@go-to-k/cdkd 0.52.0 → 0.54.0

package/dist/cli.js

@@ -22622,11 +22622,13 @@ import {
   DeleteStageCommand,
   GetStageCommand,
   PutMethodCommand,
+  UpdateMethodCommand,
   DeleteMethodCommand,
   GetMethodCommand,
   PutIntegrationCommand,
   PutMethodResponseCommand,
   CreateAuthorizerCommand,
+  UpdateAuthorizerCommand,
   DeleteAuthorizerCommand,
   GetAuthorizerCommand,
   TagResourceCommand as TagResourceCommand10,
@@ -22713,7 +22715,13 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
       case "AWS::ApiGateway::Account":
         return this.updateAccount(logicalId, physicalId, resourceType, properties);
       case "AWS::ApiGateway::Authorizer":
-        return this.updateAuthorizer(logicalId, physicalId, resourceType);
+        return this.updateAuthorizer(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       case "AWS::ApiGateway::Resource":
         return this.updateResource(
           logicalId,
@@ -22733,7 +22741,13 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
           previousProperties
         );
       case "AWS::ApiGateway::Method":
-        return this.updateMethod(logicalId, physicalId);
+        return this.updateMethod(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       default:
         throw new ProvisioningError(
           `Unsupported resource type: ${resourceType}`,
@@ -22963,22 +22977,94 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
     }
   }
   /**
-   * Update an API Gateway Authorizer.
+   * Update an API Gateway Authorizer via `UpdateAuthorizerCommand` (RFC 6902
+   * JSON Patch operations).
+   *
+   * Mutable fields (per AWS API Gateway PATCH operations docs):
+   *   `/name`, `/authType`, `/authorizerUri`, `/authorizerCredentials`,
+   *   `/identitySource`, `/identityValidationExpression`,
+   *   `/authorizerResultTtlInSeconds`, `/providerARNs`.
    *
-   * AWS exposes `UpdateAuthorizer` (PATCH) but cdkd does not yet plumb the
-   * patch-operations builder through. Authorizers are recreated by the
-   * deploy engine's immutable-property replacement path. `cdkd drift
-   * --revert` surfaces a clear "use --replace or re-deploy" message
-   * instead of silently no-op'ing the revert.
+   * `Type` and `RestApiId` are immutable (the deploy engine's replacement
+   * path handles those changes via DELETE + CREATE before this method is
+   * called).
+   *
+   * The `gate on !== undefined` pattern (NOT truthy) is load-bearing for
+   * `cdkd drift --revert`: an empty placeholder coming from
+   * `readCurrentStateAuthorizer` (e.g. `IdentitySource: ''` on a Cognito
+   * authorizer) MUST reach AWS as `replace /<field> ''` so a console-side
+   * change away from "" is actually cleared on revert. A truthy gate would
+   * silently drop the empty placeholder and the next drift run would
+   * re-detect the same divergence forever.
    */
-  updateAuthorizer(logicalId, _physicalId, _resourceType) {
-    return Promise.reject(
-      new ResourceUpdateNotSupportedError(
-        "AWS::ApiGateway::Authorizer",
+  async updateAuthorizer(logicalId, physicalId, resourceType, properties, previousProperties) {
+    this.logger.debug(`Updating API Gateway Authorizer ${logicalId}: ${physicalId}`);
+    const restApiId = properties["RestApiId"];
+    if (!restApiId) {
+      throw new ProvisioningError(
+        `RestApiId is required to update API Gateway Authorizer ${logicalId}`,
+        resourceType,
         logicalId,
-        "API Gateway Authorizer updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
-      )
-    );
+        physicalId
+      );
+    }
+    const patchOperations = [];
+    const primitiveFields = [
+      { key: "Name", path: "/name" },
+      { key: "AuthType", path: "/authType" },
+      { key: "AuthorizerUri", path: "/authorizerUri" },
+      { key: "AuthorizerCredentials", path: "/authorizerCredentials" },
+      { key: "IdentitySource", path: "/identitySource" },
+      { key: "IdentityValidationExpression", path: "/identityValidationExpression" },
+      { key: "AuthorizerResultTtlInSeconds", path: "/authorizerResultTtlInSeconds" }
+    ];
+    for (const { key, path } of primitiveFields) {
+      const newVal = properties[key];
+      const prevVal = previousProperties[key];
+      if (newVal !== prevVal) {
+        patchOperations.push({
+          op: "replace",
+          path,
+          value: newVal !== void 0 ? String(newVal) : ""
+        });
+      }
+    }
+    const newArns = properties["ProviderARNs"];
+    const prevArns = previousProperties["ProviderARNs"];
+    const arnsChanged = (newArns?.length ?? 0) !== (prevArns?.length ?? 0) || (newArns ?? []).some((a, i) => a !== prevArns?.[i]);
+    if (arnsChanged) {
+      patchOperations.push({
+        op: "replace",
+        path: "/providerARNs",
+        value: (newArns ?? []).join(",")
+      });
+    }
+    if (patchOperations.length === 0) {
+      this.logger.debug(`No changes detected for API Gateway Authorizer ${logicalId}`);
+      return { physicalId, wasReplaced: false };
+    }
+    try {
+      await this.apiGatewayClient.send(
+        new UpdateAuthorizerCommand({
+          restApiId,
+          authorizerId: physicalId,
+          patchOperations
+        })
+      );
+      this.logger.debug(
+        `Successfully updated API Gateway Authorizer ${logicalId} (${patchOperations.length} patch ops)`
+      );
+      return { physicalId, wasReplaced: false };
+    } catch (error) {
+      const cause = error instanceof Error ? error : void 0;
+      throw new ProvisioningError(
+        `Failed to update API Gateway Authorizer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
+        resourceType,
+        logicalId,
+        physicalId,
+        cause
+      );
+    }
   }
   /**
    * Delete an API Gateway Authorizer
@@ -23524,22 +23610,106 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
     }
   }
   /**
-   * Update an API Gateway Method.
+   * Update an API Gateway Method via `UpdateMethodCommand` (RFC 6902 JSON
+   * Patch operations).
+   *
+   * Mutable top-level fields:
+   *   `/authorizationType`, `/authorizerId`, `/apiKeyRequired`,
+   *   `/operationName`, `/requestValidatorId`.
    *
-   * AWS exposes `UpdateMethod` (PATCH) but cdkd does not yet plumb the
-   * patch-operations builder through. Methods are recreated by the deploy
-   * engine's immutable-property replacement path. `cdkd drift --revert`
-   * surfaces a clear "use --replace or re-deploy" message instead of
-   * silently no-op'ing the revert.
+   * Map fields (`RequestParameters`, `RequestModels`) emit per-key
+   * `add` / `remove` / `replace` ops with paths like
+   *   `/requestParameters/method.request.querystring.foo`
+   *   `/requestModels/application~1json` (slashes escaped per RFC 6901).
+   *
+   * `HttpMethod`, `ResourceId`, `RestApiId` are immutable (replacement
+   * layer handles them via DELETE + CREATE).
+   *
+   * `Integration` and `MethodResponses` are NOT touched here — they are
+   * separate API Gateway sub-resources (`UpdateIntegration` /
+   * `UpdateMethodResponse`) and the cdkd `create()` path treats them as
+   * inline children of the Method. Round-tripping their structurally-
+   * incomplete `{}` placeholders through `updateMethod` would require
+   * destroying / recreating the integration; that work is deferred and
+   * the empty placeholders are blocked from reaching AWS by the
+   * `!== undefined` gate plus the explicit "ignore Integration /
+   * MethodResponses" comment in this method body.
+   *
+   * The `gate on !== undefined` pattern (NOT truthy) is load-bearing for
+   * `cdkd drift --revert`: `ApiKeyRequired: false` and empty-string
+   * placeholders must reach AWS as a real `replace` op so a console-
+   * side toggle is actually cleared on revert.
    */
-  updateMethod(logicalId, _physicalId) {
-    return Promise.reject(
-      new ResourceUpdateNotSupportedError(
-        "AWS::ApiGateway::Method",
+  async updateMethod(logicalId, physicalId, resourceType, properties, previousProperties) {
+    this.logger.debug(`Updating API Gateway Method ${logicalId}: ${physicalId}`);
+    const parts = physicalId.split("|");
+    if (parts.length !== 3) {
+      throw new ProvisioningError(
+        `Invalid physicalId format for API Gateway Method ${logicalId}: expected "restApiId|resourceId|httpMethod", got "${physicalId}"`,
+        resourceType,
         logicalId,
-        "API Gateway Method updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
-      )
+        physicalId
+      );
+    }
+    const [restApiId, resourceId, httpMethod] = parts;
+    const patchOperations = [];
+    const primitiveFields = [
+      { key: "AuthorizationType", path: "/authorizationType" },
+      { key: "AuthorizerId", path: "/authorizerId" },
+      { key: "ApiKeyRequired", path: "/apiKeyRequired" },
+      { key: "OperationName", path: "/operationName" },
+      { key: "RequestValidatorId", path: "/requestValidatorId" }
+    ];
+    for (const { key, path } of primitiveFields) {
+      const newVal = properties[key];
+      const prevVal = previousProperties[key];
+      if (newVal !== prevVal) {
+        patchOperations.push({
+          op: "replace",
+          path,
+          value: newVal !== void 0 ? String(newVal) : ""
+        });
+      }
+    }
+    appendMapPatchOps(
+      patchOperations,
+      "/requestParameters",
+      properties["RequestParameters"] ?? {},
+      previousProperties["RequestParameters"] ?? {}
     );
+    appendMapPatchOps(
+      patchOperations,
+      "/requestModels",
+      properties["RequestModels"] ?? {},
+      previousProperties["RequestModels"] ?? {}
+    );
+    if (patchOperations.length === 0) {
+      this.logger.debug(`No changes detected for API Gateway Method ${logicalId}`);
+      return { physicalId, wasReplaced: false };
+    }
+    try {
+      await this.apiGatewayClient.send(
+        new UpdateMethodCommand({
+          restApiId,
+          resourceId,
+          httpMethod,
+          patchOperations
+        })
+      );
+      this.logger.debug(
+        `Successfully updated API Gateway Method ${logicalId} (${patchOperations.length} patch ops)`
+      );
+      return { physicalId, wasReplaced: false };
+    } catch (error) {
+      const cause = error instanceof Error ? error : void 0;
+      throw new ProvisioningError(
+        `Failed to update API Gateway Method ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
+        resourceType,
+        logicalId,
+        physicalId,
+        cause
+      );
+    }
   }
   /**
    * Delete an API Gateway Method
@@ -23866,6 +24036,23 @@ var ApiGatewayProvider = class _ApiGatewayProvider {
     return null;
   }
 };
+function appendMapPatchOps(ops, basePath, next, prev) {
+  const escape = (k) => k.replace(/~/g, "~0").replace(/\//g, "~1");
+  for (const [key, val] of Object.entries(next)) {
+    const path = `${basePath}/${escape(key)}`;
+    const stringValue = String(val);
+    if (!(key in prev)) {
+      ops.push({ op: "add", path, value: stringValue });
+    } else if (String(prev[key]) !== stringValue) {
+      ops.push({ op: "replace", path, value: stringValue });
+    }
+  }
+  for (const key of Object.keys(prev)) {
+    if (!(key in next)) {
+      ops.push({ op: "remove", path: `${basePath}/${escape(key)}` });
+    }
+  }
+}
 
 // src/provisioning/providers/apigatewayv2-provider.ts
 import {
@@ -31673,8 +31860,10 @@ var ElastiCacheProvider = class {
 import {
   ServiceDiscoveryClient,
   CreatePrivateDnsNamespaceCommand,
+  UpdatePrivateDnsNamespaceCommand,
   DeleteNamespaceCommand,
   CreateServiceCommand as CreateServiceCommand2,
+  UpdateServiceCommand as UpdateServiceCommand2,
   DeleteServiceCommand as DeleteServiceCommand2,
   GetNamespaceCommand,
   GetOperationCommand,
@@ -31736,12 +31925,18 @@ var ServiceDiscoveryProvider = class {
         );
     }
   }
-  update(logicalId, physicalId, resourceType, _properties, _previousProperties) {
+  update(logicalId, physicalId, resourceType, properties, previousProperties) {
     switch (resourceType) {
       case "AWS::ServiceDiscovery::PrivateDnsNamespace":
-        return this.updateNamespace(logicalId, physicalId);
+        return this.updateNamespace(logicalId, physicalId, resourceType, properties);
       case "AWS::ServiceDiscovery::Service":
-        return this.updateService(logicalId, physicalId);
+        return this.updateService(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
       default:
         throw new ProvisioningError(
           `Unsupported resource type: ${resourceType}`,
@@ -31824,14 +32019,66 @@ var ServiceDiscoveryProvider = class {
       );
     }
   }
-  updateNamespace(logicalId, _physicalId) {
-    return Promise.reject(
-      new ResourceUpdateNotSupportedError(
-        "AWS::ServiceDiscovery::PrivateDnsNamespace",
+  /**
+   * Update a private DNS namespace.
+   *
+   * AWS exposes `UpdatePrivateDnsNamespace` for two mutable surfaces:
+   *  - `Description`
+   *  - `Properties.DnsProperties.SOA.TTL`
+   *
+   * `Name` and `Vpc` are immutable; the deploy engine's
+   * replacement-detection layer routes those through DELETE+CREATE
+   * before this method is ever called, so we do not validate them here.
+   *
+   * Empty-string Description is intentionally allowed through (`!== undefined`
+   * gate, not truthy) so `cdkd drift --revert` can clear a console-side ADD.
+   */
+  async updateNamespace(logicalId, physicalId, resourceType, properties) {
+    this.logger.debug(`Updating private DNS namespace ${logicalId}: ${physicalId}`);
+    const client = this.getClient();
+    const namespaceChange = {};
+    if (properties["Description"] !== void 0) {
+      namespaceChange.Description = properties["Description"];
+    }
+    const propsBag = properties["Properties"];
+    const dnsProps = propsBag?.["DnsProperties"];
+    const soa = dnsProps?.["SOA"];
+    if (soa?.TTL !== void 0) {
+      namespaceChange.Properties = {
+        DnsProperties: {
+          SOA: { TTL: Number(soa.TTL) }
+        }
+      };
+    }
+    if (Object.keys(namespaceChange).length === 0) {
+      this.logger.debug(`No mutable diff for PrivateDnsNamespace ${logicalId}, skipping update`);
+      return { physicalId, wasReplaced: false };
+    }
+    try {
+      const response = await client.send(
+        new UpdatePrivateDnsNamespaceCommand({
+          Id: physicalId,
+          Namespace: namespaceChange
+        })
+      );
+      const operationId = response.OperationId;
+      if (operationId) {
+        await this.pollOperation(operationId, logicalId, resourceType);
+      }
+      this.logger.debug(`Successfully updated private DNS namespace ${logicalId}`);
+      return { physicalId, wasReplaced: false };
+    } catch (error) {
+      if (error instanceof ProvisioningError)
+        throw error;
+      const cause = error instanceof Error ? error : void 0;
+      throw new ProvisioningError(
+        `Failed to update private DNS namespace ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
+        resourceType,
         logicalId,
-        "PrivateDnsNamespace updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
-      )
-    );
+        physicalId,
+        cause
+      );
+    }
   }
   async deleteNamespace(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting private DNS namespace ${logicalId}: ${physicalId}`);
@@ -31926,14 +32173,69 @@ var ServiceDiscoveryProvider = class {
       );
     }
   }
-  updateService(logicalId, _physicalId) {
-    return Promise.reject(
-      new ResourceUpdateNotSupportedError(
-        "AWS::ServiceDiscovery::Service",
+  /**
+   * Update a service discovery service.
+   *
+   * Per AWS docs, `UpdateService` accepts a `ServiceChange` body with
+   * `Description`, `DnsConfig.DnsRecords` (TTLs etc. — `NamespaceId` /
+   * `RoutingPolicy` are not part of the change shape and are immutable
+   * here), and `HealthCheckConfig`. `Name` / `NamespaceId` /
+   * `HealthCheckCustomConfig` are immutable on UpdateService — the
+   * replacement-detection layer routes those through DELETE+CREATE.
+   *
+   * Per AWS docs, omitting `DnsRecords` / `HealthCheckConfig` from the
+   * request DELETES that configuration. To preserve fields cdkd is not
+   * actively reverting, we always echo the AWS-current value when the
+   * caller did not supply a change. `cdkd drift --revert` passes the
+   * full AWS-current snapshot as `properties`, so the round-trip is
+   * value-preserving.
+   */
+  async updateService(logicalId, physicalId, resourceType, properties, _previousProperties) {
+    this.logger.debug(`Updating service discovery service ${logicalId}: ${physicalId}`);
+    const client = this.getClient();
+    const serviceChange = {};
+    if (properties["Description"] !== void 0) {
+      serviceChange.Description = properties["Description"];
+    }
+    const dnsConfig = properties["DnsConfig"];
+    if (dnsConfig?.DnsRecords !== void 0) {
+      const change = { DnsRecords: dnsConfig.DnsRecords };
+      serviceChange.DnsConfig = change;
+    }
+    if (properties["HealthCheckConfig"] !== void 0) {
+      serviceChange.HealthCheckConfig = properties["HealthCheckConfig"];
+    }
+    if (Object.keys(serviceChange).length === 0) {
+      this.logger.debug(
+        `No mutable diff for ServiceDiscovery Service ${logicalId}, skipping update`
+      );
+      return { physicalId, wasReplaced: false };
+    }
+    try {
+      const response = await client.send(
+        new UpdateServiceCommand2({
+          Id: physicalId,
+          Service: serviceChange
+        })
+      );
+      const operationId = response.OperationId;
+      if (operationId) {
+        await this.pollOperation(operationId, logicalId, resourceType);
+      }
+      this.logger.debug(`Successfully updated service discovery service ${logicalId}`);
+      return { physicalId, wasReplaced: false };
+    } catch (error) {
+      if (error instanceof ProvisioningError)
+        throw error;
+      const cause = error instanceof Error ? error : void 0;
+      throw new ProvisioningError(
+        `Failed to update service discovery service ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
+        resourceType,
         logicalId,
-        "ServiceDiscovery Service updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
-      )
-    );
+        physicalId,
+        cause
+      );
+    }
   }
   async deleteService(logicalId, physicalId, resourceType, context) {
     this.logger.debug(`Deleting service discovery service ${logicalId}: ${physicalId}`);
@@ -33020,6 +33322,7 @@ var AppSyncProvider = class {
 import {
   GlueClient,
   CreateDatabaseCommand,
+  UpdateDatabaseCommand,
   DeleteDatabaseCommand,
   CreateTableCommand as CreateTableCommand2,
   UpdateTableCommand,
@@ -33066,11 +33369,7 @@ var GlueProvider = class {
   async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
     switch (resourceType) {
       case "AWS::Glue::Database":
-        throw new ResourceUpdateNotSupportedError(
-          resourceType,
-          logicalId,
-          "Glue Database updates are not yet implemented in cdkd; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
-        );
+        return this.updateDatabase(logicalId, physicalId, resourceType, properties);
       case "AWS::Glue::Table":
         return this.updateTable(logicalId, physicalId, resourceType, properties);
       default:
@@ -33121,12 +33420,7 @@ var GlueProvider = class {
       await this.getClient().send(
         new CreateDatabaseCommand({
           CatalogId: catalogId,
-          DatabaseInput: {
-            Name: databaseName,
-            Description: databaseInput["Description"],
-            LocationUri: databaseInput["LocationUri"],
-            Parameters: databaseInput["Parameters"]
-          }
+          DatabaseInput: this.buildDatabaseInput(databaseInput, databaseName)
         })
       );
       this.logger.debug(`Successfully created Glue Database ${logicalId}: ${databaseName}`);
@@ -33145,6 +33439,42 @@ var GlueProvider = class {
       );
     }
   }
+  async updateDatabase(logicalId, physicalId, resourceType, properties) {
+    this.logger.debug(`Updating Glue Database ${logicalId}: ${physicalId}`);
+    const databaseInput = properties["DatabaseInput"];
+    if (!databaseInput) {
+      throw new ProvisioningError(
+        `DatabaseInput is required for Glue Database update ${logicalId}`,
+        resourceType,
+        logicalId,
+        physicalId
+      );
+    }
+    const catalogId = properties["CatalogId"];
+    try {
+      await this.getClient().send(
+        new UpdateDatabaseCommand({
+          ...catalogId !== void 0 && { CatalogId: catalogId },
+          Name: physicalId,
+          DatabaseInput: this.buildDatabaseInput(databaseInput, physicalId)
+        })
+      );
+      this.logger.debug(`Successfully updated Glue Database ${logicalId}`);
+      return {
+        physicalId,
+        wasReplaced: false
+      };
+    } catch (error) {
+      const cause = error instanceof Error ? error : void 0;
+      throw new ProvisioningError(
+        `Failed to update Glue Database ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
+        resourceType,
+        logicalId,
+        physicalId,
+        cause
+      );
+    }
+  }
   async deleteDatabase(logicalId, physicalId, resourceType, properties, context) {
     this.logger.debug(`Deleting Glue Database ${logicalId}: ${physicalId}`);
     try {
@@ -33316,6 +33646,31 @@ var GlueProvider = class {
     }
   }
   // ─── Helpers ───────────────────────────────────────────────────────
+  /**
+   * Build DatabaseInput for Glue API from CFn template properties.
+   *
+   * Used by both `createDatabase` and `updateDatabase` so the same
+   * field-by-field shape is sent on both paths. Optional fields use
+   * `!== undefined` gates (per `feedback_update_optional_field_undefined_check.md`)
+   * so empty-string Description, empty Parameters map, etc. reach AWS
+   * intact — `cdkd drift --revert` relies on this to clear console-side
+   * additions.
+   */
+  buildDatabaseInput(databaseInput, fallbackName) {
+    const result = {
+      Name: databaseInput["Name"] ?? fallbackName
+    };
+    if (databaseInput["Description"] !== void 0) {
+      result.Description = databaseInput["Description"];
+    }
+    if (databaseInput["LocationUri"] !== void 0) {
+      result.LocationUri = databaseInput["LocationUri"];
+    }
+    if (databaseInput["Parameters"] !== void 0) {
+      result.Parameters = databaseInput["Parameters"];
+    }
+    return result;
+  }
   /**
    * Build TableInput for Glue API from CFn template properties
    */
@@ -34781,10 +35136,12 @@ var KinesisStreamProvider = class {
 import {
   EFSClient,
   CreateFileSystemCommand,
+  UpdateFileSystemCommand,
   DeleteFileSystemCommand,
   CreateMountTargetCommand,
   DeleteMountTargetCommand,
   DescribeMountTargetsCommand,
+  ModifyMountTargetSecurityGroupsCommand,
   CreateAccessPointCommand,
   DeleteAccessPointCommand,
   DescribeFileSystemsCommand,
@@ -34842,29 +35199,122 @@ var EFSProvider = class {
     }
   }
   /**
-   * EFS resources are treated as immutable by cdkd's `update()`. The deploy
-   * engine recreates them on property changes via immutable-property
-   * detection. (AWS does expose `UpdateFileSystem` for ThroughputMode and
-   * `ModifyMountTargetSecurityGroups` for mount-target SGs — those are
-   * deferred to a follow-up PR.) `cdkd drift --revert` surfaces a clear
-   * "use --replace or re-deploy" message instead of silently no-op'ing.
+   * Mutable surfaces by resource type:
+   *  - `AWS::EFS::FileSystem` → `UpdateFileSystem` (ThroughputMode,
+   *    ProvisionedThroughputInMibps). Other property changes
+   *    (Encrypted / KmsKeyId / PerformanceMode / etc.) are routed
+   *    through DELETE+CREATE by the replacement-detection layer; if a
+   *    diff somehow includes them, defensively reject.
+   *  - `AWS::EFS::MountTarget` → `ModifyMountTargetSecurityGroups`
+   *    (SecurityGroups only). IpAddress / SubnetId / FileSystemId are
+   *    immutable.
+   *  - `AWS::EFS::AccessPoint` → no mutable surface; AWS recreates on
+   *    every change. Reject so `cdkd drift --revert` surfaces a clear
+   *    "use --replace" hint.
    */
-  update(logicalId, physicalId, resourceType, _properties, _previousProperties) {
-    if (resourceType !== "AWS::EFS::FileSystem" && resourceType !== "AWS::EFS::MountTarget" && resourceType !== "AWS::EFS::AccessPoint") {
+  update(logicalId, physicalId, resourceType, properties, previousProperties) {
+    switch (resourceType) {
+      case "AWS::EFS::FileSystem":
+        return this.updateFileSystem(
+          logicalId,
+          physicalId,
+          resourceType,
+          properties,
+          previousProperties
+        );
+      case "AWS::EFS::MountTarget":
+        return this.updateMountTarget(logicalId, physicalId, resourceType, properties);
+      case "AWS::EFS::AccessPoint":
+        return Promise.reject(
+          new ResourceUpdateNotSupportedError(
+            resourceType,
+            logicalId,
+            "EFS AccessPoint is recreated on property changes; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
+          )
+        );
+      default:
+        throw new ProvisioningError(
+          `Unsupported resource type: ${resourceType}`,
+          resourceType,
+          logicalId,
+          physicalId
+        );
+    }
+  }
+  async updateFileSystem(logicalId, physicalId, resourceType, properties, previousProperties) {
+    const immutableKeys = ["Encrypted", "KmsKeyId", "PerformanceMode"];
+    for (const key of immutableKeys) {
+      const next = properties[key];
+      const prev = previousProperties[key];
+      if (next !== void 0 && prev !== void 0 && JSON.stringify(next) !== JSON.stringify(prev)) {
+        throw new ResourceUpdateNotSupportedError(
+          resourceType,
+          logicalId,
+          `EFS FileSystem ${key} is immutable; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack`
+        );
+      }
+    }
+    const newThroughputMode = properties["ThroughputMode"];
+    const newProvisioned = properties["ProvisionedThroughputInMibps"];
+    const oldThroughputMode = previousProperties["ThroughputMode"];
+    const oldProvisioned = previousProperties["ProvisionedThroughputInMibps"];
+    const throughputModeChanged = newThroughputMode !== void 0 && newThroughputMode !== oldThroughputMode;
+    const provisionedChanged = newProvisioned !== void 0 && newProvisioned !== oldProvisioned;
+    if (!throughputModeChanged && !provisionedChanged) {
+      this.logger.debug(`No mutable diff for EFS FileSystem ${logicalId}, skipping update`);
+      return { physicalId, wasReplaced: false };
+    }
+    this.logger.debug(`Updating EFS FileSystem ${logicalId}: ${physicalId}`);
+    try {
+      await this.getClient().send(
+        new UpdateFileSystemCommand({
+          FileSystemId: physicalId,
+          ...throughputModeChanged && { ThroughputMode: newThroughputMode },
+          ...provisionedChanged && { ProvisionedThroughputInMibps: newProvisioned }
+        })
+      );
+      await this.waitForFileSystemAvailable(physicalId, logicalId, resourceType);
+      this.logger.debug(`Successfully updated EFS FileSystem ${logicalId}`);
+      return { physicalId, wasReplaced: false };
+    } catch (error) {
+      if (error instanceof ProvisioningError)
+        throw error;
+      const cause = error instanceof Error ? error : void 0;
       throw new ProvisioningError(
-        `Unsupported resource type: ${resourceType}`,
+        `Failed to update EFS FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
         resourceType,
         logicalId,
-        physicalId
+        physicalId,
+        cause
       );
     }
-    return Promise.reject(
-      new ResourceUpdateNotSupportedError(
+  }
+  async updateMountTarget(logicalId, physicalId, resourceType, properties) {
+    this.logger.debug(`Updating EFS MountTarget ${logicalId}: ${physicalId}`);
+    const securityGroups = properties["SecurityGroups"];
+    if (securityGroups === void 0) {
+      this.logger.debug(`No mutable diff for EFS MountTarget ${logicalId}, skipping update`);
+      return { physicalId, wasReplaced: false };
+    }
+    try {
+      await this.getClient().send(
+        new ModifyMountTargetSecurityGroupsCommand({
+          MountTargetId: physicalId,
+          SecurityGroups: securityGroups
+        })
+      );
+      this.logger.debug(`Successfully updated EFS MountTarget ${logicalId}`);
+      return { physicalId, wasReplaced: false };
+    } catch (error) {
+      const cause = error instanceof Error ? error : void 0;
+      throw new ProvisioningError(
+        `Failed to update EFS MountTarget ${logicalId}: ${error instanceof Error ? error.message : String(error)}`,
         resourceType,
         logicalId,
-        "EFS resources are recreated on property changes; re-deploy with cdkd deploy --replace, or destroy + redeploy the stack"
-      )
-    );
+        physicalId,
+        cause
+      );
+    }
   }
   async delete(logicalId, physicalId, resourceType, _properties, context) {
     switch (resourceType) {
@@ -45339,7 +45789,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.52.0");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.54.0");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());