@reventlessdev/reventless-aws 3.0.0-alpha.272 → 3.0.0-alpha.274

package/src/util/Util_LogGroup_Adopting.res.mjs

@@ -0,0 +1,365 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Alias$Pulumi from "@reventlessdev/rescript-pulumi-pulumi/src/Alias.res.mjs";
+import * as Stdlib_JsExn from "@rescript/runtime/lib/es6/Stdlib_JsExn.js";
+import * as Stdlib_Option from "@rescript/runtime/lib/es6/Stdlib_Option.js";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Stdlib_Nullable from "@rescript/runtime/lib/es6/Stdlib_Nullable.js";
+import * as Primitive_object from "@rescript/runtime/lib/es6/Primitive_object.js";
+import * as Primitive_option from "@rescript/runtime/lib/es6/Primitive_option.js";
+import * as Primitive_string from "@rescript/runtime/lib/es6/Primitive_string.js";
+import * as Primitive_exceptions from "@rescript/runtime/lib/es6/Primitive_exceptions.js";
+import * as Logger$ReventlessCore from "@reventlessdev/reventless-core/src/util/Logger.res.mjs";
+import * as Util_LogGroup_Adopting_JsMjs from "./Util_LogGroup_Adopting_Js.mjs";
+import * as IndexJs from "@pulumi/pulumi/dynamic/index.js";
+
+let log = Logger$ReventlessCore.fromEnv();
+
+function newCommand(prim0, prim1) {
+  return Util_LogGroup_Adopting_JsMjs.newCommand(prim0, prim1);
+}
+
+function newClient(prim) {
+  return Util_LogGroup_Adopting_JsMjs.newClient(prim);
+}
+
+function rethrow(prim) {
+  return Util_LogGroup_Adopting_JsMjs.rethrow(prim);
+}
+
+let _sdk = {
+  contents: undefined
+};
+
+let _client = {
+  contents: undefined
+};
+
+async function getSdk() {
+  let m = _sdk.contents;
+  if (m !== undefined) {
+    return m;
+  }
+  let m$1 = await import("@aws-sdk/client-cloudwatch-logs");
+  _sdk.contents = m$1;
+  return m$1;
+}
+
+async function getClient() {
+  let c = _client.contents;
+  if (c !== undefined) {
+    return Primitive_option.valFromOption(c);
+  }
+  let sdk = await getSdk();
+  let c$1 = Util_LogGroup_Adopting_JsMjs.newClient(sdk.CloudWatchLogsClient);
+  _client.contents = Primitive_option.some(c$1);
+  return c$1;
+}
+
+function matchesAws(jsErr, code) {
+  let match = jsErr.name;
+  let match$1 = Stdlib_JsExn.message(jsErr);
+  if (match == null) {
+    if (match$1 !== undefined) {
+      return match$1.includes(code);
+    } else {
+      return false;
+    }
+  } else if (match === code) {
+    return true;
+  } else if (match$1 !== undefined) {
+    return match$1.includes(code);
+  } else {
+    return false;
+  }
+}
+
+function isAlreadyExistsError(jsErr) {
+  return matchesAws(jsErr, "ResourceAlreadyExistsException");
+}
+
+function isAlreadyGoneError(jsErr) {
+  return matchesAws(jsErr, "ResourceNotFoundException");
+}
+
+let transientNames = [
+  "OperationAbortedException",
+  "ThrottlingException",
+  "TooManyRequestsException",
+  "ServiceUnavailableException"
+];
+
+function isRetryableError(jsErr) {
+  return transientNames.some(code => matchesAws(jsErr, code));
+}
+
+async function runWithRetry(attemptOpt, maxAttemptsOpt, delayMsOpt, maxDelayMsOpt, makeCall) {
+  let attempt = attemptOpt !== undefined ? attemptOpt : 0;
+  let maxAttempts = maxAttemptsOpt !== undefined ? maxAttemptsOpt : 5;
+  let delayMs = delayMsOpt !== undefined ? delayMsOpt : 1000;
+  let maxDelayMs = maxDelayMsOpt !== undefined ? maxDelayMsOpt : 8000;
+  try {
+    return await makeCall();
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    let jsExn = Stdlib_JsExn.fromException(exn);
+    let isRetryable = attempt < maxAttempts && Stdlib_Option.mapOr(jsExn, false, isRetryableError);
+    if (isRetryable) {
+      await new Promise((resolve, param) => {
+        setTimeout(resolve, delayMs);
+      });
+      let nextDelay = (delayMs << 1);
+      return await runWithRetry(attempt + 1 | 0, maxAttempts, nextDelay > maxDelayMs ? maxDelayMs : nextDelay, maxDelayMs, makeCall);
+    }
+    if (jsExn !== undefined) {
+      return Util_LogGroup_Adopting_JsMjs.rethrow(Primitive_option.valFromOption(jsExn));
+    }
+    throw exn;
+  }
+}
+
+let marker = "reventless:adopting-log-group";
+
+async function describe(logGroupName) {
+  let sdk = await getSdk();
+  let client = await getClient();
+  let result = await runWithRetry(undefined, undefined, undefined, undefined, () => client.send(Util_LogGroup_Adopting_JsMjs.newCommand(sdk.DescribeLogGroupsCommand, {
+    logGroupNamePrefix: logGroupName
+  })));
+  return Stdlib_Option.getOr(result.logGroups, []).find(g => Primitive_object.equal(g.logGroupName, logGroupName));
+}
+
+function taggableArn(arn) {
+  if (arn.endsWith(":*")) {
+    return arn.slice(0, arn.length - 2 | 0);
+  } else {
+    return arn;
+  }
+}
+
+async function applyRetention(logGroupName, retentionInDays) {
+  let sdk = await getSdk();
+  let client = await getClient();
+  return await runWithRetry(undefined, undefined, undefined, undefined, () => {
+    if (retentionInDays > 0) {
+      return client.send(Util_LogGroup_Adopting_JsMjs.newCommand(sdk.PutRetentionPolicyCommand, {
+        logGroupName: logGroupName,
+        retentionInDays: retentionInDays
+      }));
+    } else {
+      return client.send(Util_LogGroup_Adopting_JsMjs.newCommand(sdk.DeleteRetentionPolicyCommand, logGroupName));
+    }
+  });
+}
+
+async function applyTags(arn, tags) {
+  let sdk = await getSdk();
+  let client = await getClient();
+  return await runWithRetry(undefined, undefined, undefined, undefined, () => client.send(Util_LogGroup_Adopting_JsMjs.newCommand(sdk.TagResourceCommand, {
+    resourceArn: taggableArn(arn),
+    tags: tags
+  })));
+}
+
+async function create(inputs) {
+  let sdk = await getSdk();
+  let client = await getClient();
+  let tags = inputs.tags;
+  let retentionInDays = inputs.retentionInDays;
+  let logGroupName = inputs.logGroupName;
+  let adopted;
+  try {
+    await runWithRetry(undefined, undefined, undefined, undefined, () => client.send(Util_LogGroup_Adopting_JsMjs.newCommand(sdk.CreateLogGroupCommand, {
+      logGroupName: logGroupName,
+      tags: tags
+    })));
+    adopted = false;
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Stdlib_Option.mapOr(Stdlib_JsExn.fromException(exn), false, isAlreadyExistsError)) {
+      adopted = true;
+    } else {
+      throw exn;
+    }
+  }
+  let match = await describe(logGroupName);
+  let arn;
+  if (match !== undefined) {
+    let arn$1 = match.arn;
+    arn = arn$1 !== undefined ? arn$1 : Stdlib_JsError.throwWithMessage(`log group "` + logGroupName + `" is missing immediately after create/adopt`);
+  } else {
+    arn = Stdlib_JsError.throwWithMessage(`log group "` + logGroupName + `" is missing immediately after create/adopt`);
+  }
+  if (adopted) {
+    await applyTags(arn, tags);
+    log.info("Util_LogGroup_Adopting", undefined, `adopted existing log group "` + logGroupName + `"; applied retention ` + retentionInDays.toString() + `d and tags`);
+  }
+  await applyRetention(logGroupName, retentionInDays);
+  return {
+    id: logGroupName,
+    outs: {
+      logGroupName: logGroupName,
+      arn: arn,
+      retentionInDays: retentionInDays,
+      tags: tags,
+      managedBy: marker
+    }
+  };
+}
+
+async function update(_id, _olds, news) {
+  let tags = news.tags;
+  let retentionInDays = news.retentionInDays;
+  let logGroupName = news.logGroupName;
+  let match = await describe(logGroupName);
+  let arn;
+  if (match !== undefined) {
+    let arn$1 = match.arn;
+    arn = arn$1 !== undefined ? arn$1 : undefined;
+  } else {
+    arn = undefined;
+  }
+  if (arn !== undefined) {
+    await applyTags(arn, tags);
+    await applyRetention(logGroupName, retentionInDays);
+  } else {
+    log.warn("Util_LogGroup_Adopting", undefined, `log group "` + logGroupName + `" was gone at update; recreating it`);
+    await create(news);
+  }
+  return {
+    outs: {
+      logGroupName: logGroupName,
+      arn: Stdlib_Nullable.fromOption(arn),
+      retentionInDays: retentionInDays,
+      tags: tags,
+      managedBy: marker
+    }
+  };
+}
+
+async function delete_(id, _props) {
+  let sdk = await getSdk();
+  let client = await getClient();
+  try {
+    return await runWithRetry(undefined, undefined, undefined, undefined, () => client.send(Util_LogGroup_Adopting_JsMjs.newCommand(sdk.DeleteLogGroupCommand, {
+      logGroupName: id
+    })));
+  } catch (raw_exn) {
+    let exn = Primitive_exceptions.internalToException(raw_exn);
+    if (Stdlib_Option.mapOr(Stdlib_JsExn.fromException(exn), false, isAlreadyGoneError)) {
+      return;
+    }
+    throw exn;
+  }
+}
+
+function sameTags(a, b) {
+  let normalise = d => {
+    let entries = Object.entries(d);
+    entries.sort((param, param$1) => Primitive_string.compare(param[0], param$1[0]));
+    return entries.map(param => param[0] + `=` + param[1]).join("");
+  };
+  return normalise(a) === normalise(b);
+}
+
+function diff_(_id, olds, news) {
+  let oldName = olds.logGroupName;
+  let replaces = (oldName == null) ? [] : (
+      oldName !== news.logGroupName ? ["logGroupName"] : []
+    );
+  let notNormalisedYet = Stdlib_Option.isNone(Primitive_option.fromNullable(olds.managedBy));
+  let days = olds.retentionInDays;
+  let retentionChanged = (days == null) ? false : days !== news.retentionInDays;
+  let tags = olds.tags;
+  let tagsChanged = (tags == null) ? false : !sameTags(tags, news.tags);
+  return {
+    changes: replaces.length !== 0 || notNormalisedYet || retentionChanged || tagsChanged,
+    replaces: replaces,
+    deleteBeforeReplace: false
+  };
+}
+
+async function read_(id, props) {
+  let live = await describe(id);
+  if (live !== undefined) {
+    return {
+      id: id,
+      props: {
+        logGroupName: id,
+        arn: Stdlib_Nullable.fromOption(live.arn),
+        retentionInDays: Stdlib_Option.getOr(live.retentionInDays, 0),
+        tags: props.tags,
+        managedBy: props.managedBy
+      }
+    };
+  } else {
+    log.info("Util_LogGroup_Adopting", undefined, `log group "` + id + `" is gone; reporting drift`);
+    return {};
+  }
+}
+
+let provider = {
+  create: create,
+  update: update,
+  delete: delete_,
+  diff: diff_,
+  read: read_
+};
+
+function resourcePropsOf(props) {
+  return {
+    logGroupName: props.logGroupName,
+    retentionInDays: props.retentionInDays,
+    tags: props.tags,
+    name: undefined,
+    arn: undefined,
+    managedBy: undefined
+  };
+}
+
+function make(name, props, opts) {
+  let migrationAlias = Alias$Pulumi.make(name, "aws:cloudwatch/logGroup:LogGroup", undefined);
+  let finalOpts;
+  if (opts !== undefined) {
+    let newrecord = {...opts};
+    newrecord.aliases = [migrationAlias];
+    finalOpts = newrecord;
+  } else {
+    finalOpts = {
+      aliases: [migrationAlias]
+    };
+  }
+  return new IndexJs.Resource(provider, name, resourcePropsOf(props), finalOpts);
+}
+
+export {
+  log,
+  newCommand,
+  newClient,
+  rethrow,
+  _sdk,
+  _client,
+  getSdk,
+  getClient,
+  matchesAws,
+  isAlreadyExistsError,
+  isAlreadyGoneError,
+  transientNames,
+  isRetryableError,
+  runWithRetry,
+  marker,
+  describe,
+  taggableArn,
+  applyRetention,
+  applyTags,
+  create,
+  update,
+  delete_,
+  sameTags,
+  diff_,
+  read_,
+  provider,
+  resourcePropsOf,
+  make,
+}
+/* log Not a pure module */

package/src/util/Util_LogGroup_Adopting_Js.mjs

@@ -0,0 +1,20 @@
+// Untyped JS primitives for Util_LogGroup_Adopting.
+//
+// The AWS SDK is imported dynamically there (a Pulumi dynamic provider
+// serialises its whole captured closure into stack state, and a statically
+// captured SDK does not survive that), so its command classes arrive as plain
+// values on a module namespace and cannot be reached through `@new external`.
+// These three helpers are the only untyped reflection that needs, kept out of
+// the ReScript source.
+
+/** `new Ctor(input)` — the SDK exports plain classes. */
+export const newCommand = (Ctor, input) => new Ctor(input)
+
+/** `new Ctor()` — the client constructor takes no required argument. */
+export const newClient = Ctor => new Ctor()
+
+/** Rethrows a JavaScript error as-is, bypassing the ReScript exception wrapper,
+    so Pulumi prints AWS's own message rather than "error: undefined". */
+export const rethrow = e => {
+  throw e
+}

package/src/util/Util_LogRetention.res

@@ -62,19 +62,18 @@ let logLevelFor = (
 Whether the framework creates a *managed* CloudWatch log group for this stack, or
 leaves Lambda/AppSync to auto-create an unmanaged one.
 
-**Managed for every stack by default.** A stack deployed on this framework gets
-its log groups from Pulumi on the first `pulumi up`, before Lambda/AppSync would
-lazily auto-create them — so on a fresh stack there is nothing to adopt and no
-`ResourceAlreadyExists` hazard. Every current stack is `alpha`, and there is no
-prod stack to migrate, so extending management to all stacks costs nothing today.
+**Managed for every stack by default**, and for Lambda there is nothing to adopt
+on any stack: the group is created *before* the function and under a name the
+program chooses (`Util_LambdaLogging.logGroupNameFor`), which is never the name
+Lambda auto-creates. The `ResourceAlreadyExists` hazard that made this gate
+necessary is structural for AppSync only, whose group name comes from a
+server-assigned api id.
 
-The one case that still needs care is *adopting* a stack that predates managed
-groups: it already carries Lambda's auto-created group, and `CreateLogGroup`
-fails with `ResourceAlreadyExists` rather than adopting it. When such a stack
-ever appears, either `pulumi import` its groups first, or name it in the
-`unmanagedLogGroupStacks` config key to keep it on auto-created groups until the
-import is done. That escape hatch is the "prepared for the future" seam — turning
-a prod adoption into a config flip rather than an edit to this function.
+`unmanagedLogGroupStacks` remains the escape hatch for a stack that has adopted
+**nothing** — it makes the program stop *declaring* log groups. Do not reach for
+it once a stack holds managed groups in state: "stop declaring them" reads to the
+engine as removed-from-the-program, and the next deploy deletes them along with
+their retention, tags and any attached metric filters.
 */
 let managesLogGroup = (~stack: string, ~unmanagedStacks: array<string>=[]): bool =>
   !(unmanagedStacks->Array.includes(stack))

package/tests/Util_LambdaLoggingTest.res

@@ -0,0 +1,48 @@
+open JestGlobals
+
+// The managed log group's name is now chosen by the program rather than derived
+// from the function's physical name output. That choice is what removes the race
+// (the group can be created before the function, and pointed at from
+// `loggingConfig`), so the properties it has to keep are worth pinning.
+describe("Util_LambdaLogging.logGroupNameFor", () => {
+  let nameFor = (~project="online-shop-catalog-aws", ~stack="alpha", ~name) =>
+    Util_LambdaLogging.logGroupNameFor(~project, ~stack, ~name)
+
+  testSync("is the conventional Lambda group prefix", () =>
+    expect(nameFor(~name="AllReadModels"))->toBe(
+      "/aws/lambda/online-shop-catalog-aws-alpha-AllReadModels",
+    )
+  )
+
+  testSync("carries no Pulumi physical-name suffix, so a replaced function keeps its group", () => {
+    let before = nameFor(~name="AllReadModels")
+    let afterReplacement = nameFor(~name="AllReadModels")
+    expect(before)->toBe(afterReplacement)
+  })
+
+  testSync("is stack-scoped, so environments of one project cannot collide", () =>
+    expect(nameFor(~stack="pr-42", ~name="AllReadModels"))->not_->toBe(
+      nameFor(~stack="alpha", ~name="AllReadModels"),
+    )
+  )
+
+  // The regression this scoping exists for. Every plugin of one platform is its
+  // own Pulumi PROJECT deployed under the SAME stack name, and components are
+  // named by role rather than by owner — so several projects each host an
+  // `AllStateViewSlices`. Scoping on the stack alone gave them one name, and
+  // every deploy after the first failed with ResourceAlreadyExistsException.
+  testSync("is project-scoped, so one platform's plugins cannot collide", () =>
+    expect(nameFor(~project="online-shop-catalog-aws", ~name="AllStateViewSlices"))
+    ->not_
+    ->toBe(nameFor(~project="online-shop-ordering-aws", ~name="AllStateViewSlices"))
+  )
+
+  testSync("differs from the group Lambda would auto-create for the same function", () => {
+    // Lambda auto-creates `/aws/lambda/<physical name>`, and the physical name
+    // always carries Pulumi's `-<7hex>` suffix. Not colliding with it is what
+    // makes the create unconditionally safe on a stack whose groups AWS already
+    // made.
+    let autoCreated = "/aws/lambda/AllReadModels-0287438"
+    expect(nameFor(~name="AllReadModels"))->not_->toBe(autoCreated)
+  })
+})

package/tests/Util_LambdaLoggingTest.res.mjs

@@ -0,0 +1,30 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Util_LambdaLogging$ReventlessAws from "../src/util/Util_LambdaLogging.res.mjs";
+
+globalThis.describe("Util_LambdaLogging.logGroupNameFor", () => {
+  let nameFor = (projectOpt, stackOpt, name) => {
+    let project = projectOpt !== undefined ? projectOpt : "online-shop-catalog-aws";
+    let stack = stackOpt !== undefined ? stackOpt : "alpha";
+    return Util_LambdaLogging$ReventlessAws.logGroupNameFor(project, stack, name);
+  };
+  globalThis.test("is the conventional Lambda group prefix", () => {
+    globalThis.expect(nameFor(undefined, undefined, "AllReadModels")).toBe("/aws/lambda/online-shop-catalog-aws-alpha-AllReadModels");
+  });
+  globalThis.test("carries no Pulumi physical-name suffix, so a replaced function keeps its group", () => {
+    let before = nameFor(undefined, undefined, "AllReadModels");
+    let afterReplacement = nameFor(undefined, undefined, "AllReadModels");
+    globalThis.expect(before).toBe(afterReplacement);
+  });
+  globalThis.test("is stack-scoped, so environments of one project cannot collide", () => {
+    globalThis.expect(nameFor(undefined, "pr-42", "AllReadModels")).not.toBe(nameFor(undefined, "alpha", "AllReadModels"));
+  });
+  globalThis.test("is project-scoped, so one platform's plugins cannot collide", () => {
+    globalThis.expect(nameFor("online-shop-catalog-aws", undefined, "AllStateViewSlices")).not.toBe(nameFor("online-shop-ordering-aws", undefined, "AllStateViewSlices"));
+  });
+  globalThis.test("differs from the group Lambda would auto-create for the same function", () => {
+    globalThis.expect(nameFor(undefined, undefined, "AllReadModels")).not.toBe("/aws/lambda/AllReadModels-0287438");
+  });
+});
+
+/*  Not a pure module */

package/tests/Util_LogGroup_AdoptingTest.res

@@ -0,0 +1,169 @@
+open JestGlobals
+
+// Build a plain JS object shaped like a JS Error / SDK exception, cast to
+// JsExn.t so the classifiers can be called without a real throw/catch.
+type testError = {name: string, message: string}
+let mkErr = (~name, ~message): JsExn.t => Obj.magic(({name, message}: testError))
+
+module Adopting = Util_LogGroup_Adopting
+
+let tags = Dict.fromArray([("Name", "PlatformApiAppSyncLogGroup"), ("reventless:role", "Logs")])
+
+let normalisedOuts: Adopting.outs = {
+  logGroupName: Nullable.make("/aws/appsync/apis/abc123"),
+  arn: Nullable.make("arn:aws:logs:eu-west-1:1:log-group:/aws/appsync/apis/abc123:*"),
+  retentionInDays: Nullable.make(7),
+  tags: Nullable.make(tags),
+  managedBy: Nullable.make(Adopting.marker),
+}
+
+let inputs: Adopting.providerInputs = {
+  logGroupName: "/aws/appsync/apis/abc123",
+  retentionInDays: 7,
+  tags,
+}
+
+describe("Util_LogGroup_Adopting.isAlreadyExistsError", () => {
+  testSync("true for the error this provider exists to absorb", () =>
+    expect(
+      Adopting.isAlreadyExistsError(
+        mkErr(~name="ResourceAlreadyExistsException", ~message="The specified log group already exists"),
+      ),
+    )->toBe(true)
+  )
+
+  testSync("true when the code rides in the message", () =>
+    expect(
+      Adopting.isAlreadyExistsError(
+        mkErr(~name="InvalidParameterException", ~message="ResourceAlreadyExistsException: exists"),
+      ),
+    )->toBe(true)
+  )
+
+  testSync("false for a permission failure, which must still fail loudly", () =>
+    expect(
+      Adopting.isAlreadyExistsError(mkErr(~name="AccessDeniedException", ~message="not authorized")),
+    )->toBe(false)
+  )
+})
+
+describe("Util_LogGroup_Adopting.isRetryableError", () => {
+  testSync("true for the concurrent-write rejection on one group", () =>
+    expect(Adopting.isRetryableError(mkErr(~name="OperationAbortedException", ~message="x")))->toBe(
+      true,
+    )
+  )
+
+  testSync("false for an already-exists error — that is absorbed, not retried", () =>
+    expect(
+      Adopting.isRetryableError(mkErr(~name="ResourceAlreadyExistsException", ~message="x")),
+    )->toBe(false)
+  )
+})
+
+describe("Util_LogGroup_Adopting.taggableArn", () => {
+  testSync("strips the trailing `:*` TagResource rejects", () =>
+    expect(
+      Adopting.taggableArn("arn:aws:logs:eu-west-1:1:log-group:/aws/appsync/apis/abc123:*"),
+    )->toBe("arn:aws:logs:eu-west-1:1:log-group:/aws/appsync/apis/abc123")
+  )
+
+  testSync("leaves an already-taggable arn alone", () => {
+    let arn = "arn:aws:logs:eu-west-1:1:log-group:/aws/appsync/apis/abc123"
+    expect(Adopting.taggableArn(arn))->toBe(arn)
+  })
+})
+
+describe("Util_LogGroup_Adopting.sameTags", () => {
+  testSync("is insensitive to key order", () =>
+    expect(
+      Adopting.sameTags(
+        Dict.fromArray([("a", "1"), ("b", "2")]),
+        Dict.fromArray([("b", "2"), ("a", "1")]),
+      ),
+    )->toBe(true)
+  )
+
+  testSync("sees a changed value", () =>
+    expect(
+      Adopting.sameTags(Dict.fromArray([("a", "1")]), Dict.fromArray([("a", "2")])),
+    )->toBe(false)
+  )
+
+  testSync("sees an added key", () =>
+    expect(
+      Adopting.sameTags(Dict.fromArray([("a", "1")]), Dict.fromArray([("a", "1"), ("b", "2")])),
+    )->toBe(false)
+  )
+})
+
+describe("Util_LogGroup_Adopting.diff_", () => {
+  testSync("no change when the live state already matches", () => {
+    let result = Adopting.diff_("id", normalisedOuts, inputs)
+    expect(result.changes)->toBe(false)
+    expect(result.replaces)->toEqual([])
+  })
+
+  testSync("a retention change is an update, not a replace", () => {
+    let result = Adopting.diff_("id", normalisedOuts, {...inputs, retentionInDays: 30})
+    expect(result.changes)->toBe(true)
+    expect(result.replaces)->toEqual([])
+  })
+
+  testSync("a tag change is an update, not a replace", () => {
+    let result = Adopting.diff_(
+      "id",
+      normalisedOuts,
+      {...inputs, tags: Dict.fromArray([("Name", "renamed")])},
+    )
+    expect(result.changes)->toBe(true)
+    expect(result.replaces)->toEqual([])
+  })
+
+  testSync("a name change replaces — CloudWatch cannot rename a group in place", () => {
+    let result = Adopting.diff_(
+      "id",
+      normalisedOuts,
+      {...inputs, logGroupName: "/aws/appsync/apis/def456"},
+    )
+    expect(result.changes)->toBe(true)
+    expect(result.replaces)->toEqual(["logGroupName"])
+  })
+
+  testSync("replacing creates before deleting, so the old group stays readable", () => {
+    let result = Adopting.diff_(
+      "id",
+      normalisedOuts,
+      {...inputs, logGroupName: "/aws/appsync/apis/def456"},
+    )
+    expect(result.deleteBeforeReplace)->toBe(false)
+  })
+
+  // State written by the classic `aws:cloudwatch/logGroup:LogGroup` resource the
+  // alias adopts carries none of this provider's fields. It has to report a
+  // change even when nothing differs, because the following update is what
+  // writes this provider's output shape — and Pulumi's `__provider` — into state.
+  testSync("adopted classic state is always a change, so the update normalises it", () => {
+    let classicOuts: Adopting.outs = {
+      logGroupName: Nullable.undefined,
+      arn: Nullable.undefined,
+      retentionInDays: Nullable.undefined,
+      tags: Nullable.undefined,
+      managedBy: Nullable.undefined,
+    }
+    let result = Adopting.diff_("id", classicOuts, inputs)
+    expect(result.changes)->toBe(true)
+  })
+
+  testSync("adopted classic state never replaces on a field it does not carry", () => {
+    let classicOuts: Adopting.outs = {
+      logGroupName: Nullable.undefined,
+      arn: Nullable.undefined,
+      retentionInDays: Nullable.undefined,
+      tags: Nullable.undefined,
+      managedBy: Nullable.undefined,
+    }
+    let result = Adopting.diff_("id", classicOuts, inputs)
+    expect(result.replaces)->toEqual([])
+  })
+})