@go-to-k/cdkd 0.252.0 → 0.252.1

package/dist/cli.js

@@ -1888,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.252.0";
+	return "0.252.1";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -35555,6 +35555,38 @@ var FSxFileSystemProvider = class {
 		];
 	}
 	/**
+	* Plain-string arrays FSx returns as unordered sets.
+	*
+	*  - `WindowsConfiguration.Aliases` — DNS alias names (`files.example.com`).
+	*    Alternate names the file system answers to; the API documents no
+	*    ordering semantics and no name is privileged over another, so a
+	*    `DescribeFileSystems` reorder carries no meaning.
+	*
+	* This does not match the shared normalizer's AWS-id / ARN heuristic, so
+	* without the declaration a reorder would surface as phantom drift. Declared
+	* here rather than sorted in `readWindowsConfiguration` so the sort applies
+	* to BOTH comparison sides — see
+	* {@link ResourceProvider.getDriftUnorderedPaths}.
+	*
+	* Deliberately NOT declared:
+	*
+	*  - `WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.DnsIps` —
+	*    the API reference describes it only as "A list of IP addresses of DNS
+	*    servers or domain controllers in the self-managed AD directory"
+	*    (https://docs.aws.amazon.com/fsx/latest/APIReference/API_SelfManagedActiveDirectoryConfiguration.html),
+	*    with no statement that order is insignificant. DNS resolver lists are
+	*    conventionally preference-ordered (primary first), and if FSx honors
+	*    that when joining the domain, sorting would HIDE a real reorder. A
+	*    false positive is visible and correctable; silently hiding drift is
+	*    not. Same reasoning excludes ElastiCache `PreferredAvailabilityZones`.
+	*  - `OntapConfiguration.RouteTableIds` / `OpenZFSConfiguration.RouteTableIds`
+	*    — their `rtb-` elements already match the shared id heuristic.
+	*/
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::FSx::FileSystem") return [];
+		return ["WindowsConfiguration.Aliases"];
+	}
+	/**
 	* Read the AWS-current file system configuration in CFn-property shape
 	* via `DescribeFileSystems`. Lustre data-repository fields (`ImportPath`
 	* / `ExportPath` / `AutoImportPolicy` / `ImportedFileChunkSize`) are
@@ -44691,6 +44723,19 @@ function createDiffCommand() {
 * on BOTH sides before the diff. These two passes were surfaced by dogfooding
 * the sibling cdk-real-drift (cdkrd) tool, which hit the same false-positive
 * classes against the same kind of AWS-snapshot baseline.
+*
+* Plain-string arrays are NOT canonicalized by the two heuristic passes above,
+* because a scalar list can be order-significant. But several CFn inputs are
+* semantically unordered sets of plain strings (FSx `WindowsConfiguration.Aliases`,
+* `...SelfManagedActiveDirectoryConfiguration.DnsIps`, ...), so
+* {@link canonicalizeUnorderedArraysAtPaths} sorts them at an explicit,
+* provider-declared path list only — an opt-in seam mirroring
+* `getDriftUnknownPaths` (see `ResourceProvider.getDriftUnorderedPaths`).
+* Doing it HERE rather than inside the provider's reverse-mapper is load-bearing:
+* the normalizer runs on BOTH comparison sides, so it stays correct for the
+* `properties`-fallback baseline (a resource deployed before observed-capture,
+* whose baseline is the user's TEMPLATE order). Sorting only the AWS read side
+* would manufacture drift on exactly that path.
 */
 function canonicalizeTagListsDeep(v) {
 	if (Array.isArray(v)) {
@@ -44725,6 +44770,72 @@ function canonicalizeIdArraysDeep(v) {
 	}
 	return v;
 }
+/**
+* Match a dotted property path against a provider-declared path list.
+*
+* An entry matches when the path is exactly equal to it, OR when the entry is
+* a prefix followed by `.`. Every entry is therefore a SUBTREE declaration:
+* `'VpcConfig'` matches `VpcConfig`, `VpcConfig.SubnetIds`, and anything
+* deeper. There is no leaf-only form.
+*
+* Shared by the two provider-declared path lists so their semantics cannot
+* drift apart: `getDriftUnknownPaths` (via `isIgnoredPath` in
+* `drift-calculator.ts`) and `getDriftUnorderedPaths` (via
+* {@link canonicalizeUnorderedArraysAtPaths} below).
+*/
+function matchesPathPrefix(path, entries) {
+	for (const entry of entries) {
+		if (path === entry) return true;
+		if (path.startsWith(`${entry}.`)) return true;
+	}
+	return false;
+}
+/**
+* Sort plain-string arrays found at one of the provider-declared `paths`, and
+* ONLY there. Unlike the two heuristic passes above, this one is opt-in per
+* resource type via `ResourceProvider.getDriftUnorderedPaths` — a scalar list
+* is order-significant unless the provider says otherwise.
+*
+* Paths use dot-notation for nested keys and are matched by the shared
+* {@link matchesPathPrefix} rule, the same one `getDriftUnknownPaths` uses. So
+* `'WindowsConfiguration'` covers every plain-string array in that subtree, and
+* `'WindowsConfiguration.Aliases'` covers that path and everything beneath it
+* (every entry is a subtree declaration — there is no leaf-only form).
+*
+* One semantic DIVERGENCE from `getDriftUnknownPaths`, required for this pass
+* to work: `isIgnoredPath` never sees a path that crosses an array, because the
+* comparator's `diffAt` compares arrays wholesale via `deepEqual` and never
+* descends into elements. This walk DOES descend into array elements, giving
+* each element its parent's path (array indices never appear in paths). So
+* `'Items.Aliases'` is meaningful here — it reaches an `Aliases` array inside
+* each element of `Items` — while being inert as an ignore-path. The divergence
+* is strictly more permissive; nothing that matches for ignore-paths fails to
+* match here.
+*
+* Only arrays whose every element is a plain string are sorted, so a
+* mis-declared path can never reorder object or mixed-type elements. Nested
+* arrays are also left alone: an array element that is itself an array is not
+* descended into, so `{P: [['b','a']]}` never has its INNER list sorted by a
+* `'P'` declaration (no CFn shape in tree is an array-of-arrays, and sorting
+* one would contradict the plain-string-elements-only rule).
+*/
+function canonicalizeUnorderedArraysAtPaths(v, paths) {
+	if (paths.length === 0) return v;
+	return walkUnordered(v, "", paths);
+}
+function walkUnordered(v, path, paths) {
+	if (Array.isArray(v)) {
+		const mapped = v.map((el) => Array.isArray(el) ? el : walkUnordered(el, path, paths));
+		if (mapped.length > 1 && matchesPathPrefix(path, paths) && mapped.every((el) => typeof el === "string")) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+		return mapped;
+	}
+	if (v && typeof v === "object") {
+		const out = {};
+		for (const [k, val] of Object.entries(v)) out[k] = walkUnordered(val, path === "" ? k : `${path}.${k}`, paths);
+		return out;
+	}
+	return v;
+}
 
 //#endregion
 //#region src/analyzer/drift-calculator.ts
@@ -44784,25 +44895,35 @@ function canonicalizeIdArraysDeep(v) {
 * it is exactly equal to the entry, or when the entry is a prefix followed
 * by `.` — so `'Code'` excludes the whole `Code` subtree, and
 * `'VpcConfig.SubnetIds'` excludes only that leaf.
+*
+* `options.unorderedPaths` is supplied by the provider (via
+* `getDriftUnorderedPaths`) for plain-string arrays that are semantically
+* UNORDERED sets — e.g. FSx `WindowsConfiguration.Aliases`. Those are sorted on
+* BOTH sides before comparison so an AWS-side reorder is not phantom drift.
+* Path matching uses the same prefix rule as `ignorePaths`.
 */
 function calculateResourceDrift(stateProperties, awsProperties, options) {
 	const drifts = [];
 	const ignore = options?.ignorePaths ?? [];
 	const union = options?.unionWalkObjects ?? false;
-	stateProperties = canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties));
-	awsProperties = canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties));
+	const unordered = options?.unorderedPaths ?? [];
+	stateProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties)), unordered);
+	awsProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties)), unordered);
 	for (const key of Object.keys(stateProperties)) {
 		if (isIgnoredPath(key, ignore)) continue;
 		diffAt(key, stateProperties[key], awsProperties[key], drifts, ignore, union);
 	}
 	return drifts;
 }
+/**
+* Thin alias over the shared {@link matchesPathPrefix} rule, kept as a named
+* function because "ignored" is what the path list means at these call sites.
+* Sharing the implementation with `getDriftUnorderedPaths` is deliberate: both
+* lists are provider-declared and documented as reading the same way, so they
+* must not be able to drift apart.
+*/
 function isIgnoredPath(path, ignorePaths) {
-	for (const entry of ignorePaths) {
-		if (path === entry) return true;
-		if (path.startsWith(`${entry}.`)) return true;
-	}
-	return false;
+	return matchesPathPrefix(path, ignorePaths);
 }
 /**
 * Recursive worker. Pushes drift entries into `out` rather than
@@ -45204,10 +45325,12 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				continue;
 			}
 			const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType) : [];
+			const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
 			const useObserved = resource.observedProperties !== void 0;
 			const changes = calculateResourceDrift(useObserved ? resource.observedProperties : resource.properties ?? {}, aws, {
 				ignorePaths,
-				unionWalkObjects: useObserved
+				unionWalkObjects: useObserved,
+				unorderedPaths
 			});
 			if (changes.length === 0) outcomes.push({
 				kind: "clean",
@@ -62017,7 +62140,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.252.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.252.1");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());