@kensio/yulin 1.21.14 → 1.21.16

package/dist/service/cloudformation/changeset/sim-cfn-change-set-changes.js

@@ -1,5 +1,5 @@
 import { makeSimCfnStackResourceMap } from "../stack/resource-map/sim-cfn-stack-resource-map.js";
-import { simCfnStackReplacedLogicalIds } from "../stack/update/sim-cfn-stack-replaced-resources.js";
+import { simCfnStackReplacedLogicalIds } from "../stack/update/sim-cfn-stack-resource-changes.js";
 /**
  * What executing a change set would do to the Stack it is held against.
  *

package/dist/service/cloudformation/resource/factory/sim-cfn-resource-factory.type.d.ts

@@ -1,5 +1,5 @@
 import type { SimCfnResource, SimCloudFormationResourceCreateContext, SimCloudFormationResourceDeleteContext } from "../sim-cfn-resource.js";
-import type { SimCloudFormationResourceUpdateContext } from "../sim-cfn-resource.type.js";
+import type { SimCloudFormationResourceInPlaceUpdateContext, SimCloudFormationResourceUpdateContext } from "../sim-cfn-resource.type.js";
 export interface SimCfnServiceResourceFactory {
     create(resourceTypeName: string, resource: SimCfnResource, context: SimCloudFormationResourceCreateContext): Promise<object | undefined>;
     /**
@@ -24,6 +24,30 @@ export interface SimCfnServiceResourceFactory {
      * create request cannot check.
      */
     assertUpdateAllowed?(resourceTypeName: string, current: SimCfnResource, updated: SimCfnResource, context: SimCloudFormationResourceUpdateContext): Promise<void> | void;
+    /**
+     * Whether a change between two definitions of this Resource can be applied
+     * to the deployed Resource, leaving it where it is.
+     *
+     * Sim CloudFormation replaces a changed Resource unless a service says
+     * otherwise, which is the safe reading for one with no way to change a
+     * deployed Resource. A service answers true for the changes real
+     * CloudFormation applies with no interruption, and carries them out in
+     * `updateInPlace`.
+     *
+     * Answering true keeps the Resource's physical name, so nothing naming it is
+     * replaced either.
+     */
+    updatesInPlace?(resourceTypeName: string, current: SimCfnResource, updated: SimCfnResource): boolean;
+    /**
+     * Apply a change to the deployed Resource.
+     *
+     * Called only for a change `updatesInPlace` claimed, and before the update
+     * deletes or creates anything. The deployed simulated AWS object is on
+     * `current`, and `updated` carries the new definition. What it returns
+     * becomes the Resource's simulated AWS object, which is usually the deployed
+     * one it was given.
+     */
+    updateInPlace?(resourceTypeName: string, current: SimCfnResource, updated: SimCfnResource, context: SimCloudFormationResourceInPlaceUpdateContext): Promise<object | undefined>;
 }
 export interface SimCloudFormationParsedResourceType {
     readonly providerName: string;

package/dist/service/cloudformation/resource/resolve/service/sim-cfn-resource-service-factory.d.ts

@@ -0,0 +1,18 @@
+import type { SimAws } from "../../../../aws/sim-aws.js";
+import type { SimCfnServiceResourceFactory } from "../../factory/sim-cfn-resource-factory.type.js";
+import type { SimCfnResource } from "../../sim-cfn-resource.js";
+/**
+ * A Resource's service factory, and the type name that factory knows it by.
+ */
+export interface SimCfnResourceServiceFactory {
+    readonly factory: SimCfnServiceResourceFactory;
+    readonly resourceTypeName: string;
+}
+/**
+ * The service factory owning a Resource, where a service owns it.
+ *
+ * An untyped Resource and one whose type no service simulates both come back
+ * undefined. Update work asks this before a Stack is changed, and a Resource
+ * nothing can create is a Resource nothing can update either.
+ */
+export declare function simCfnResourceServiceFactory(simAws: SimAws, resource: SimCfnResource): SimCfnResourceServiceFactory | undefined;

package/dist/service/cloudformation/resource/resolve/service/sim-cfn-resource-service-factory.js

@@ -0,0 +1,30 @@
+import { parseSimCloudFormationResourceType } from "../../parser/sim-cfn-resource-parser.js";
+import { isSimCfnUnsupportedResourceError } from "../../unsupported/sim-cfn-unsupported-resource.js";
+import { resolveSimCloudFormationServiceResourceFactory } from "./sim-cfn-service-resolver.js";
+/**
+ * The service factory owning a Resource, where a service owns it.
+ *
+ * An untyped Resource and one whose type no service simulates both come back
+ * undefined. Update work asks this before a Stack is changed, and a Resource
+ * nothing can create is a Resource nothing can update either.
+ */
+export function simCfnResourceServiceFactory(simAws, resource) {
+    const { type } = resource;
+    if (type === undefined) {
+        return undefined;
+    }
+    const resourceType = parseSimCloudFormationResourceType(type);
+    try {
+        return {
+            factory: resolveSimCloudFormationServiceResourceFactory(simAws, resource.accountRegionScope, resourceType),
+            resourceTypeName: resourceType.resourceTypeName,
+        };
+    }
+    catch (error) {
+        if (isSimCfnUnsupportedResourceError(error)) {
+            return undefined;
+        }
+        /* v8 ignore next -- defensive: the resolver refuses with nothing else */
+        throw error;
+    }
+}

package/dist/service/cloudformation/resource/sim-cfn-resource.type.d.ts

@@ -94,6 +94,24 @@ export interface SimCloudFormationResourceDeleteContext {
      */
     readonly retention?: SimCfnResourceRetention | undefined;
 }
+/**
+ * What a service is given to apply a change to a Resource it created, without
+ * replacing it.
+ *
+ * Both property sets are resolved against the Resources the Stack holds now,
+ * so a Ref reaches the physical name of a deployed Resource. The old set is
+ * there because a service often has to know which property changed. Secrets
+ * Manager writes a new secret version for a changed value and leaves the
+ * version alone for a changed description.
+ */
+export interface SimCloudFormationResourceInPlaceUpdateContext {
+    readonly simAws: SimAws;
+    readonly resources: ReadonlyMap<string, SimCfnResource>;
+    readonly currentResolvedProperties: SimCfnTemplateValueRecord;
+    readonly updatedResolvedProperties: SimCfnTemplateValueRecord;
+    /** The principal the update runs as, as creation carries it. */
+    readonly caller?: SimAwsCaller | undefined;
+}
 /**
  * The two resolved Resource definitions available to update validation.
  */

package/dist/service/cloudformation/resource/update/sim-cfn-resource-in-place-updater.d.ts

@@ -0,0 +1,35 @@
+import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfnResource } from "../sim-cfn-resource.js";
+interface SimCfnResourceInPlaceUpdaterProperties {
+    readonly current: SimCfnResource;
+    readonly updated: SimCfnResource;
+}
+interface ApplySimCfnResourceInPlaceUpdateProperties {
+    readonly simAws: SimAws;
+    readonly resources: ReadonlyMap<string, SimCfnResource>;
+    readonly caller?: SimAwsCaller | undefined;
+}
+/**
+ * Applies one Resource change to the deployed Resource, without replacing it.
+ *
+ * The new Resource record takes the deployed simulated AWS object on from the
+ * one it replaces in the Stack's map. That is what carries the bucket's
+ * contents or the secret's versions across an update, and what leaves the
+ * Resource reporting CREATE_COMPLETE rather than starting again as pending.
+ *
+ * Both property sets are resolved against the Resources the Stack holds now.
+ * Nothing has been deleted or created at this point, so a Ref reaches a
+ * deployed Resource's physical name from either side.
+ */
+export declare class SimCfnResourceInPlaceUpdater {
+    private readonly current;
+    private readonly updated;
+    constructor(properties: SimCfnResourceInPlaceUpdaterProperties);
+    /**
+     * Apply the change, and move the new Resource record on to what it left in
+     * simulated AWS.
+     */
+    apply(properties: ApplySimCfnResourceInPlaceUpdateProperties): Promise<void>;
+}
+export {};

package/dist/service/cloudformation/resource/update/sim-cfn-resource-in-place-updater.js

@@ -0,0 +1,61 @@
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { simCfnResourceServiceFactory } from "../resolve/service/sim-cfn-resource-service-factory.js";
+import { simCfnResourceUpdateError } from "./sim-cfn-resource-update-error.js";
+/**
+ * Applies one Resource change to the deployed Resource, without replacing it.
+ *
+ * The new Resource record takes the deployed simulated AWS object on from the
+ * one it replaces in the Stack's map. That is what carries the bucket's
+ * contents or the secret's versions across an update, and what leaves the
+ * Resource reporting CREATE_COMPLETE rather than starting again as pending.
+ *
+ * Both property sets are resolved against the Resources the Stack holds now.
+ * Nothing has been deleted or created at this point, so a Ref reaches a
+ * deployed Resource's physical name from either side.
+ */
+export class SimCfnResourceInPlaceUpdater {
+    current;
+    updated;
+    constructor(properties) {
+        this.current = properties.current;
+        this.updated = properties.updated;
+    }
+    /**
+     * Apply the change, and move the new Resource record on to what it left in
+     * simulated AWS.
+     */
+    async apply(properties) {
+        const { current, updated } = this;
+        const { simAws, resources, caller } = properties;
+        const service = simCfnResourceServiceFactory(simAws, updated);
+        // The plan only lists a Resource whose service has both update hooks.
+        assertDefined(service, `sim CloudFormation service for Resource ${updated.logicalId} to update`);
+        const { factory, resourceTypeName } = service;
+        const updateInPlace = factory.updateInPlace?.bind(factory);
+        assertDefined(updateInPlace, `sim CloudFormation in-place update for Resource ${updated.logicalId}`);
+        updated.markCreateInProgress();
+        try {
+            const simResource = await updateInPlace(resourceTypeName, current, updated, {
+                simAws,
+                resources,
+                currentResolvedProperties: await current.resolvedProperties({
+                    simAws,
+                    resources,
+                    caller,
+                }),
+                updatedResolvedProperties: await updated.resolvedProperties({
+                    simAws,
+                    resources,
+                    caller,
+                }),
+                caller,
+            });
+            updated.markCreateComplete(simResource);
+        }
+        catch (error) {
+            const updateError = simCfnResourceUpdateError(updated, error);
+            updated.markCreateFailed(updateError);
+            throw updateError;
+        }
+    }
+}

package/dist/service/cloudformation/resource/update/sim-cfn-resource-update-error.d.ts

@@ -0,0 +1,9 @@
+import type { SimCfnResource } from "../sim-cfn-resource.js";
+/**
+ * The error a failed in-place update reports, naming the Resource it stopped
+ * on.
+ *
+ * An Error is given the prefix and passed on, so a service's own error type and
+ * its stack survive to the Stack that reads it.
+ */
+export declare function simCfnResourceUpdateError(resource: SimCfnResource, error: unknown): Error;

package/dist/service/cloudformation/resource/update/sim-cfn-resource-update-error.js

@@ -0,0 +1,14 @@
+/**
+ * The error a failed in-place update reports, naming the Resource it stopped
+ * on.
+ *
+ * An Error is given the prefix and passed on, so a service's own error type and
+ * its stack survive to the Stack that reads it.
+ */
+export function simCfnResourceUpdateError(resource, error) {
+    const messagePrefix = `Sim CloudFormation Resource ${resource.logicalId} update failed`;
+    /* v8 ignore next -- defensive: a service refuses with an Error */
+    const refusal = error instanceof Error ? error : new Error(String(error));
+    refusal.message = `${messagePrefix}: ${refusal.message}`;
+    return refusal;
+}

package/dist/service/cloudformation/resource/update/sim-cfn-resource-update-validator.js

@@ -1,6 +1,4 @@
-import { parseSimCloudFormationResourceType } from "../parser/sim-cfn-resource-parser.js";
-import { resolveSimCloudFormationServiceResourceFactory } from "../resolve/service/sim-cfn-service-resolver.js";
-import { isSimCfnUnsupportedResourceError } from "../unsupported/sim-cfn-unsupported-resource.js";
+import { simCfnResourceServiceFactory } from "../resolve/service/sim-cfn-resource-service-factory.js";
 /**
  * Runs service-specific validation for one Resource replacement.
  */
@@ -17,25 +15,14 @@ export class SimCfnResourceUpdateValidator {
     async assertAllowed(properties) {
         const { current, updated } = this;
         const { simAws, currentResources, updatedResources, caller } = properties;
-        const { type } = updated;
-        if (type === undefined || current.type !== type) {
+        if (updated.type === undefined || current.type !== updated.type) {
             return;
         }
-        const resourceType = parseSimCloudFormationResourceType(type);
-        let factory;
-        try {
-            factory = resolveSimCloudFormationServiceResourceFactory(simAws, updated.accountRegionScope, resourceType);
-        }
-        catch (error) {
-            if (isSimCfnUnsupportedResourceError(error)) {
-                return;
-            }
-            throw error;
-        }
-        if (factory.assertUpdateAllowed === undefined) {
+        const service = simCfnResourceServiceFactory(simAws, updated);
+        if (service?.factory.assertUpdateAllowed === undefined) {
             return;
         }
-        await factory.assertUpdateAllowed(resourceType.resourceTypeName, current, updated, {
+        await service.factory.assertUpdateAllowed(service.resourceTypeName, current, updated, {
             simAws,
             currentResources,
             updatedResources,

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.d.ts

@@ -10,7 +10,7 @@ import { SimCfnResourceRetention } from "../resource/delete/sim-cfn-resource-ret
 import type { SimCfnTemplate } from "../template/sim-cfn-template.js";
 import type { SimCfnResourceOrder } from "./deploy/sim-cfn-resource-order.js";
 import { SimCfnStackUpdater } from "./update/sim-cfn-stack-updater.js";
-import type { SimCfnStackResourceReplacement } from "./update/sim-cfn-stack-update-plan.js";
+import type { SimCfnStackResourceChange } from "./update/sim-cfn-stack-resource-change-pairs.js";
 import type { SimCloudFormationStackName } from "./sim-cfn-stack.js";
 interface SimCfnStackUpdateProperties {
     readonly background: BackgroundScheduler;
@@ -104,7 +104,11 @@ export declare class SimCfnStackResourceOperations {
     /**
      * Validate every Resource replacement before the update changes the Stack.
      */
-    assertUpdatesAllowed(currentResources: ReadonlyMap<string, SimCfnResource>, updatedResources: ReadonlyMap<string, SimCfnResource>, replacements: readonly SimCfnStackResourceReplacement[]): Promise<void>;
+    assertUpdatesAllowed(currentResources: ReadonlyMap<string, SimCfnResource>, updatedResources: ReadonlyMap<string, SimCfnResource>, replacements: readonly SimCfnStackResourceChange[]): Promise<void>;
+    /** Whether the service owning a Resource can apply this change to it. */
+    updatesInPlace(current: SimCfnResource, updated: SimCfnResource): boolean;
+    /** Apply the given Resource changes to the deployed Resources. */
+    updateInPlace(resources: ReadonlyMap<string, SimCfnResource>, updates: readonly SimCfnStackResourceChange[]): Promise<void>;
     /**
      * An update of this Stack from a changed template, in the same scope.
      */
@@ -130,6 +134,7 @@ export declare class SimCfnStackResourceOperations {
      */
     private teardownRetention;
     private publishAssets;
+    private resourceUpdates;
     private creator;
     private deleter;
 }

package/dist/service/cloudformation/stack/sim-cfn-stack-resource-operations.js

@@ -5,7 +5,7 @@ import { simCfnStackRetainedLogicalIds } from "./teardown/sim-cfn-stack-retained
 import { SimCfnStackResourceCreator } from "./deploy/sim-cfn-stack-resource-creator.js";
 import { SimCfnStackResourceDeleter } from "./teardown/sim-cfn-stack-resource-deleter.js";
 import { SimCfnStackUpdater } from "./update/sim-cfn-stack-updater.js";
-import { SimCfnResourceUpdateValidator } from "../resource/update/sim-cfn-resource-update-validator.js";
+import { SimCfnStackResourceUpdates } from "./update/sim-cfn-stack-resource-updates.js";
 /**
  * What a Stack can ask simulated AWS to do with its Resources.
  *
@@ -98,17 +98,15 @@ export class SimCfnStackResourceOperations {
      * Validate every Resource replacement before the update changes the Stack.
      */
     async assertUpdatesAllowed(currentResources, updatedResources, replacements) {
-        await Promise.all(replacements.map(async ({ current, updated }) => {
-            await new SimCfnResourceUpdateValidator({
-                current,
-                updated,
-            }).assertAllowed({
-                simAws: this.simAws,
-                currentResources,
-                updatedResources,
-                caller: this.context.caller,
-            });
-        }));
+        await this.resourceUpdates().assertAllowed(currentResources, updatedResources, replacements);
+    }
+    /** Whether the service owning a Resource can apply this change to it. */
+    updatesInPlace(current, updated) {
+        return this.resourceUpdates().claimed(current, updated);
+    }
+    /** Apply the given Resource changes to the deployed Resources. */
+    async updateInPlace(resources, updates) {
+        await this.resourceUpdates().apply(resources, updates);
     }
     /**
      * An update of this Stack from a changed template, in the same scope.
@@ -163,6 +161,12 @@ export class SimCfnStackResourceOperations {
             assetsCaller: this.context.publishingCaller(),
         }).publish();
     }
+    resourceUpdates() {
+        return new SimCfnStackResourceUpdates({
+            simAws: this.simAws,
+            caller: this.context.caller,
+        });
+    }
     creator(resources) {
         return new SimCfnStackResourceCreator({
             simAws: this.simAws,

package/dist/service/cloudformation/stack/update/sim-cfn-stack-resource-change-pairs.d.ts

@@ -0,0 +1,12 @@
+import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+/**
+ * The deployed and new halves of one Resource an update changes.
+ */
+export interface SimCfnStackResourceChange {
+    readonly current: SimCfnResource;
+    readonly updated: SimCfnResource;
+}
+/**
+ * The deployed and new halves of each of the given logical IDs.
+ */
+export declare function simCfnStackResourceChangePairs(current: ReadonlyMap<string, SimCfnResource>, updated: ReadonlyMap<string, SimCfnResource>, logicalIds: ReadonlySet<string>): readonly SimCfnStackResourceChange[];

package/dist/service/cloudformation/stack/update/sim-cfn-stack-resource-change-pairs.js

@@ -0,0 +1,18 @@
+/**
+ * The deployed and new halves of each of the given logical IDs.
+ */
+export function simCfnStackResourceChangePairs(current, updated, logicalIds) {
+    return logicalIds
+        .values()
+        .map((logicalId) => {
+        const currentResource = current.get(logicalId);
+        const updatedResource = updated.get(logicalId);
+        /* v8 ignore next 5 -- defensive: a changed logical ID is one both maps
+           hold */
+        if (currentResource === undefined || updatedResource === undefined) {
+            throw new Error(`CloudFormation change ${logicalId} is missing one of its Resource definitions`);
+        }
+        return { current: currentResource, updated: updatedResource };
+    })
+        .toArray();
+}

package/dist/service/cloudformation/stack/update/sim-cfn-stack-resource-changes.d.ts

@@ -0,0 +1,52 @@
+import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+/**
+ * Who decides whether a change can be applied to the deployed Resource.
+ * Answering false replaces the Resource.
+ */
+export interface SimCfnStackInPlaceUpdates {
+    updatesInPlace(current: SimCfnResource, updated: SimCfnResource): boolean;
+}
+interface SimCfnStackResourceChangesProperties {
+    readonly current: ReadonlyMap<string, SimCfnResource>;
+    readonly updated: ReadonlyMap<string, SimCfnResource>;
+    /**
+     * Which changes the owning service can apply to the deployed Resource.
+     * Omitted, every changed Resource is replaced.
+     */
+    readonly inPlaceUpdates?: SimCfnStackInPlaceUpdates | undefined;
+}
+/**
+ * What an update does to each Resource a Stack and its new template share.
+ */
+export interface SimCfnStackResourceChanges {
+    /** The logical IDs to delete and create again from the new template. */
+    readonly replaced: ReadonlySet<string>;
+    /** The logical IDs to change where they are. */
+    readonly updatedInPlace: ReadonlySet<string>;
+}
+/**
+ * How an update reconciles each changed Resource, given the Stack's deployed
+ * Resources and the ones its new template describes.
+ *
+ * A Resource whose resolved template entry changed is replaced, which means
+ * deleting it and creating it again from the new template. The service owning
+ * the Resource can claim the change instead, for the properties real
+ * CloudFormation applies with no interruption.
+ *
+ * A Resource that names a replaced Resource is replaced too, all the way up the
+ * dependency chain. Real CloudFormation hands the dependent the new physical
+ * name instead, but nothing here can rewrite an already created simulated
+ * Resource, and leaving the dependent alone would leave it pointing at a
+ * Resource that has gone. That reaches a claimed Resource as well, and takes
+ * the claim back. An in-place update never starts a spread of its own, since
+ * the Resource keeps the physical name its dependents already hold.
+ */
+export declare function simCfnStackResourceChanges(properties: SimCfnStackResourceChangesProperties): SimCfnStackResourceChanges;
+/**
+ * The logical IDs an update has to replace.
+ *
+ * Kept for the change set, which reports what an update would do without
+ * knowing which service owns each Resource.
+ */
+export declare function simCfnStackReplacedLogicalIds(properties: SimCfnStackResourceChangesProperties): ReadonlySet<string>;
+export {};

package/dist/service/cloudformation/stack/update/sim-cfn-stack-resource-changes.js

@@ -0,0 +1,86 @@
+import { simCfnTemplateSignature } from "./sim-cfn-template-signature.js";
+/**
+ * How an update reconciles each changed Resource, given the Stack's deployed
+ * Resources and the ones its new template describes.
+ *
+ * A Resource whose resolved template entry changed is replaced, which means
+ * deleting it and creating it again from the new template. The service owning
+ * the Resource can claim the change instead, for the properties real
+ * CloudFormation applies with no interruption.
+ *
+ * A Resource that names a replaced Resource is replaced too, all the way up the
+ * dependency chain. Real CloudFormation hands the dependent the new physical
+ * name instead, but nothing here can rewrite an already created simulated
+ * Resource, and leaving the dependent alone would leave it pointing at a
+ * Resource that has gone. That reaches a claimed Resource as well, and takes
+ * the claim back. An in-place update never starts a spread of its own, since
+ * the Resource keeps the physical name its dependents already hold.
+ */
+export function simCfnStackResourceChanges(properties) {
+    const { current, updated, inPlaceUpdates } = properties;
+    const changed = changedLogicalIds({ current, updated });
+    const updatedInPlace = new Set(changed.values().filter((logicalId) => {
+        const currentResource = current.get(logicalId);
+        const updatedResource = updated.get(logicalId);
+        return (currentResource !== undefined &&
+            updatedResource !== undefined &&
+            inPlaceUpdates?.updatesInPlace(currentResource, updatedResource) ===
+                true);
+    }));
+    const replaced = new Set(changed.values().filter((logicalId) => !updatedInPlace.has(logicalId)));
+    spreadToDependents({ updated, current, replaced });
+    // A claimed Resource the spread reached is replaced after all. Its
+    // dependency is being deleted and created again, and an update applied
+    // before that would have read the deployed Resource on its way out.
+    for (const logicalId of replaced) {
+        updatedInPlace.delete(logicalId);
+    }
+    return { replaced, updatedInPlace };
+}
+/**
+ * The logical IDs an update has to replace.
+ *
+ * Kept for the change set, which reports what an update would do without
+ * knowing which service owns each Resource.
+ */
+export function simCfnStackReplacedLogicalIds(properties) {
+    return simCfnStackResourceChanges(properties).replaced;
+}
+/**
+ * Replace every Resource naming a replaced one, and every Resource naming
+ * those.
+ */
+function spreadToDependents(properties) {
+    const { current, updated, replaced } = properties;
+    // Each pass replaces the Resources naming one already being replaced, until a
+    // pass finds none, which is the end of the dependency chain.
+    let spreading = true;
+    while (spreading) {
+        spreading = false;
+        for (const [logicalId, resource] of updated) {
+            const spreads = current.has(logicalId) &&
+                !replaced.has(logicalId) &&
+                resource.dependencies().some((dependency) => replaced.has(dependency));
+            if (spreads) {
+                replaced.add(logicalId);
+                spreading = true;
+            }
+        }
+    }
+}
+/**
+ * The logical IDs whose resolved template entry differs from the deployed one.
+ */
+function changedLogicalIds(properties) {
+    const { current, updated } = properties;
+    const changed = new Set();
+    for (const [logicalId, resource] of updated) {
+        const deployed = current.get(logicalId);
+        if (deployed !== undefined &&
+            simCfnTemplateSignature(deployed.template) !==
+                simCfnTemplateSignature(resource.template)) {
+            changed.add(logicalId);
+        }
+    }
+    return changed;
+}

package/dist/service/cloudformation/stack/update/sim-cfn-stack-resource-updates.d.ts

@@ -0,0 +1,42 @@
+import type { SimAws } from "../../../aws/sim-aws.js";
+import type { SimAwsCaller } from "../../../aws/caller/sim-aws-caller.js";
+import type { SimCfnResource } from "../../resource/sim-cfn-resource.js";
+import type { SimCfnStackResourceChange } from "./sim-cfn-stack-resource-change-pairs.js";
+interface SimCfnStackResourceUpdatesProperties {
+    readonly simAws: SimAws;
+    /** The principal the update runs as, as creation carries it. */
+    readonly caller?: SimAwsCaller | undefined;
+}
+/**
+ * The Resource changes a Stack update applies to the deployed Resources,
+ * rather than by replacing them.
+ *
+ * Which changes those are is the owning service's answer, given before the
+ * update touches anything. A service with no way to change a deployed Resource
+ * answers nothing, and every change to its Resources is a replacement.
+ */
+export declare class SimCfnStackResourceUpdates {
+    private readonly simAws;
+    private readonly caller;
+    constructor(properties: SimCfnStackResourceUpdatesProperties);
+    /**
+     * Whether the service owning a Resource can apply this change to the
+     * deployed Resource.
+     *
+     * A Resource type no service simulates cannot be updated where it is. Its
+     * creation was skipped, so there is nothing deployed to change.
+     */
+    claimed(current: SimCfnResource, updated: SimCfnResource): boolean;
+    /**
+     * Validate every Resource replacement before the update changes the Stack.
+     */
+    assertAllowed(currentResources: ReadonlyMap<string, SimCfnResource>, updatedResources: ReadonlyMap<string, SimCfnResource>, replacements: readonly SimCfnStackResourceChange[]): Promise<void>;
+    /**
+     * Apply the given changes to the deployed Resources.
+     *
+     * Each one is independent of the others, since none of them creates or
+     * deletes anything another could be waiting on.
+     */
+    apply(resources: ReadonlyMap<string, SimCfnResource>, updates: readonly SimCfnStackResourceChange[]): Promise<void>;
+}
+export {};

package/dist/service/cloudformation/stack/update/sim-cfn-stack-resource-updates.js

@@ -0,0 +1,70 @@
+import { SimCfnResourceInPlaceUpdater } from "../../resource/update/sim-cfn-resource-in-place-updater.js";
+import { simCfnResourceServiceFactory } from "../../resource/resolve/service/sim-cfn-resource-service-factory.js";
+import { SimCfnResourceUpdateValidator } from "../../resource/update/sim-cfn-resource-update-validator.js";
+/**
+ * The Resource changes a Stack update applies to the deployed Resources,
+ * rather than by replacing them.
+ *
+ * Which changes those are is the owning service's answer, given before the
+ * update touches anything. A service with no way to change a deployed Resource
+ * answers nothing, and every change to its Resources is a replacement.
+ */
+export class SimCfnStackResourceUpdates {
+    simAws;
+    caller;
+    constructor(properties) {
+        this.simAws = properties.simAws;
+        this.caller = properties.caller;
+    }
+    /**
+     * Whether the service owning a Resource can apply this change to the
+     * deployed Resource.
+     *
+     * A Resource type no service simulates cannot be updated where it is. Its
+     * creation was skipped, so there is nothing deployed to change.
+     */
+    claimed(current, updated) {
+        if (updated.type === undefined || current.type !== updated.type) {
+            return false;
+        }
+        const service = simCfnResourceServiceFactory(this.simAws, updated);
+        // Both halves or neither. A service that can recognise a change it can
+        // apply but cannot apply it would leave the update with nothing to run.
+        if (service?.factory.updatesInPlace === undefined ||
+            service.factory.updateInPlace === undefined) {
+            return false;
+        }
+        return service.factory.updatesInPlace(service.resourceTypeName, current, updated);
+    }
+    /**
+     * Validate every Resource replacement before the update changes the Stack.
+     */
+    async assertAllowed(currentResources, updatedResources, replacements) {
+        await Promise.all(replacements.map(async ({ current, updated }) => {
+            await new SimCfnResourceUpdateValidator({
+                current,
+                updated,
+            }).assertAllowed({
+                simAws: this.simAws,
+                currentResources,
+                updatedResources,
+                caller: this.caller,
+            });
+        }));
+    }
+    /**
+     * Apply the given changes to the deployed Resources.
+     *
+     * Each one is independent of the others, since none of them creates or
+     * deletes anything another could be waiting on.
+     */
+    async apply(resources, updates) {
+        await Promise.all(updates.map(async ({ current, updated }) => {
+            await new SimCfnResourceInPlaceUpdater({ current, updated }).apply({
+                simAws: this.simAws,
+                resources,
+                caller: this.caller,
+            });
+        }));
+    }
+}