@go-to-k/cdkd 0.286.1 → 0.286.2

package/dist/{deploy-engine-D0RCEQ6D.js → deploy-engine-BoSlW08T.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CnQK6Jeh.js";
+import { t as getCdkdVersion } from "./version-Crg_SdRh.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -836,6 +836,116 @@ function isNameCooldownError(message) {
 function isRecreateRetryableError(message) {
 	return isNameCollisionError(message) || isNameCooldownError(message);
 }
+/**
+* The Cloud Control exception NAME for "this resource type ships no handler
+* for the action you asked for" (issue
+* [#2520](https://github.com/go-to-k/cdkd/issues/2520)).
+*
+* A NAME, not a message fragment: AWS SDK v3 sets `error.name` to the service
+* exception's own identifier, which is a wire-level contract, while the prose
+* beside it is text AWS is free to reword. The sibling READ classifier in
+* `src/cli/commands/drift.ts` (`NO_READ_HANDLER_NAMES`) already keys on this
+* same name for the GET direction.
+*/
+const CC_UNSUPPORTED_ACTION_ERROR_NAME = "UnsupportedActionException";
+/**
+* The AWS prose the update-not-supported classifier accepted before the
+* structured signal existed. Kept as a TOP-LEVEL-only fallback — see
+* {@link isUpdateUnsupportedError} for why it is not walked down the chain.
+*/
+const CC_UPDATE_UNSUPPORTED_MESSAGE_FALLBACK = "does not support UPDATE";
+/**
+* True when a failed `provider.update()` for `logicalId` was rejected because
+* the resource type has no UPDATE handler at all — the signal the deploy
+* engine's update-failure fallback fires on, turning the update into a
+* replacement.
+*
+* ## Why the chain is walked
+*
+* `CloudControlProvider.handleError` WRAPS the raw AWS rejection in a
+* `ProvisioningError` and interpolates `err.message` only; the exception name
+* is never copied into the wrapper's text. Measured 2026-09-04: `aws
+* cloudcontrol update-resource --type-name AWS::DocDB::DBCluster` answers
+* `UnsupportedActionException` with the message `Resource type
+* AWS::DocDB::DBCluster does not support UPDATE action`, which does not repeat
+* the name. That is why the predicate's pre-#2520
+* `message.includes('UnsupportedActionException')` half matched nothing cdkd
+* produces, and why the structured read has to look one link down.
+*
+* Two structured signals, both read off a link rather than out of prose:
+*
+*  - `name` — the synchronous `UpdateResource` rejection, one cause link below
+*    the provider's wrapper.
+*  - `ccErrorCode` PLUS `ccOperation === 'UPDATE'` — the two fields
+*    `CloudControlOperationFailedError` carries for an asynchronous
+*    progress-event failure, read structurally exactly as
+*    `cloud-control-provider.ts` reads the code for `AlreadyExists` /
+*    `NotFound`. No async occurrence has been MEASURED
+*    (`UnsupportedActionException` is raised synchronously by `UpdateResource`
+*    today); the arm exists so the async shape cannot silently fall through to
+*    prose, and it is pinned by unit cases built from the real error class.
+*    `ccOperation` is required rather than decorative precisely BECAUSE the
+*    arm is unmeasured: a CREATE or DELETE sub-operation reporting the same
+*    code says nothing about whether the type has an UPDATE handler, and
+*    reading the code alone would let it trigger a DELETE + CREATE. The
+*    narrowing is not absolute and the gap is stated rather than papered over:
+*    such a failure arriving at the TOP level still classifies if its own
+*    MESSAGE quotes AWS's prose. Unreachable today —
+*    `CloudControlOperationFailedError`'s message is built as
+*    `${operation} failed for <id>: <StatusMessage>`, so a CREATE's text
+*    cannot contain the UPDATE phrase unless AWS puts it there — and closing
+*    it would mean anchoring the prose read on the operation too, which would
+*    narrow the retained pre-#2520 reach rather than preserve it.
+*
+* ## Why the walk stops at another resource's error
+*
+* `logicalId` is not decoration — it is the fence that keeps a chain walk from
+* being WIDER than the message read it replaces. `NestedStackProvider.update`
+* runs a whole child deploy inside the PARENT's `provider.update()` call, so a
+* child resource's Cloud Control rejection propagates into the parent's update
+* catch, several cause links down. An unanchored walk would classify that as
+* "the nested stack cannot be updated in place" and DELETE + CREATE the entire
+* child stack. The pre-#2520 message read was immune by accident — the child
+* engine's wrapper is `Failed to update resource <child>`, which quotes no AWS
+* text — and this anchor makes the immunity deliberate: `ProvisioningError`
+* and `ResourceUpdateNotSupportedError` both carry `logicalId`, so the walk
+* stops dead at the first link that names a resource other than the one being
+* updated.
+*
+* The prose fallback is read at the TOP LEVEL ONLY, exactly as the pre-#2520
+* predicate did, and for the same asymmetry: missing the signal fails the
+* deploy (safe), matching it too broadly replaces a resource nobody asked to
+* replace (unsafe). It is read INSIDE the walk, after the anchor, so the
+* anchor governs every route into a `true` — ordered ahead of it, the
+* nested-stack immunity would rest on the child engine's wrapper happening to
+* quote no AWS text, which is a property of another file.
+*
+* ## Codes deliberately NOT matched
+*
+* The Cloud Control handler error code `NotUpdatable` reports "this particular
+* patch is not applicable" (a create-only property, an invalid document)
+* rather than "the type has no UPDATE handler", and cdkd already routes the
+* create-only case through its own property-driven replacement — accepting it
+* here would convert ordinary update rejections into replacements.
+* `TypeNotFoundException`, which `handleError` wraps into the SAME sentence as
+* the unsupported-action case, is not matched either: an unregistered type has
+* no replacement story, so it must keep failing the deploy rather than
+* deleting the resource.
+*/
+function isUpdateUnsupportedError(error, logicalId) {
+	let current = error;
+	for (let depth = 0; current !== null && current !== void 0 && depth < MAX_CAUSE_CHAIN_DEPTH; depth++) {
+		const link = current;
+		if (typeof link.logicalId === "string" && link.logicalId !== logicalId) return false;
+		if (link.name === "UnsupportedActionException") return true;
+		if (link.ccErrorCode === "UnsupportedActionException" && link.ccOperation === "UPDATE") return true;
+		if (depth === 0) {
+			if ((current instanceof Error ? current.message : String(current)).includes("does not support UPDATE")) return true;
+		}
+		current = link.cause;
+	}
+	return false;
+}
 
 //#endregion
 //#region src/utils/error-handler.ts
@@ -21642,7 +21752,8 @@ function ccProtectionProperty(resourceType) {
 const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"Alexa::ASK::Skill",
 	"AWS::AmazonMQ::ConfigurationAssociation",
-	"AWS::ApiGatewayV2::ApiGatewayManagedOverrides",
+	"AWS::Amplify::Jobs",
+	"AWS::AmplifyUIBuilder::CodegenJob",
 	"AWS::AppMesh::GatewayRoute",
 	"AWS::AppMesh::Mesh",
 	"AWS::AppMesh::Route",
@@ -21651,64 +21762,90 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::AppMesh::VirtualRouter",
 	"AWS::AppMesh::VirtualService",
 	"AWS::AppStream::Fleet",
+	"AWS::AppStream::StackFleetAssociation",
 	"AWS::AppSync::ApiCache",
 	"AWS::Artifact::Report",
 	"AWS::Athena::Session",
 	"AWS::AutoScalingPlans::ScalingPlan",
 	"AWS::BackupSearch::SearchJob",
+	"AWS::BackupSearch::SearchResultExportJob",
 	"AWS::BCMDataExports::Table",
+	"AWS::Bedrock::AsyncInvoke",
 	"AWS::Bedrock::DefaultPromptRouter",
+	"AWS::Bedrock::FlowExecution",
+	"AWS::Bedrock::FoundationModel",
+	"AWS::Bedrock::ImportedModel",
+	"AWS::Bedrock::ModelImportJob",
 	"AWS::Bedrock::ModelInvocationJob",
+	"AWS::BedrockAgentCore::ConfigurationBundleVersion",
+	"AWS::BedrockAgentCore::HarnessVersion",
+	"AWS::BedrockAgentCore::PolicyGeneration",
 	"AWS::BedrockAgentCore::TokenVault",
+	"AWS::Braket::Job",
+	"AWS::Cassandra::Stream",
 	"AWS::Cloud9::EnvironmentEC2",
 	"AWS::CloudFormation::Macro",
 	"AWS::CloudFormation::ResourceScan",
 	"AWS::CloudFormation::WaitCondition",
 	"AWS::CloudFront::StreamingDistribution",
 	"AWS::CodeArtifact::Package",
-	"AWS::CodeBuild::ReportGroup",
+	"AWS::CodeBuild::Build",
+	"AWS::CodeBuild::BuildBatch",
 	"AWS::CodeBuild::Sandbox",
-	"AWS::CodeBuild::SourceCredential",
 	"AWS::CodeStar::GitHubRepository",
 	"AWS::CognitoSync::Dataset",
+	"AWS::Comprehend::DocumentClassificationJob",
+	"AWS::Comprehend::DominantLanguageDetectionJob",
+	"AWS::Comprehend::EntitiesDetectionJob",
+	"AWS::Comprehend::FlywheelDataset",
+	"AWS::Comprehend::SentimentDetectionJob",
+	"AWS::Comprehend::TargetedSentimentDetectionJob",
 	"AWS::Config::ConfigurationRecorder",
 	"AWS::Config::DeliveryChannel",
 	"AWS::Config::OrganizationConfigRule",
+	"AWS::ControlCatalog::CommonControl",
+	"AWS::ControlCatalog::Control",
 	"AWS::ControlCatalog::Objective",
+	"AWS::DataExchange::Assets",
+	"AWS::DataExchange::EntitledDataSets",
+	"AWS::DataExchange::Job",
+	"AWS::DataSync::TaskExecution",
 	"AWS::DAX::Cluster",
-	"AWS::DAX::ParameterGroup",
 	"AWS::DAX::SubnetGroup",
+	"AWS::Deadline::Job",
 	"AWS::DirectoryService::MicrosoftAD",
-	"AWS::DMS::EventSubscription",
 	"AWS::DMS::ReplicationInstance",
-	"AWS::DMS::ReplicationSubnetGroup",
-	"AWS::DMS::ReplicationTask",
-	"AWS::DocDB::DBClusterParameterGroup",
+	"AWS::DRS::RecoveryInstance",
 	"AWS::DynamoDB::Export",
+	"AWS::DynamoDB::Stream",
 	"AWS::EC2::ClientVpnAuthorizationRule",
 	"AWS::EC2::ClientVpnEndpoint",
 	"AWS::EC2::ClientVpnRoute",
 	"AWS::EC2::ClientVpnTargetNetworkAssociation",
+	"AWS::EC2::ExportInstanceTask",
 	"AWS::EC2::NetworkInterfacePermission",
+	"AWS::EC2::ReplaceRootVolumeTask",
+	"AWS::EC2::VpnConnectionDeviceType",
 	"AWS::EC2::VPNGatewayRoutePropagation",
+	"AWS::ECRPublic::Registry",
+	"AWS::ECS::ContainerInstance",
+	"AWS::ECS::Task",
 	"AWS::ElastiCache::ReservedCacheNode",
 	"AWS::ElastiCache::SecurityGroup",
 	"AWS::ElastiCache::SecurityGroupIngress",
 	"AWS::ElasticLoadBalancingV2::ListenerCertificate",
 	"AWS::Elasticsearch::Domain",
 	"AWS::EMR::NotebookExecution",
+	"AWS::EMRContainers::JobRun",
+	"AWS::EMRServerless::JobRun",
 	"AWS::Events::Replay",
+	"AWS::FIS::Experiment",
 	"AWS::FIS::SafetyLever",
 	"AWS::FSx::Snapshot",
 	"AWS::FSx::StorageVirtualMachine",
-	"AWS::FSx::Volume",
-	"AWS::Glue::Classifier",
-	"AWS::Glue::CustomEntityType",
-	"AWS::Glue::DataQualityRuleset",
 	"AWS::Glue::DevEndpoint",
-	"AWS::Glue::MLTransform",
 	"AWS::Glue::Partition",
-	"AWS::Glue::TableOptimizer",
+	"AWS::Glue::TableVersion",
 	"AWS::Greengrass::ConnectorDefinition",
 	"AWS::Greengrass::ConnectorDefinitionVersion",
 	"AWS::Greengrass::CoreDefinition",
@@ -21730,11 +21867,18 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::IdentityStore::AllGroupMemberships",
 	"AWS::ImageBuilder::AllImageBuildVersions",
 	"AWS::ImageBuilder::AllWorkflowBuildVersions",
+	"AWS::ImageBuilder::LifecycleExecution",
 	"AWS::ImageBuilder::WorkflowExecution",
 	"AWS::ImageBuilder::WorkflowStepExecution",
+	"AWS::InternetMonitor::InternetEvent",
+	"AWS::IoT::Index",
 	"AWS::IoT::PolicyPrincipalAttachment",
 	"AWS::IoT::ThingPrincipalAttachment",
+	"AWS::IoTDeviceAdvisor::SuiteRun",
 	"AWS::IoTThingsGraph::FlowTemplate",
+	"AWS::IoTTwinMaker::MetadataTransferJob",
+	"AWS::IVS::Composition",
+	"AWS::KafkaConnect::ConnectorOperation",
 	"AWS::KinesisAnalytics::Application",
 	"AWS::KinesisAnalytics::ApplicationOutput",
 	"AWS::KinesisAnalytics::ApplicationReferenceDataSource",
@@ -21744,22 +21888,32 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::LakeFormation::DataLakeSettings",
 	"AWS::LakeFormation::Permissions",
 	"AWS::LakeFormation::Resource",
+	"AWS::Lambda::DurableExecution",
+	"AWS::Lightsail::ExportSnapshotRecord",
+	"AWS::Location::Job",
+	"AWS::Macie2::ClassificationJob",
 	"AWS::ManagedBlockchain::Member",
 	"AWS::ManagedBlockchain::Node",
 	"AWS::MediaConnect::Offering",
 	"AWS::MediaConnect::Reservation",
 	"AWS::MediaConvert::JobTemplate",
-	"AWS::MediaConvert::Preset",
 	"AWS::MediaConvert::Queue",
 	"AWS::MediaLive::Channel",
 	"AWS::MediaLive::Input",
 	"AWS::MediaLive::InputSecurityGroup",
 	"AWS::MediaLive::Offering",
 	"AWS::MediaPackage::HarvestJob",
+	"AWS::MediaPackageV2::HarvestJob",
 	"AWS::MediaStore::Container",
+	"AWS::MedicalImaging::ImageSet",
 	"AWS::MemoryDB::MultiRegionParameterGroup",
 	"AWS::MemoryDB::ReservedNode",
+	"AWS::NeptuneGraph::ExportTask",
+	"AWS::NovaAct::WorkflowRun",
+	"AWS::Omics::ReadSet",
 	"AWS::Omics::Reference",
+	"AWS::Omics::Run",
+	"AWS::Omics::Task",
 	"AWS::OpsWorks::App",
 	"AWS::OpsWorks::ElasticLoadBalancerAttachment",
 	"AWS::OpsWorks::Instance",
@@ -21767,8 +21921,14 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::OpsWorks::Stack",
 	"AWS::OpsWorks::UserProfile",
 	"AWS::OpsWorks::Volume",
+	"AWS::Organizations::Root",
 	"AWS::OSIS::PipelineBlueprint",
+	"AWS::PartnerCentral::ConnectionPreferences",
+	"AWS::PartnerCentral::Partner",
+	"AWS::Personalize::BatchInferenceJob",
+	"AWS::Personalize::BatchSegmentJob",
 	"AWS::Personalize::DataDeletionJob",
+	"AWS::Personalize::DatasetExportJob",
 	"AWS::Personalize::Recipe",
 	"AWS::Pinpoint::ADMChannel",
 	"AWS::Pinpoint::APNSChannel",
@@ -21793,33 +21953,50 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::PinpointEmail::DedicatedIpPool",
 	"AWS::PinpointEmail::Identity",
 	"AWS::QLDB::Ledger",
+	"AWS::QuickSight::AssetBundleExportJob",
+	"AWS::QuickSight::AssetBundleImportJob",
 	"AWS::RDS::DBSecurityGroup",
 	"AWS::RDS::DBSecurityGroupIngress",
+	"AWS::RDS::ReservedDBInstance",
 	"AWS::Redshift::ClusterSecurityGroup",
 	"AWS::Redshift::ClusterSecurityGroupIngress",
+	"AWS::Redshift::DataShare",
 	"AWS::RedshiftServerless::RecoveryPoint",
+	"AWS::ResilienceHub::RecommendationTemplate",
 	"AWS::Route53::RecordSetGroup",
+	"AWS::Route53Resolver::FirewallConfig",
+	"AWS::SageMaker::AutoMLJob",
 	"AWS::SageMaker::CodeRepository",
-	"AWS::SageMaker::EndpointConfig",
+	"AWS::SageMaker::ExperimentTrialComponent",
+	"AWS::SageMaker::HubContentVersion",
+	"AWS::SageMaker::HyperParameterTuningJob",
 	"AWS::SageMaker::ModelCardExportJob",
 	"AWS::SageMaker::MonitoringScheduleAlert",
 	"AWS::SageMaker::NotebookInstance",
 	"AWS::SageMaker::NotebookInstanceLifecycleConfig",
+	"AWS::SageMaker::OptimizationJob",
+	"AWS::SageMaker::PipelineExecution",
+	"AWS::SageMaker::TrainingJob",
 	"AWS::SageMaker::TransformJob",
 	"AWS::SageMaker::Workteam",
-	"AWS::SDB::Domain",
+	"AWS::SavingsPlans::SavingsPlan",
+	"AWS::SecurityAgent::PentestTask",
 	"AWS::ServiceDiscovery::Instance",
-	"AWS::SES::ReceiptFilter",
-	"AWS::SES::ReceiptRule",
-	"AWS::SES::ReceiptRuleSet",
+	"AWS::ServiceQuotas::Quota",
 	"AWS::Signer::SigningJob",
+	"AWS::SSM::AutomationExecution",
+	"AWS::SSM::ManagedInstance",
 	"AWS::SSM::Session",
 	"AWS::SSO::ApplicationProvider",
 	"AWS::States::Execution",
 	"AWS::StepFunctions::MapRun",
 	"AWS::ThinClient::SoftwareSet",
+	"AWS::Transcribe::CallAnalyticsJob",
+	"AWS::Transcribe::MedicalScribeJob",
 	"AWS::Transcribe::MedicalTranscriptionJob",
+	"AWS::Transcribe::TranscriptionJob",
 	"AWS::UserNotifications::ManagedNotificationConfiguration",
+	"AWS::UserNotifications::NotificationEvent",
 	"AWS::WAF::ByteMatchSet",
 	"AWS::WAF::IPSet",
 	"AWS::WAF::Rule",
@@ -21837,7 +22014,9 @@ const NON_PROVISIONABLE_TYPES = /* @__PURE__ */ new Set([
 	"AWS::WAFRegional::SqlInjectionMatchSet",
 	"AWS::WAFRegional::WebACL",
 	"AWS::WAFRegional::WebACLAssociation",
-	"AWS::WAFRegional::XssMatchSet"
+	"AWS::WAFRegional::XssMatchSet",
+	"AWS::Wisdom::Session",
+	"AWS::WorkSpaces::WorkSpaceApplication"
 ]);
 
 //#endregion
@@ -22346,7 +22525,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BocQJsjl.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-CSEPihOt.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -29274,6 +29453,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::Cognito::UserPool",
 	"AWS::SecretsManager::Secret",
 	"AWS::SSM::Parameter",
+	"AWS::CloudHSM::Cluster",
 	"AWS::KMS::Key",
 	"AWS::KMS::ReplicaKey",
 	"AWS::CodeCommit::Repository",
@@ -29294,6 +29474,9 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::RedshiftServerless::Snapshot",
 	"AWS::NeptuneGraph::Graph",
 	"AWS::NeptuneGraph::GraphSnapshot",
+	"AWS::RDS::DBSnapshot",
+	"AWS::RDS::ClusterSnapshot",
+	"AWS::DynamoDB::Backup",
 	"AWS::MemoryDB::Cluster",
 	"AWS::MemoryDB::MultiRegionCluster",
 	"AWS::ElastiCache::ServerlessCache",
@@ -29319,6 +29502,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::S3Outposts::Bucket",
 	"AWS::HealthImaging::Datastore",
 	"AWS::HealthLake::FHIRDatastore",
+	"AWS::FSx::Volume",
 	"AWS::SES::MailManagerArchive",
 	"AWS::WorkspacesInstances::Volume",
 	"AWS::IoTAnalytics::Channel",
@@ -29341,6 +29525,7 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 	"AWS::Connect::DataTable",
 	"AWS::AppConfig::ConfigurationProfile",
 	"AWS::AIOps::InvestigationGroup",
+	"AWS::IoTSiteWise::Workspace",
 	"AWS::Rbin::Rule",
 	"AWS::SMSVOICE::PhoneNumber",
 	"AWS::SMSVOICE::SenderId"
@@ -34099,42 +34284,64 @@ var DeployEngine = class {
 							expectedRegion: this.stackRegion
 						})), logicalId, void 0, void 0, updateProvider);
 					} catch (updateError) {
-						const msg = updateError instanceof Error ? updateError.message : String(updateError);
-						const ccUnsupported = msg.includes("UnsupportedActionException") || msg.includes("does not support UPDATE");
+						const ccUnsupported = isUpdateUnsupportedError(updateError, logicalId);
 						const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && this.options.replace === true;
 						if (ccUnsupported || replaceOptIn) {
-							const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
-							if (statefulReason && this.options.forceStatefulRecreation !== true) {
-								const retainNote = updateReplacePolicy === "Retain" ? " Note: UpdateReplacePolicy: Retain does NOT protect this path — the replacement deletes the old resource regardless." : "";
-								throw markNonRetryable(new CdkdError((replaceOptIn ? `--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.` : `${logicalId} (${resourceType}) cannot be updated in place by the provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update.`) + retainNote, "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
-							}
-							this.logger.info(`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
-							const fallbackFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy);
-							let fallbackDeleteResult = void 0;
-							try {
-								fallbackDeleteResult = await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
-									expectedRegion: this.stackRegion,
-									forceDataDelete: this.options.forceStatefulRecreation === true,
-									...fallbackFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: fallbackFinalSnapshotId }
-								});
-							} catch (deleteError) {
-								const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-								if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
-								else throw deleteError;
+							const retainOldOnReplace = updateReplacePolicy === "Retain";
+							const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps);
+							if (statefulReason && this.options.forceStatefulRecreation !== true) throw markNonRetryable(new CdkdError(replaceOptIn ? `--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.` : `${logicalId} (${resourceType}) cannot be updated in place by the provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update.`, "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
+							this.logger.info(retainOldOnReplace ? `UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
+							if (!retainOldOnReplace) {
+								const fallbackFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy);
+								let fallbackDeleteResult = void 0;
+								try {
+									fallbackDeleteResult = await updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
+										expectedRegion: this.stackRegion,
+										forceDataDelete: this.options.forceStatefulRecreation === true,
+										...fallbackFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: fallbackFinalSnapshotId }
+									});
+								} catch (deleteError) {
+									const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
+									if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
+									else throw deleteError;
+								}
+								const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
+								if (fallbackSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, fallbackSkipReason, "during the UPDATE-not-supported replacement"));
 							}
-							const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
-							if (fallbackSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, fallbackSkipReason, "during the UPDATE-not-supported replacement"));
 							const replDecision = this.providerRegistry.getProviderFor({
 								resourceType,
 								properties: resolvedProps
 							});
 							const replProvider = replDecision.provider;
 							const replProps = replDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
-							const createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
+							let retainedSurvivorReason;
+							let createResult;
+							try {
+								createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
+							} catch (createError) {
+								if (!retainOldOnReplace) throw createError;
+								if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
+								const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+								throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+							}
+							if (retainOldOnReplace) {
+								if (createResult.physicalId === currentResource.physicalId) {
+									const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
+									throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place, so the new properties were not applied. ${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
+								}
+								this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical resource (${currentResource.physicalId}) is RETAINED and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need its data.`);
+								retainedSurvivorReason = `UpdateReplacePolicy: Retain kept the old ${resourceType} (${currentResource.physicalId}), now untracked by cdkd`;
+							}
 							const replacementResult = {
 								physicalId: createResult.physicalId,
 								wasReplaced: true,
-								...createResult.attributes && { attributes: createResult.attributes }
+								...createResult.attributes && { attributes: createResult.attributes },
+								...createResult.noEchoAttributes === true && { noEchoAttributes: true },
+								...createResult.noEchoAttributeNames && { noEchoAttributeNames: createResult.noEchoAttributeNames },
+								...retainedSurvivorReason !== void 0 ? {
+									outcome: "partial",
+									reason: retainedSurvivorReason
+								} : { outcome: "updated" }
 							};
 							if (createResult.effectiveProperties) replacementResult.effectiveProperties = createResult.effectiveProperties;
 							result = replacementResult;
@@ -34280,8 +34487,12 @@ var DeployEngine = class {
 	* connect the message to their code at all.
 	*
 	* `descriptor` names WHERE the name came from; `remedy` is the accurate
-	* first option. Both callers append the shared `--replace` alternative,
-	* which is identical in either case.
+	* first option. What each caller appends after it differs: the two
+	* property-driven create-first sites append the shared `--replace`
+	* alternative, while the update-failure fallback's two `Retain` refusals
+	* (issue #2518) append the Retain clause instead — under `Retain` no flag
+	* frees the name, so offering `--replace` there would send the user to a
+	* flag that changes nothing.
 	*
 	* Classification is best-effort by construction (see
 	* {@link looksLikeCdkdGeneratedName}) and falls back to the pre-#1636
@@ -34608,4 +34819,4 @@ var DeployEngine = class {
 
 //#endregion
 export { beginCommandInterruptScope as $, resolveAutoAssetStorage as $n, isTransientServerError as $r, maskSecretsInError as $t, formatResourceLine as A, ensureAssetStorage as An, DependencyError as Ar, requireConfigString as At, isExportAliasCollision as B, dockerSpawnEnvWithSensitive as Bn, ResourceTimeoutError as Br, INTRINSIC_KEYS as Bt, unsupportedFinalSnapshotError as C, loadPublishableAssetManifest as Cn, getAwsClients as Cr, coerceCfnBoolean as Ct, isStatefulRecreateTargetForReplace as D, AssetModeResolver as Dn, CdkdError as Dr, replayWarn as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, stripControlChars as En, AssetError as Er, readConfigString as Et, red as F, validateAssetBucketName as Fn, LocalStartServiceError as Fr, s3BucketDualStackDomainName as Ft, collectInlinePolicyNamesManagedBySiblings as G, runDockerStreaming as Gn, SynthesisError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, stateKeySecretExposure as H, getDockerCmd as Hn, StackHasActiveImportsError as Hr, withRetry as Ht, yellow as I, validateContainerRepoName as In, LockError as Ir, s3BucketRegionalDomainName as It, findActionableSilentDrops as J, Synthesizer as Jn, normalizeAwsError as Jr, carriesSecretMask as Jt, clearOnUpdateRemoval as K, AssetManifestLoader as Kn, formatError as Kr, STATE_SOURCED_READBACK_RULES as Kt, collectDeclaredOutputNames as L, buildDenyExternalAccessPolicy as Ln, NestedStackChildDirectDestroyError as Lr, s3BucketWebsiteUrl as Lt, cyan as M, isCrossRegionRedirect as Mn, DynamicReferenceRegionAmbiguousError as Mr, producerRegionsFromState as Mt, gray as N, parseBootstrapMarker as Nn, IntrinsicResolutionRefusalError as Nr, s3BucketArn as Nt, isStatefulRecreateTargetSync as O, BOOTSTRAP_MARKER_PREFIX as On, ConfigError as Or, requireConfigArray as Ot, green as P, readBootstrapMarkerBody as Pn, LocalInvokeBuildError as Pr, s3BucketDomainName as Pt, maskerOrIdentity as Q, resolveApp as Qn, isThrottlingError as Qr, isSingleDynamicReferenceToken as Qt, collectPublishedOutputNames as R, describeAwsFailure as Rn, PartialFailureError as Rr, applyRoleArnIfSet as Rt, refusesFinalSnapshot as S, createAssetRedirectResolver as Sn, AwsClients as Sr, assertRegionMatch as St, extractDeploymentEventError as T, escapeRegExp$1 as Tn, setAwsClients as Tr, configStringRefusal as Tt, getCurrentResourceSecrets as U, partitionSensitiveEnv as Un, StackTerminationProtectionError as Ur, DagBuilder as Ut, secretBearingStateKeyWarning as V, formatDockerLoginError as Vn, ResourceUpdateNotSupportedError as Vr, describeTypeWithThrottleRetry as Vt, IAMRoleProvider as W, runDockerForeground as Wn, StateError as Wr, TemplateParser as Wt, createMaskedRetryLogger as X, getDefaultStateBucketName as Xn, isMarkedNonRetryable as Xr, dynamicReferenceTokens as Xt, findSilentDropProperties as Y, synthesisStatusMessage as Yn, withErrorHandling as Yr, createSecretMasker as Yt, maskDeep as Z, getLegacyStateBucketName as Zn, isRetryableTransientError as Zr, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shouldRetainResource as _n, derivePartitionAndUrlSuffix as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, LockManager as an, stateBucketExistenceConfirmed as ar, slowCcOperationTimeoutMs as at, createPreDeleteFinalSnapshot as b, WorkGraph as bn, clearBucketRegionCache as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, UNRENDERABLE as cn, CFN_TEMPLATE_URL_LIMIT as cr, deleteSkipReason as ct, updatePartialReason as d, forceQuitRecoveryClause as dn, uploadCfnTemplate as dr, IntrinsicFunctionResolver as dt, markNonRetryable as ei, maskSecretsInText as en, resolveCaptureObservedState as er, endCommandInterruptScope as et, withResourceDeadline as f, CUSTOM_RESOURCE_RESPONSE_PREFIX as fn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as fr, carriesDynamicReference as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, importableOutputs as gn, canonicalizeRegion as gr, isUnboundTemplateParameter as gt, computeImplicitDeleteEdges as h, importableOutputKeys as hn, PARTITION_TABLE as hr, getAccountInfo as ht, DeploymentEventsReader as i, scrubResourceRecord as in, resolveUseCdkBootstrapAssets as ir, CloudControlProvider as it, bold as j, getBootstrapMarkerKey as jn, DeployCancelledError as jr, classifyReplaySecretRegion as jt, renderStatefulReason as k, assertAssetBucketRegion as kn, CrossAccountSecretRefusalError as kr, requireConfigObject as kt, replayRollback as l, buildForceUnlockCommand as ln, MIGRATE_TMP_PREFIX as lr, disableInstanceApiTermination as lt, IMPLICIT_DELETE_DEPENDENCIES as m, exportNamesCarriedFrom as mn, expectedOwnerParam as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, retryClassificationText as ni, recoverMaskedOutput as nn, resolveStateBucketWithDefault as nr, isInterruptedWaitError as nt, planFailedOps as o, S3StateBackend as on, warnDeprecatedNoPrefixCliFlag as or, UNSPECIFIED_SKIP_REASON as ot, maskingRetryLogger as p, DEFAULT_STATE_PREFIX as pn, displaySafe as pr, cfnRefValueFromPhysicalId as pt, ProviderRegistry as q, getDockerImageBySourceHash as qn, isCdkdError as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, __exportAll as ri, redactSecretsForState as rn, resolveStateBucketWithDefaultAndSource as rr, startInterruptWatch as rt, planRollback as s, rebuildClientForBucketRegion as sn, CFN_TEMPLATE_BODY_LIMIT as sr, deleteIndeterminateGuards as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, markRedactedCause as ti, recordMaskOnlyValue as tn, resolveSkipPrefix as tr, interruptWatchListenerCount as tt, updatePartialMessage as u, buildLockContentionMessage as un, findLargeInlineResources as ur, isTerminationProtectionPropagationError as ut, buildFinalSnapshotIdentifier as v, AssetPublisher as vn, AssemblyReader as vr, refStateLookupFromResource as vt, makeCanonicalizePropertiesFn as w, rewriteTemplateAssetReferences as wn, resetAwsClients as wr, configBooleanRefusal as wt, isFinalSnapshotError as x, buildAssetRedirectMap as xn, resolveBucketRegion as xr, resolveExplicitPhysicalId as xt, ccRoutedFinalSnapshotError as y, stringifyValue as yn, processStackMessages as yr, WAFv2WebACLProvider as yt, exportAliasCollisionScrubWarning as z, buildDockerImage as zn, ProvisioningError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine-D0RCEQ6D.js.map
+//# sourceMappingURL=deploy-engine-BoSlW08T.js.map