if (!enriched["BackupPlanId"]) enriched["BackupPlanId"] = physicalId;
+				break;
+			case "AWS::Backup::BackupSelection":
+				if (!enriched["SelectionId"] || !enriched["BackupPlanId"]) {
+					const compoundSegments = physicalId.split("|");
+					if (compoundSegments.length >= 2) {
+						if (!enriched["SelectionId"]) enriched["SelectionId"] = compoundSegments[0];
+						if (!enriched["BackupPlanId"]) enriched["BackupPlanId"] = compoundSegments[1];
+					}
+					const model = await this.readBackupResourceModel(resourceType, physicalId);
+					if (model) {
+						if (typeof model["SelectionId"] === "string") enriched["SelectionId"] = model["SelectionId"];
+						if (typeof model["BackupPlanId"] === "string") enriched["BackupPlanId"] = model["BackupPlanId"];
+						this.logger.debug(`Enriched Backup BackupSelection ${physicalId} with SelectionId from CC GetResource`);
+					}
+				}
+				break;
 			default: break;
 		}
 		return enriched;
 	}
 	/**
+	* Read the Cloud Control GetResource model for a pure-CC Backup resource and
+	* return its parsed property map, or `undefined` on any failure. Backup types
+	* have no SDK provider, so this generic CC read-back is the cleanest source
+	* of their readOnly attributes (ARNs, VersionId, SelectionId) that the sparse
+	* CREATE ResourceModel does not reliably surface. Best-effort: never throws.
+	*/
+	async readBackupResourceModel(resourceType, physicalId) {
+		try {
+			const raw = (await this.cloudControlClient.send(new GetResourceCommand({
+				TypeName: resourceType,
+				Identifier: physicalId
+			}))).ResourceDescription?.Properties;
+			if (typeof raw !== "string" || raw.length === 0) return;
+			const parsed = JSON.parse(raw);
+			if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return;
+			return parsed;
+		} catch (error) {
+			this.logger.debug(`Failed to read CC model for ${resourceType} ${physicalId}: ${error instanceof Error ? error.message : String(error)}`);
+			return;
+		}
+	}
+	/**
 	* Handle errors and throw ProvisioningError
 	*/
 	handleError(error, operation, resourceType, logicalId, physicalId) {
@@ -14895,4 +14997,4 @@ var DeployEngine = class {
 
 //#endregion
 export { resolveSkipPrefix as $, DiffCalculator as A, buildDockerImage as B, findActionableSilentDrops as C, refStateLookupFromResource as D, cfnRefValueFromPhysicalId as E, rebuildClientForBucketRegion as F, AssetManifestLoader as G, getDockerCmd as H, shouldRetainResource as I, synthesisStatusMessage as J, getDockerImageBySourceHash as K, AssetPublisher as L, TemplateParser as M, LockManager as N, WAFv2WebACLProvider as O, S3StateBackend as P, resolveCaptureObservedState as Q, stringifyValue as R, ProviderRegistry as S, IntrinsicFunctionResolver as T, runDockerForeground as U, formatDockerLoginError as V, runDockerStreaming as W, getLegacyStateBucketName as X, getDefaultStateBucketName as Y, resolveApp as Z, green as _, withRetry as a, MIGRATE_TMP_PREFIX as at, IAMRoleProvider as b, computeImplicitDeleteEdges as c, AssemblyReader as ct, isStatefulRecreateTargetSync as d, resolveStateBucketWithDefault as et, renderStatefulReason as f, gray as g, cyan as h, withResourceDeadline as i, CFN_TEMPLATE_URL_LIMIT as it, DagBuilder as j, applyRoleArnIfSet as k, extractDeploymentEventError as l, clearBucketRegionCache as lt, bold as m, DEFAULT_RESOURCE_WARN_AFTER_MS as n, warnDeprecatedNoPrefixCliFlag as nt, isRetryableTransientError as o, findLargeInlineResources as ot, formatResourceLine as p, Synthesizer as q, DeployEngine as r, CFN_TEMPLATE_BODY_LIMIT as rt, IMPLICIT_DELETE_DEPENDENCIES as s, uploadCfnTemplate as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, resolveStateBucketWithDefaultAndSource as tt, MULTI_REGION_RECREATE_BLOCKED_TYPES as u, resolveBucketRegion as ut, red as v, CloudControlProvider as w, collectInlinePolicyNamesManagedBySiblings as x, yellow as y, WorkGraph as z };
-//# sourceMappingURL=deploy-engine-D-51YceH.js.map
+//# sourceMappingURL=deploy-engine-CINi8mJy.js.map