@go-to-k/cdkd 0.280.26 → 0.280.28

package/dist/{deploy-engine-Sb8KbTlA.js → deploy-engine-Dkep5i7x.js}

@@ -7985,9 +7985,43 @@ function isIamPropagationError(message) {
 * and the rollback executor's reverse-replacement) — everywhere else it is a
 * genuine conflict that must fail fast. Shared by those sites' collision
 * detection + retry filters so a signature extension lands in one place.
+*
+* The optional `s` is load-bearing, not defensive spelling (issue #1625):
+* Lambda's `CreateFunction` raises `ResourceConflictException: Function
+* already exist: <name>` — SINGULAR — so the `already exists` form missed it
+* entirely and NO Lambda function could take the collision path. The
+* consequence was not a cosmetic message: a property-driven replacement of a
+* Lambda (dropping `DurableConfig`, changing `TenancyConfig`) create-firsts
+* into its own still-live name, the raw `ResourceConflictException` escaped
+* instead of the actionable `NAMED_REPLACEMENT_COLLISION` error, and
+* `cdkd deploy --replace`'s delete-first fallback never fired — so the
+* replacement was unperformable by any flag. Verified against real AWS
+* (us-east-1, 2026-08-12) by creating one function name twice.
+*
+* Two fences keep the widened arm from crediting a NON-collision, which
+* matters because the sites that consult it react DESTRUCTIVELY (the
+* `--replace` delete-first fallback deletes the old resource):
+*  - `\b` after `exists?` rejects a participle ("already existed as a draft");
+*  - the lookbehind rejects a NEGATED or MODAL phrase — "the bucket does NOT
+*    already exist", "the destination bucket MUST already exist" — which the
+*    bare pattern matched. The modal form is the one that bites: a create
+*    rejected for a missing PREREQUISITE would be reported to the user as a
+*    name collision pointing at `--replace`, and following that advice
+*    deletes the live old resource before the re-create fails again for the
+*    same reason, leaving it absent from AWS with state still recording it.
+* The error-CODE arm stays exact (`AlreadyExists`): the singular
+* `AlreadyExist` is not an AWS code spelling, and loosening it would match
+* inside unrelated identifiers.
+*
+* Classification stays MESSAGE-based rather than moving to the exception
+* NAME, and that is load-bearing here rather than inherited: Lambda raises
+* `ResourceConflictException` for a function in a PENDING state too (see
+* `lambda-function-provider.ts`), so keying on the name would classify a
+* transient state conflict as a collision and delete a live function under
+* `--replace`.
 */
 function isNameCollisionError(message) {
-	return /already exists/i.test(message) || message.includes("AlreadyExists");
+	return /(?<!\b(?:must|not|should|may|cannot)\s)already exists?\b/i.test(message) || message.includes("AlreadyExists");
 }
 /**
 * Match the SQS same-name re-creation cooldown: after `DeleteQueue`, creating
@@ -12836,7 +12870,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BJsjMRaA.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-C3rBE_Ni.js").then((n) => n.n);
 			await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 			return;
 		}
@@ -16440,6 +16474,111 @@ function findActionableSilentDrops(resourceType, templateProperties, allowedKeys
 	return drops.filter(({ property }) => !allowedKeys.has(`${resourceType}:${property}`));
 }
 
+//#endregion
+//#region src/provisioning/mutually-exclusive-properties.ts
+/**
+* The rule table, keyed by CFn resource type.
+*
+* Deliberately seeded with the ONE combination this repo has verified end to
+* end (`AWS::EC2::Route`, refused by `EC2Provider.createRoute` since #1566 and
+* normalized on both diff sides since #1591). The mechanism is general; the
+* data is not speculative. See "Adding a rule" above.
+*/
+const MUTUALLY_EXCLUSIVE_PROPERTIES = /* @__PURE__ */ new Map([["AWS::EC2::Route", [{
+	properties: [
+		"DestinationCidrBlock",
+		"DestinationIpv6CidrBlock",
+		"DestinationPrefixListId"
+	],
+	rationale: "CloudFormation and the EC2 CreateRoute API accept exactly one destination per route.",
+	firstDeclaredWins: true
+}]]]);
+/**
+* True for a single-key object whose key is `Ref` or `Fn::*` — the shape of an
+* unresolved CloudFormation intrinsic. Mirrors `isIntrinsicShaped` in
+* {@link ./create-only-properties}; kept local because the two modules answer
+* different questions about the shape and should not drift into one another's
+* behavior by accident.
+*/
+function isUnresolvedIntrinsic(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	return keys.length === 1 && (keys[0] === "Ref" || keys[0].startsWith("Fn::"));
+}
+/**
+* True when `value` is unconditionally present in the template.
+*
+* The predicate is `Boolean`, not a hand-listed `undefined | null | ''` set,
+* matching `narrowRouteDestinations`' truthiness narrowing in
+* `ec2-provider.ts`: the property bag is `unknown`-valued at runtime, so an
+* unquoted YAML `0` must be skipped here exactly as the provider's `||` chain
+* skips it — otherwise pre-flight refuses a template the provider would have
+* accepted. An unresolved intrinsic is truthy but its resolved presence is
+* NOT yet known, so it is excluded ahead of the truthiness test.
+*/
+function isDeclared(value) {
+	if (isUnresolvedIntrinsic(value)) return false;
+	return Boolean(value);
+}
+/**
+* Find every mutually-exclusive rule this resource violates.
+*
+* Returns `[]` for a type with no rules, an absent property bag, and any
+* combination that is only reached through an unresolved intrinsic.
+*/
+function findMutuallyExclusiveViolations(resourceType, templateProperties) {
+	if (!templateProperties) return [];
+	const rules = MUTUALLY_EXCLUSIVE_PROPERTIES.get(resourceType);
+	if (!rules) return [];
+	return findViolationsForRules(resourceType, rules, templateProperties);
+}
+/**
+* The table-free core of {@link findMutuallyExclusiveViolations}, taking the
+* rules explicitly.
+*
+* Exported so the multi-rule and multi-violation paths are reachable from
+* tests: the shipped table has a single type with a single rule, so those
+* branches would otherwise be dead code that no assertion can exercise.
+*/
+function findViolationsForRules(resourceType, rules, templateProperties) {
+	const violations = [];
+	for (const rule of rules) {
+		const declared = rule.properties.filter((property) => isDeclared(templateProperties[property]));
+		if (declared.length <= 1) continue;
+		const winnerCertain = !rule.properties.slice(0, rule.properties.indexOf(declared[0])).some((property) => isUnresolvedIntrinsic(templateProperties[property]));
+		violations.push({
+			resourceType,
+			rule,
+			declared,
+			winnerCertain
+		});
+	}
+	return violations;
+}
+/**
+* Render one violation as a per-resource error line.
+*
+* For a `firstDeclaredWins` rule the message names the key that would actually
+* be SENT, which is what makes the remedy actionable.
+*
+* It deliberately stops short of promising the deployed resource is unaffected.
+* Pre-flight has no state, so it cannot know which destination the LIVE
+* resource was created from: for a route deployed with only
+* `DestinationIpv6CidrBlock` whose template later GAINS
+* `DestinationCidrBlock`, deleting the IPv6 key makes the CIDR key the sole
+* destination — a create-only change that REPLACES the route. Saying "removing
+* the others leaves the resource unchanged" would be false exactly there.
+*
+* The sentence is omitted entirely when
+* {@link MutuallyExclusiveViolation.winnerCertain} is false — naming a winner
+* the raw template does not determine would be a confident falsehood.
+*/
+function buildMutuallyExclusiveMessage(logicalId, violation) {
+	const { resourceType, rule, declared, winnerCertain } = violation;
+	const winnerNote = rule.firstDeclaredWins && winnerCertain ? ` cdkd would send only ${declared[0]}; ${declared.slice(1).join(" / ")} would be dropped. Deleting the dropped keys changes nothing cdkd sends — but if the LIVE resource was created from one of them, making ${declared[0]} the sole value is a create-only change that REPLACES it.` : "";
+	return `  - ${logicalId} (${resourceType}) declares ${declared.join(" and ")}\n      ${rule.rationale}${winnerNote}\n      Declare at most one of: ${rule.properties.join(" / ")}`;
+}
+
 //#endregion
 //#region src/provisioning/provider-registry.ts
 /**
@@ -16738,11 +16877,41 @@ var ProviderRegistry = class {
 	* the property check is a no-op (`findSilentDropProperties` returns `[]`
 	* for non-Tier-1 / unknown types).
 	*
+	* Since issue [#1634](https://github.com/go-to-k/cdkd/issues/1634) this
+	* ALSO runs the mutually-exclusive-property check
+	* ({@link validateMutuallyExclusiveProperties}), which throws BEFORE any
+	* routing decision is logged — a template CloudFormation itself rejects
+	* should not first produce a page of routing chatter.
+	*
 	* @see findAutoRouteHits for the pure-functional pre-deploy plan-builder
 	*      that returns the same information without logging.
 	*/
 	validateResourceProperties(resources) {
-		this.reportSilentDropDecisions(resources);
+		const materialized = [...resources];
+		this.validateMutuallyExclusiveProperties(materialized);
+		this.reportSilentDropDecisions(materialized);
+	}
+	/**
+	* Reject a template that declares two or more MUTUALLY EXCLUSIVE top-level
+	* properties on one resource (issue
+	* [#1634](https://github.com/go-to-k/cdkd/issues/1634)).
+	*
+	* Aggregated into ONE error listing every offending resource, mirroring
+	* {@link validateResourceTypes} — a template with three bad routes should
+	* report three, not fail three deploys in a row. There is deliberately no
+	* `--allow-*` escape hatch: the combination is invalid at CloudFormation and
+	* at the service API, so the only correct outcome is a template edit (see
+	* the rule module's header).
+	*
+	* Unlike the provider-side refusal this fires even when the resource already
+	* exists and the deploy diff classifies NO_CHANGE, which is the gap the
+	* issue was filed for.
+	*/
+	validateMutuallyExclusiveProperties(resources) {
+		const lines = [];
+		for (const { logicalId, resourceType, properties } of resources) for (const violation of findMutuallyExclusiveViolations(resourceType, properties)) lines.push(buildMutuallyExclusiveMessage(logicalId, violation));
+		if (lines.length === 0) return;
+		throw new Error(`The following resources declare mutually exclusive properties:\n` + lines.join("\n") + "\n\nCloudFormation rejects these combinations too — edit the template to declare only one of each set.");
 	}
 	/**
 	* Info-log every silent-drop routing decision (auto-route via CC API) and
@@ -19352,7 +19521,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.280.26";
+	return "0.280.28";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -21485,4 +21654,4 @@ var DeployEngine = class {
 
 //#endregion
 export { requireConfigObject as $, AssemblyReader as $t, green as A, __exportAll as An, runDockerForeground as At, disableInstanceApiTermination as B, resolveCaptureObservedState as Bt, MULTI_REGION_RECREATE_BLOCKED_TYPES as C, StackTerminationProtectionError as Cn, getBootstrapMarkerKey as Ct, bold as D, isCdkdError as Dn, buildDockerImage as Dt, formatResourceLine as E, formatError as En, validateContainerRepoName as Et, clearOnUpdateRemoval as F, synthesisStatusMessage as Ft, WAFv2WebACLProvider as G, stateBucketExistenceConfirmed as Gt, IntrinsicFunctionResolver as H, resolveStateBucketWithDefault as Ht, ProviderRegistry as I, getDefaultStateBucketName as It, assertRegionMatch as J, CFN_TEMPLATE_URL_LIMIT as Jt, normalizeAwsTagsToCfn as K, warnDeprecatedNoPrefixCliFlag as Kt, findActionableSilentDrops as L, getLegacyStateBucketName as Lt, yellow as M, AssetManifestLoader as Mt, IAMRoleProvider as N, getDockerImageBySourceHash as Nt, cyan as O, normalizeAwsError as On, formatDockerLoginError as Ot, collectInlinePolicyNamesManagedBySiblings as P, Synthesizer as Pt, requireConfigArray as Q, expectedOwnerParam as Qt, CloudControlProvider as R, resolveApp as Rt, extractDeploymentEventError as S, StackHasActiveImportsError as Sn, ensureAssetStorage as St, renderStatefulReason as T, SynthesisError as Tn, validateAssetBucketName as Tt, cfnRefValueFromPhysicalId as U, resolveStateBucketWithDefaultAndSource as Ut, isTerminationProtectionPropagationError as V, resolveSkipPrefix as Vt, refStateLookupFromResource as W, resolveUseCdkBootstrapAssets as Wt, readConfigString as X, findLargeInlineResources as Xt, configStringRefusal as Y, MIGRATE_TMP_PREFIX as Yt, replayWarn as Z, uploadCfnTemplate as Zt, createPreDeleteFinalSnapshot as _, NestedStackChildDirectDestroyError as _n, createAssetRedirectResolver as _t, DeploymentEventsStore as a, resetAwsClients as an, isRetryableTransientError as at, unsupportedFinalSnapshotError as b, ResourceTimeoutError as bn, AssetModeResolver as bt, replayFailedOperations as c, CdkdError as cn, TemplateParser as ct, IMPLICIT_DELETE_DEPENDENCIES as d, DeployCancelledError as dn, rebuildClientForBucketRegion as dt, processStackMessages as en, requireConfigString as et, computeImplicitDeleteEdges as f, LocalInvokeBuildError as fn, shouldRetainResource as ft, ccRoutedFinalSnapshotError as g, MissingCdkCliError as gn, buildAssetRedirectMap as gt, buildFinalSnapshotIdentifier as h, LockError as hn, WorkGraph as ht, DeploymentEventsReader as i, getAwsClients as in, withRetry as it, red as j, runDockerStreaming as jt, gray as k, withErrorHandling as kn, getDockerCmd as kt, replayRollback as l, ConfigError as ln, LockManager as lt, PRE_DELETE_SNAPSHOT_TYPES as m, LocalStartServiceError as mn, stringifyValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, resolveBucketRegion as nn, DiffCalculator as nt, planFailedOps as o, setAwsClients as on, isThrottlingError as ot, ATOMIC_FINAL_SNAPSHOT_TYPES as p, LocalMigrateError as pn, AssetPublisher as pt, resolveExplicitPhysicalId as q, CFN_TEMPLATE_BODY_LIMIT as qt, DeployEngine as r, AwsClients as rn, describeTypeWithThrottleRetry as rt, planRollback as s, AssetError as sn, DagBuilder as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, clearBucketRegionCache as tn, applyRoleArnIfSet as tt, withResourceDeadline as u, DependencyError as un, S3StateBackend as ut, isFinalSnapshotError as v, PartialFailureError as vn, loadPublishableAssetManifest as vt, isStatefulRecreateTargetSync as w, StateError as wn, parseBootstrapMarker as wt, makeCanonicalizePropertiesFn as x, ResourceUpdateNotSupportedError as xn, BOOTSTRAP_MARKER_PREFIX as xt, refusesFinalSnapshot as y, ProvisioningError as yn, rewriteTemplateAssetReferences as yt, slowCcOperationTimeoutMs as z, resolveAutoAssetStorage as zt };
-//# sourceMappingURL=deploy-engine-Sb8KbTlA.js.map
+//# sourceMappingURL=deploy-engine-Dkep5i7x.js.map