@go-to-k/cdkd 0.250.0 → 0.251.0

package/dist/cli.js

@@ -1888,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.250.0";
+	return "0.251.0";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -34494,6 +34494,11 @@ const VARIANT_CONFIG_KEY = {
 	ONTAP: "OntapConfiguration",
 	OPENZFS: "OpenZFSConfiguration"
 };
+/**
+* Exported so a unit test can assert every declared-mutable sub-property has
+* a matching `apply*UpdateField` case — the invariant the unreachable
+* `default:` guard enforces at runtime.
+*/
 const VARIANT_MUTABLE_SUBPROPS = {
 	LustreConfiguration: LUSTRE_MUTABLE_SUBPROPS,
 	WindowsConfiguration: WINDOWS_MUTABLE_SUBPROPS,
@@ -34501,6 +34506,21 @@ const VARIANT_MUTABLE_SUBPROPS = {
 	OpenZFSConfiguration: OPENZFS_MUTABLE_SUBPROPS
 };
 /**
+* Copy `value` into `target[key]` only when AWS actually returned it, so the
+* snapshot carries no `undefined`-valued keys.
+*
+* The drift comparator walks the BASELINE's keys (`observedProperties`, or
+* `properties` when a resource predates observed-capture), not the AWS side —
+* so an omitted key here is not itself phantom drift. It matters because this
+* snapshot BECOMES the next baseline: `deploy-engine` stores it as
+* `observedProperties`, and an explicit `Foo: undefined` would then be walked
+* as a real key on every later comparison. Omitting is also what keeps the
+* emitted shape a faithful subset of the CFn input shape.
+*/
+const putIfDefined = (target, key, value) => {
+	if (value !== void 0) target[key] = value;
+};
+/**
 * Compute the Add/Remove route-table-id deltas an ONTAP / OpenZFS
 * `UpdateFileSystem` needs from the previous vs. next `RouteTableIds` list.
 * Route table membership is an unordered set, so a pure reorder yields no
@@ -34927,14 +34947,30 @@ var FSxFileSystemProvider = class {
 			const prevVal = prev[key];
 			if (JSON.stringify(nextVal) === JSON.stringify(prevVal)) continue;
 			if (!mutable.has(key)) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `AWS FSx FileSystem ${configKey}.${key} is immutable on AWS — UpdateFileSystem cannot change it after creation. Re-deploy with cdkd deploy --replace, or destroy + redeploy the stack.`);
-			if (configKey === "LustreConfiguration" ? this.applyLustreUpdateField(key, nextVal, diff) : configKey === "WindowsConfiguration" ? this.applyWindowsUpdateField(key, nextVal, diff) : configKey === "OntapConfiguration" ? this.applyOntapUpdateField(key, nextVal, prevVal, diff) : this.applyOpenZFSUpdateField(key, nextVal, prevVal, diff)) hasMutableDiff = true;
+			const ctx = {
+				resourceType,
+				logicalId,
+				configKey
+			};
+			if (configKey === "LustreConfiguration" ? this.applyLustreUpdateField(ctx, key, nextVal, diff) : configKey === "WindowsConfiguration" ? this.applyWindowsUpdateField(ctx, key, nextVal, diff) : configKey === "OntapConfiguration" ? this.applyOntapUpdateField(ctx, key, nextVal, prevVal, diff) : this.applyOpenZFSUpdateField(ctx, key, nextVal, prevVal, diff)) hasMutableDiff = true;
 		}
 		return {
 			diff,
 			hasMutableDiff
 		};
 	}
-	applyLustreUpdateField(key, next, diff) {
+	/**
+	* A sub-property listed in a `*_MUTABLE_SUBPROPS` set with no matching
+	* `apply*UpdateField` case. Reaching here is a cdkd bug, not user error:
+	* `computeVariantConfigDiff` already accepted the key as mutable, so
+	* falling through would issue a no-op `UpdateFileSystem` (`hasMutableDiff`
+	* true, empty diff) and silently drop the user's change. Fail loudly
+	* instead so the missing mapping surfaces the moment it is added.
+	*/
+	unmappedMutableSubprop(ctx, key) {
+		throw new ProvisioningError(`AWS FSx FileSystem ${ctx.configKey}.${key} is declared mutable but has no UpdateFileSystem mapping in cdkd. This is a cdkd bug — please report it at https://github.com/go-to-k/cdkd/issues`, ctx.resourceType, ctx.logicalId);
+	}
+	applyLustreUpdateField(ctx, key, next, diff) {
 		const out = diff;
 		switch (key) {
 			case "WeeklyMaintenanceStartTime":
@@ -34966,10 +35002,11 @@ var FSxFileSystemProvider = class {
 				} : void 0;
 				break;
 			}
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
-	applyWindowsUpdateField(key, next, diff) {
+	applyWindowsUpdateField(ctx, key, next, diff) {
 		const out = diff;
 		switch (key) {
 			case "WeeklyMaintenanceStartTime":
@@ -34992,10 +35029,11 @@ var FSxFileSystemProvider = class {
 			case "FsrmConfiguration":
 				out.FsrmConfiguration = this.toWindowsFsrmConfiguration(next);
 				break;
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
-	applyOntapUpdateField(key, next, prev, diff) {
+	applyOntapUpdateField(ctx, key, next, prev, diff) {
 		const out = diff;
 		switch (key) {
 			case "DailyAutomaticBackupStartTime":
@@ -35019,10 +35057,11 @@ var FSxFileSystemProvider = class {
 				if (remove) out.RemoveRouteTableIds = remove;
 				return add !== void 0 || remove !== void 0;
 			}
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
-	applyOpenZFSUpdateField(key, next, prev, diff) {
+	applyOpenZFSUpdateField(ctx, key, next, prev, diff) {
 		const out = diff;
 		switch (key) {
 			case "DailyAutomaticBackupStartTime":
@@ -35050,6 +35089,7 @@ var FSxFileSystemProvider = class {
 				if (remove) out.RemoveRouteTableIds = remove;
 				return add !== void 0 || remove !== void 0;
 			}
+			default: this.unmappedMutableSubprop(ctx, key);
 		}
 		return true;
 	}
@@ -35223,28 +35263,122 @@ var FSxFileSystemProvider = class {
 			default: return;
 		}
 	}
+	/** Map the read-side `WindowsConfiguration` back to CFn input shape. */
+	readWindowsConfiguration(windows) {
+		const config = {};
+		putIfDefined(config, "ActiveDirectoryId", windows.ActiveDirectoryId);
+		putIfDefined(config, "DeploymentType", windows.DeploymentType);
+		putIfDefined(config, "PreferredSubnetId", windows.PreferredSubnetId);
+		putIfDefined(config, "ThroughputCapacity", windows.ThroughputCapacity);
+		putIfDefined(config, "WeeklyMaintenanceStartTime", windows.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", windows.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "AutomaticBackupRetentionDays", windows.AutomaticBackupRetentionDays);
+		putIfDefined(config, "CopyTagsToBackups", windows.CopyTagsToBackups);
+		if (windows.Aliases !== void 0) config["Aliases"] = windows.Aliases.map((alias) => alias.Name).filter((name) => name !== void 0);
+		if (windows.SelfManagedActiveDirectoryConfiguration) {
+			const ad = windows.SelfManagedActiveDirectoryConfiguration;
+			const adConfig = {};
+			putIfDefined(adConfig, "DomainName", ad.DomainName);
+			putIfDefined(adConfig, "OrganizationalUnitDistinguishedName", ad.OrganizationalUnitDistinguishedName);
+			putIfDefined(adConfig, "FileSystemAdministratorsGroup", ad.FileSystemAdministratorsGroup);
+			putIfDefined(adConfig, "UserName", ad.UserName);
+			putIfDefined(adConfig, "DnsIps", ad.DnsIps ? [...ad.DnsIps] : void 0);
+			putIfDefined(adConfig, "DomainJoinServiceAccountSecret", ad.DomainJoinServiceAccountSecret);
+			if (Object.keys(adConfig).length > 0) config["SelfManagedActiveDirectoryConfiguration"] = adConfig;
+		}
+		if (windows.AuditLogConfiguration) {
+			const audit = {};
+			putIfDefined(audit, "FileAccessAuditLogLevel", windows.AuditLogConfiguration.FileAccessAuditLogLevel);
+			putIfDefined(audit, "FileShareAccessAuditLogLevel", windows.AuditLogConfiguration.FileShareAccessAuditLogLevel);
+			putIfDefined(audit, "AuditLogDestination", windows.AuditLogConfiguration.AuditLogDestination);
+			if (Object.keys(audit).length > 0) config["AuditLogConfiguration"] = audit;
+		}
+		const diskIops = this.readDiskIopsConfiguration(windows.DiskIopsConfiguration);
+		if (diskIops) config["DiskIopsConfiguration"] = diskIops;
+		if (windows.FsrmConfiguration) {
+			const fsrm = {};
+			putIfDefined(fsrm, "FsrmServiceEnabled", windows.FsrmConfiguration.FsrmServiceEnabled);
+			putIfDefined(fsrm, "EventLogDestination", windows.FsrmConfiguration.EventLogDestination);
+			if (Object.keys(fsrm).length > 0) config["FsrmConfiguration"] = fsrm;
+		}
+		return config;
+	}
+	/** Map the read-side `OntapConfiguration` back to CFn input shape. */
+	readOntapConfiguration(ontap) {
+		const config = {};
+		putIfDefined(config, "DeploymentType", ontap.DeploymentType);
+		putIfDefined(config, "AutomaticBackupRetentionDays", ontap.AutomaticBackupRetentionDays);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", ontap.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "WeeklyMaintenanceStartTime", ontap.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "EndpointIpAddressRange", ontap.EndpointIpAddressRange);
+		putIfDefined(config, "PreferredSubnetId", ontap.PreferredSubnetId);
+		putIfDefined(config, "ThroughputCapacity", ontap.ThroughputCapacity);
+		putIfDefined(config, "ThroughputCapacityPerHAPair", ontap.ThroughputCapacityPerHAPair);
+		putIfDefined(config, "HAPairs", ontap.HAPairs);
+		putIfDefined(config, "RouteTableIds", ontap.RouteTableIds ? [...ontap.RouteTableIds] : void 0);
+		putIfDefined(config, "EndpointIpv6AddressRange", ontap.EndpointIpv6AddressRange);
+		const diskIops = this.readDiskIopsConfiguration(ontap.DiskIopsConfiguration);
+		if (diskIops) config["DiskIopsConfiguration"] = diskIops;
+		return config;
+	}
+	/** Map the read-side `OpenZFSConfiguration` back to CFn input shape. */
+	readOpenZFSConfiguration(openzfs) {
+		const config = {};
+		putIfDefined(config, "DeploymentType", openzfs.DeploymentType);
+		putIfDefined(config, "AutomaticBackupRetentionDays", openzfs.AutomaticBackupRetentionDays);
+		putIfDefined(config, "CopyTagsToBackups", openzfs.CopyTagsToBackups);
+		putIfDefined(config, "CopyTagsToVolumes", openzfs.CopyTagsToVolumes);
+		putIfDefined(config, "DailyAutomaticBackupStartTime", openzfs.DailyAutomaticBackupStartTime);
+		putIfDefined(config, "WeeklyMaintenanceStartTime", openzfs.WeeklyMaintenanceStartTime);
+		putIfDefined(config, "ThroughputCapacity", openzfs.ThroughputCapacity);
+		putIfDefined(config, "PreferredSubnetId", openzfs.PreferredSubnetId);
+		putIfDefined(config, "EndpointIpAddressRange", openzfs.EndpointIpAddressRange);
+		putIfDefined(config, "RouteTableIds", openzfs.RouteTableIds ? [...openzfs.RouteTableIds] : void 0);
+		putIfDefined(config, "EndpointIpv6AddressRange", openzfs.EndpointIpv6AddressRange);
+		const diskIops = this.readDiskIopsConfiguration(openzfs.DiskIopsConfiguration);
+		if (diskIops) config["DiskIopsConfiguration"] = diskIops;
+		if (openzfs.ReadCacheConfiguration) {
+			const readCache = {};
+			putIfDefined(readCache, "SizingMode", openzfs.ReadCacheConfiguration.SizingMode);
+			putIfDefined(readCache, "SizeGiB", openzfs.ReadCacheConfiguration.SizeGiB);
+			if (Object.keys(readCache).length > 0) config["ReadCacheConfiguration"] = readCache;
+		}
+		return config;
+	}
+	/** Shared `DiskIopsConfiguration` reverse-mapper (Windows / ONTAP / OpenZFS). */
+	readDiskIopsConfiguration(diskIops) {
+		if (!diskIops) return void 0;
+		const out = {};
+		putIfDefined(out, "Mode", diskIops.Mode);
+		putIfDefined(out, "Iops", diskIops.Iops);
+		return Object.keys(out).length > 0 ? out : void 0;
+	}
 	/**
 	* State property paths this provider cannot read back from AWS:
 	*  - `SecurityGroupIds` — `DescribeFileSystems` returns network
 	*    interface ids, never the original security group list.
 	*  - `BackupId` — creation-source input, not surfaced on the deployed
 	*    file system.
-	*  - `WindowsConfiguration` / `OntapConfiguration` / `OpenZFSConfiguration`
-	*    — `readCurrentState` maps only the Lustre block back to CFn shape
-	*    today, so drift on the non-Lustre variant blocks is not yet computed;
-	*    marking them unknown avoids a guaranteed false positive on every run
-	*    (variant-config drift is a follow-up). Only the block matching the
-	*    file system's type is ever present in state, so listing all three is
-	*    harmless.
+	*  - `WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password`
+	*    / `OntapConfiguration.FsxAdminPassword` — write-only credentials; the
+	*    API never echoes them back.
+	*  - `OpenZFSConfiguration.RootVolumeConfiguration` — configured on the
+	*    root VOLUME, not the file system; `DescribeFileSystems` returns only
+	*    `RootVolumeId`, so reading it back would need a separate
+	*    `DescribeVolumes` call (out of scope here).
+	*
+	* The whole-block `WindowsConfiguration` / `OntapConfiguration` /
+	* `OpenZFSConfiguration` entries are gone as of the variant reverse-mappers
+	* — only the individually-unreadable leaves above stay unknown.
 	*/
 	getDriftUnknownPaths(resourceType) {
 		if (resourceType !== "AWS::FSx::FileSystem") return [];
 		return [
 			"SecurityGroupIds",
 			"BackupId",
-			"WindowsConfiguration",
-			"OntapConfiguration",
-			"OpenZFSConfiguration"
+			"WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.Password",
+			"OntapConfiguration.FsxAdminPassword",
+			"OpenZFSConfiguration.RootVolumeConfiguration"
 		];
 	}
 	/**
@@ -35252,7 +35386,11 @@ var FSxFileSystemProvider = class {
 	* via `DescribeFileSystems`. Lustre data-repository fields (`ImportPath`
 	* / `ExportPath` / `AutoImportPolicy` / `ImportedFileChunkSize`) are
 	* mapped back from the nested `DataRepositoryConfiguration` the API
-	* returns. Returns `undefined` when the file system is gone.
+	* returns. The Windows / ONTAP / OpenZFS variant blocks are reverse-mapped
+	* by their respective `read*Configuration` helpers; the few inputs AWS
+	* never returns stay listed in {@link getDriftUnknownPaths}. At most one
+	* variant block is ever present (they key off `FileSystemType`).
+	* Returns `undefined` when the file system is gone.
 	*/
 	async readCurrentState(physicalId, _logicalId, resourceType) {
 		if (resourceType !== "AWS::FSx::FileSystem") return void 0;
@@ -35265,47 +35403,59 @@ var FSxFileSystemProvider = class {
 		}
 		if (!fs) return void 0;
 		const result = {};
-		if (fs.FileSystemType !== void 0) result["FileSystemType"] = fs.FileSystemType;
-		if (fs.StorageCapacity !== void 0) result["StorageCapacity"] = fs.StorageCapacity;
-		if (fs.StorageType !== void 0) result["StorageType"] = fs.StorageType;
-		if (fs.SubnetIds !== void 0) result["SubnetIds"] = [...fs.SubnetIds];
-		if (fs.KmsKeyId !== void 0) result["KmsKeyId"] = fs.KmsKeyId;
-		if (fs.FileSystemTypeVersion !== void 0) result["FileSystemTypeVersion"] = fs.FileSystemTypeVersion;
-		if (fs.NetworkType !== void 0) result["NetworkType"] = fs.NetworkType;
+		putIfDefined(result, "FileSystemType", fs.FileSystemType);
+		putIfDefined(result, "StorageCapacity", fs.StorageCapacity);
+		putIfDefined(result, "StorageType", fs.StorageType);
+		putIfDefined(result, "SubnetIds", fs.SubnetIds ? [...fs.SubnetIds] : void 0);
+		putIfDefined(result, "KmsKeyId", fs.KmsKeyId);
+		putIfDefined(result, "FileSystemTypeVersion", fs.FileSystemTypeVersion);
+		putIfDefined(result, "NetworkType", fs.NetworkType);
 		const lustre = fs.LustreConfiguration;
 		if (lustre) {
 			const config = {};
-			if (lustre.WeeklyMaintenanceStartTime !== void 0) config["WeeklyMaintenanceStartTime"] = lustre.WeeklyMaintenanceStartTime;
-			if (lustre.DeploymentType !== void 0) config["DeploymentType"] = lustre.DeploymentType;
-			if (lustre.PerUnitStorageThroughput !== void 0) config["PerUnitStorageThroughput"] = lustre.PerUnitStorageThroughput;
-			if (lustre.DailyAutomaticBackupStartTime !== void 0) config["DailyAutomaticBackupStartTime"] = lustre.DailyAutomaticBackupStartTime;
-			if (lustre.AutomaticBackupRetentionDays !== void 0) config["AutomaticBackupRetentionDays"] = lustre.AutomaticBackupRetentionDays;
-			if (lustre.CopyTagsToBackups !== void 0) config["CopyTagsToBackups"] = lustre.CopyTagsToBackups;
-			if (lustre.DriveCacheType !== void 0) config["DriveCacheType"] = lustre.DriveCacheType;
-			if (lustre.DataCompressionType !== void 0) config["DataCompressionType"] = lustre.DataCompressionType;
-			if (lustre.EfaEnabled !== void 0) config["EfaEnabled"] = lustre.EfaEnabled;
-			if (lustre.ThroughputCapacity !== void 0) config["ThroughputCapacity"] = lustre.ThroughputCapacity;
+			putIfDefined(config, "WeeklyMaintenanceStartTime", lustre.WeeklyMaintenanceStartTime);
+			putIfDefined(config, "DeploymentType", lustre.DeploymentType);
+			putIfDefined(config, "PerUnitStorageThroughput", lustre.PerUnitStorageThroughput);
+			putIfDefined(config, "DailyAutomaticBackupStartTime", lustre.DailyAutomaticBackupStartTime);
+			putIfDefined(config, "AutomaticBackupRetentionDays", lustre.AutomaticBackupRetentionDays);
+			putIfDefined(config, "CopyTagsToBackups", lustre.CopyTagsToBackups);
+			putIfDefined(config, "DriveCacheType", lustre.DriveCacheType);
+			putIfDefined(config, "DataCompressionType", lustre.DataCompressionType);
+			putIfDefined(config, "EfaEnabled", lustre.EfaEnabled);
+			putIfDefined(config, "ThroughputCapacity", lustre.ThroughputCapacity);
 			if (lustre.MetadataConfiguration) {
 				const metadata = {};
-				if (lustre.MetadataConfiguration.Mode !== void 0) metadata["Mode"] = lustre.MetadataConfiguration.Mode;
-				if (lustre.MetadataConfiguration.Iops !== void 0) metadata["Iops"] = lustre.MetadataConfiguration.Iops;
+				putIfDefined(metadata, "Mode", lustre.MetadataConfiguration.Mode);
+				putIfDefined(metadata, "Iops", lustre.MetadataConfiguration.Iops);
 				if (Object.keys(metadata).length > 0) config["MetadataConfiguration"] = metadata;
 			}
 			if (lustre.DataReadCacheConfiguration) {
 				const readCache = {};
-				if (lustre.DataReadCacheConfiguration.SizingMode !== void 0) readCache["SizingMode"] = lustre.DataReadCacheConfiguration.SizingMode;
-				if (lustre.DataReadCacheConfiguration.SizeGiB !== void 0) readCache["SizeGiB"] = lustre.DataReadCacheConfiguration.SizeGiB;
+				putIfDefined(readCache, "SizingMode", lustre.DataReadCacheConfiguration.SizingMode);
+				putIfDefined(readCache, "SizeGiB", lustre.DataReadCacheConfiguration.SizeGiB);
 				if (Object.keys(readCache).length > 0) config["DataReadCacheConfiguration"] = readCache;
 			}
 			const dataRepo = lustre.DataRepositoryConfiguration;
 			if (dataRepo) {
-				if (dataRepo.ImportPath !== void 0) config["ImportPath"] = dataRepo.ImportPath;
-				if (dataRepo.ExportPath !== void 0) config["ExportPath"] = dataRepo.ExportPath;
-				if (dataRepo.AutoImportPolicy !== void 0) config["AutoImportPolicy"] = dataRepo.AutoImportPolicy;
-				if (dataRepo.ImportedFileChunkSize !== void 0) config["ImportedFileChunkSize"] = dataRepo.ImportedFileChunkSize;
+				putIfDefined(config, "ImportPath", dataRepo.ImportPath);
+				putIfDefined(config, "ExportPath", dataRepo.ExportPath);
+				putIfDefined(config, "AutoImportPolicy", dataRepo.AutoImportPolicy);
+				putIfDefined(config, "ImportedFileChunkSize", dataRepo.ImportedFileChunkSize);
 			}
 			if (Object.keys(config).length > 0) result["LustreConfiguration"] = config;
 		}
+		if (fs.WindowsConfiguration) {
+			const config = this.readWindowsConfiguration(fs.WindowsConfiguration);
+			if (Object.keys(config).length > 0) result["WindowsConfiguration"] = config;
+		}
+		if (fs.OntapConfiguration) {
+			const config = this.readOntapConfiguration(fs.OntapConfiguration);
+			if (Object.keys(config).length > 0) result["OntapConfiguration"] = config;
+		}
+		if (fs.OpenZFSConfiguration) {
+			const config = this.readOpenZFSConfiguration(fs.OpenZFSConfiguration);
+			if (Object.keys(config).length > 0) result["OpenZFSConfiguration"] = config;
+		}
 		result["Tags"] = normalizeAwsTagsToCfn(fs.Tags);
 		return result;
 	}
@@ -61608,7 +61758,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.250.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.251.0");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());