@go-to-k/cdkd 0.252.0 → 0.252.2

package/dist/cli.js

@@ -1888,7 +1888,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.252.0";
+	return "0.252.2";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -24565,19 +24565,15 @@ var RDSDBProxyProvider = class {
 			return {
 				physicalId,
 				attributes: {
-					DBProxyArn: proxy?.DBProxyArn ?? "",
-					Endpoint: proxy?.Endpoint ?? "",
-					VpcId: proxy?.VpcId ?? ""
+					...proxy?.DBProxyArn && { DBProxyArn: proxy.DBProxyArn },
+					...proxy?.Endpoint && { Endpoint: proxy.Endpoint },
+					...proxy?.VpcId && { VpcId: proxy.VpcId }
 				}
 			};
 		} catch {
 			return {
 				physicalId,
-				attributes: {
-					DBProxyArn: "",
-					Endpoint: "",
-					VpcId: ""
-				}
+				attributes: {}
 			};
 		}
 	}
@@ -24892,21 +24888,16 @@ var RDSDBProxyEndpointProvider = class {
 			return {
 				physicalId,
 				attributes: {
-					Endpoint: ep?.Endpoint ?? "",
-					DBProxyEndpointArn: ep?.DBProxyEndpointArn ?? "",
-					IsDefault: ep?.IsDefault ?? false,
-					VpcId: ep?.VpcId ?? ""
+					...ep?.Endpoint && { Endpoint: ep.Endpoint },
+					...ep?.DBProxyEndpointArn && { DBProxyEndpointArn: ep.DBProxyEndpointArn },
+					...ep && { IsDefault: ep.IsDefault ?? false },
+					...ep?.VpcId && { VpcId: ep.VpcId }
 				}
 			};
 		} catch {
 			return {
 				physicalId,
-				attributes: {
-					Endpoint: "",
-					DBProxyEndpointArn: "",
-					IsDefault: false,
-					VpcId: ""
-				}
+				attributes: {}
 			};
 		}
 	}
@@ -33774,13 +33765,14 @@ var SchedulerScheduleProvider = class {
 		const groupName = this.groupNameOf(properties);
 		this.logger.debug(`Creating Schedule ${logicalId}: ${name}${groupName ? ` (group: ${groupName})` : ""}`);
 		try {
+			const response = await this.getClient().send(new CreateScheduleCommand({
+				Name: name,
+				...groupName && { GroupName: groupName },
+				...this.toSdkFields(properties)
+			}));
 			return {
 				physicalId: name,
-				attributes: { Arn: (await this.getClient().send(new CreateScheduleCommand({
-					Name: name,
-					...groupName && { GroupName: groupName },
-					...this.toSdkFields(properties)
-				}))).ScheduleArn ?? "" }
+				attributes: response.ScheduleArn ? { Arn: response.ScheduleArn } : {}
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -33798,10 +33790,11 @@ var SchedulerScheduleProvider = class {
 				...groupName && { GroupName: groupName },
 				...this.toSdkFields(properties)
 			};
+			const response = await this.getClient().send(new UpdateScheduleCommand(input));
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: { Arn: (await this.getClient().send(new UpdateScheduleCommand(input))).ScheduleArn ?? "" }
+				attributes: response.ScheduleArn ? { Arn: response.ScheduleArn } : {}
 			};
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError) throw error;
@@ -33889,12 +33882,13 @@ var SchedulerScheduleProvider = class {
 		if (!explicit) return null;
 		const groupName = this.groupNameOf(input.properties);
 		try {
+			const response = await this.getClient().send(new GetScheduleCommand({
+				Name: explicit,
+				...groupName && { GroupName: groupName }
+			}));
 			return {
 				physicalId: explicit,
-				attributes: { Arn: (await this.getClient().send(new GetScheduleCommand({
-					Name: explicit,
-					...groupName && { GroupName: groupName }
-				}))).Arn ?? "" }
+				attributes: response.Arn ? { Arn: response.Arn } : {}
 			};
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$9) return null;
@@ -35555,6 +35549,38 @@ var FSxFileSystemProvider = class {
 		];
 	}
 	/**
+	* Plain-string arrays FSx returns as unordered sets.
+	*
+	*  - `WindowsConfiguration.Aliases` — DNS alias names (`files.example.com`).
+	*    Alternate names the file system answers to; the API documents no
+	*    ordering semantics and no name is privileged over another, so a
+	*    `DescribeFileSystems` reorder carries no meaning.
+	*
+	* This does not match the shared normalizer's AWS-id / ARN heuristic, so
+	* without the declaration a reorder would surface as phantom drift. Declared
+	* here rather than sorted in `readWindowsConfiguration` so the sort applies
+	* to BOTH comparison sides — see
+	* {@link ResourceProvider.getDriftUnorderedPaths}.
+	*
+	* Deliberately NOT declared:
+	*
+	*  - `WindowsConfiguration.SelfManagedActiveDirectoryConfiguration.DnsIps` —
+	*    the API reference describes it only as "A list of IP addresses of DNS
+	*    servers or domain controllers in the self-managed AD directory"
+	*    (https://docs.aws.amazon.com/fsx/latest/APIReference/API_SelfManagedActiveDirectoryConfiguration.html),
+	*    with no statement that order is insignificant. DNS resolver lists are
+	*    conventionally preference-ordered (primary first), and if FSx honors
+	*    that when joining the domain, sorting would HIDE a real reorder. A
+	*    false positive is visible and correctable; silently hiding drift is
+	*    not. Same reasoning excludes ElastiCache `PreferredAvailabilityZones`.
+	*  - `OntapConfiguration.RouteTableIds` / `OpenZFSConfiguration.RouteTableIds`
+	*    — their `rtb-` elements already match the shared id heuristic.
+	*/
+	getDriftUnorderedPaths(resourceType) {
+		if (resourceType !== "AWS::FSx::FileSystem") return [];
+		return ["WindowsConfiguration.Aliases"];
+	}
+	/**
 	* Read the AWS-current file system configuration in CFn-property shape
 	* via `DescribeFileSystems`. Lustre data-repository fields (`ImportPath`
 	* / `ExportPath` / `AutoImportPolicy` / `ImportedFileChunkSize`) are
@@ -39947,7 +39973,7 @@ var DLMLifecyclePolicyProvider = class {
 			const response = await this.getClient().send(new GetLifecyclePolicyCommand$1({ PolicyId: input.knownPhysicalId }));
 			return response.Policy?.PolicyId ? {
 				physicalId: input.knownPhysicalId,
-				attributes: { Arn: response.Policy.PolicyArn ?? "" }
+				attributes: response.Policy.PolicyArn ? { Arn: response.Policy.PolicyArn } : {}
 			} : null;
 		} catch (err) {
 			if (err instanceof ResourceNotFoundException$12) return null;
@@ -44691,6 +44717,19 @@ function createDiffCommand() {
 * on BOTH sides before the diff. These two passes were surfaced by dogfooding
 * the sibling cdk-real-drift (cdkrd) tool, which hit the same false-positive
 * classes against the same kind of AWS-snapshot baseline.
+*
+* Plain-string arrays are NOT canonicalized by the two heuristic passes above,
+* because a scalar list can be order-significant. But several CFn inputs are
+* semantically unordered sets of plain strings (FSx `WindowsConfiguration.Aliases`,
+* `...SelfManagedActiveDirectoryConfiguration.DnsIps`, ...), so
+* {@link canonicalizeUnorderedArraysAtPaths} sorts them at an explicit,
+* provider-declared path list only — an opt-in seam mirroring
+* `getDriftUnknownPaths` (see `ResourceProvider.getDriftUnorderedPaths`).
+* Doing it HERE rather than inside the provider's reverse-mapper is load-bearing:
+* the normalizer runs on BOTH comparison sides, so it stays correct for the
+* `properties`-fallback baseline (a resource deployed before observed-capture,
+* whose baseline is the user's TEMPLATE order). Sorting only the AWS read side
+* would manufacture drift on exactly that path.
 */
 function canonicalizeTagListsDeep(v) {
 	if (Array.isArray(v)) {
@@ -44725,6 +44764,72 @@ function canonicalizeIdArraysDeep(v) {
 	}
 	return v;
 }
+/**
+* Match a dotted property path against a provider-declared path list.
+*
+* An entry matches when the path is exactly equal to it, OR when the entry is
+* a prefix followed by `.`. Every entry is therefore a SUBTREE declaration:
+* `'VpcConfig'` matches `VpcConfig`, `VpcConfig.SubnetIds`, and anything
+* deeper. There is no leaf-only form.
+*
+* Shared by the two provider-declared path lists so their semantics cannot
+* drift apart: `getDriftUnknownPaths` (via `isIgnoredPath` in
+* `drift-calculator.ts`) and `getDriftUnorderedPaths` (via
+* {@link canonicalizeUnorderedArraysAtPaths} below).
+*/
+function matchesPathPrefix(path, entries) {
+	for (const entry of entries) {
+		if (path === entry) return true;
+		if (path.startsWith(`${entry}.`)) return true;
+	}
+	return false;
+}
+/**
+* Sort plain-string arrays found at one of the provider-declared `paths`, and
+* ONLY there. Unlike the two heuristic passes above, this one is opt-in per
+* resource type via `ResourceProvider.getDriftUnorderedPaths` — a scalar list
+* is order-significant unless the provider says otherwise.
+*
+* Paths use dot-notation for nested keys and are matched by the shared
+* {@link matchesPathPrefix} rule, the same one `getDriftUnknownPaths` uses. So
+* `'WindowsConfiguration'` covers every plain-string array in that subtree, and
+* `'WindowsConfiguration.Aliases'` covers that path and everything beneath it
+* (every entry is a subtree declaration — there is no leaf-only form).
+*
+* One semantic DIVERGENCE from `getDriftUnknownPaths`, required for this pass
+* to work: `isIgnoredPath` never sees a path that crosses an array, because the
+* comparator's `diffAt` compares arrays wholesale via `deepEqual` and never
+* descends into elements. This walk DOES descend into array elements, giving
+* each element its parent's path (array indices never appear in paths). So
+* `'Items.Aliases'` is meaningful here — it reaches an `Aliases` array inside
+* each element of `Items` — while being inert as an ignore-path. The divergence
+* is strictly more permissive; nothing that matches for ignore-paths fails to
+* match here.
+*
+* Only arrays whose every element is a plain string are sorted, so a
+* mis-declared path can never reorder object or mixed-type elements. Nested
+* arrays are also left alone: an array element that is itself an array is not
+* descended into, so `{P: [['b','a']]}` never has its INNER list sorted by a
+* `'P'` declaration (no CFn shape in tree is an array-of-arrays, and sorting
+* one would contradict the plain-string-elements-only rule).
+*/
+function canonicalizeUnorderedArraysAtPaths(v, paths) {
+	if (paths.length === 0) return v;
+	return walkUnordered(v, "", paths);
+}
+function walkUnordered(v, path, paths) {
+	if (Array.isArray(v)) {
+		const mapped = v.map((el) => Array.isArray(el) ? el : walkUnordered(el, path, paths));
+		if (mapped.length > 1 && matchesPathPrefix(path, paths) && mapped.every((el) => typeof el === "string")) return [...mapped].sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+		return mapped;
+	}
+	if (v && typeof v === "object") {
+		const out = {};
+		for (const [k, val] of Object.entries(v)) out[k] = walkUnordered(val, path === "" ? k : `${path}.${k}`, paths);
+		return out;
+	}
+	return v;
+}
 
 //#endregion
 //#region src/analyzer/drift-calculator.ts
@@ -44784,25 +44889,35 @@ function canonicalizeIdArraysDeep(v) {
 * it is exactly equal to the entry, or when the entry is a prefix followed
 * by `.` — so `'Code'` excludes the whole `Code` subtree, and
 * `'VpcConfig.SubnetIds'` excludes only that leaf.
+*
+* `options.unorderedPaths` is supplied by the provider (via
+* `getDriftUnorderedPaths`) for plain-string arrays that are semantically
+* UNORDERED sets — e.g. FSx `WindowsConfiguration.Aliases`. Those are sorted on
+* BOTH sides before comparison so an AWS-side reorder is not phantom drift.
+* Path matching uses the same prefix rule as `ignorePaths`.
 */
 function calculateResourceDrift(stateProperties, awsProperties, options) {
 	const drifts = [];
 	const ignore = options?.ignorePaths ?? [];
 	const union = options?.unionWalkObjects ?? false;
-	stateProperties = canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties));
-	awsProperties = canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties));
+	const unordered = options?.unorderedPaths ?? [];
+	stateProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(stateProperties)), unordered);
+	awsProperties = canonicalizeUnorderedArraysAtPaths(canonicalizeIdArraysDeep(canonicalizeTagListsDeep(awsProperties)), unordered);
 	for (const key of Object.keys(stateProperties)) {
 		if (isIgnoredPath(key, ignore)) continue;
 		diffAt(key, stateProperties[key], awsProperties[key], drifts, ignore, union);
 	}
 	return drifts;
 }
+/**
+* Thin alias over the shared {@link matchesPathPrefix} rule, kept as a named
+* function because "ignored" is what the path list means at these call sites.
+* Sharing the implementation with `getDriftUnorderedPaths` is deliberate: both
+* lists are provider-declared and documented as reading the same way, so they
+* must not be able to drift apart.
+*/
 function isIgnoredPath(path, ignorePaths) {
-	for (const entry of ignorePaths) {
-		if (path === entry) return true;
-		if (path.startsWith(`${entry}.`)) return true;
-	}
-	return false;
+	return matchesPathPrefix(path, ignorePaths);
 }
 /**
 * Recursive worker. Pushes drift entries into `out` rather than
@@ -45204,10 +45319,12 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				continue;
 			}
 			const ignorePaths = provider.getDriftUnknownPaths ? provider.getDriftUnknownPaths(resource.resourceType) : [];
+			const unorderedPaths = provider.getDriftUnorderedPaths ? provider.getDriftUnorderedPaths(resource.resourceType) : [];
 			const useObserved = resource.observedProperties !== void 0;
 			const changes = calculateResourceDrift(useObserved ? resource.observedProperties : resource.properties ?? {}, aws, {
 				ignorePaths,
-				unionWalkObjects: useObserved
+				unionWalkObjects: useObserved,
+				unorderedPaths
 			});
 			if (changes.length === 0) outcomes.push({
 				kind: "clean",
@@ -51901,7 +52018,8 @@ async function importOne(task) {
 			logicalId,
 			resourceType: resource.Type,
 			outcome: "imported",
-			physicalId: result.physicalId
+			physicalId: result.physicalId,
+			...result.attributes !== void 0 && { attributes: result.attributes }
 		};
 	} catch (error) {
 		const msg = error instanceof Error ? error.message : String(error);
@@ -52044,11 +52162,14 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 		const tmplResource = template.Resources[row.logicalId];
 		if (!tmplResource) continue;
 		const deps = [...templateParser.extractDependencies(tmplResource)].filter((dep) => !parameterNames.has(dep));
+		const prior = existingState?.resources[row.logicalId];
+		const priorAttributes = prior && prior.physicalId === row.physicalId ? prior.attributes : void 0;
+		const rowAttributes = row.attributes && Object.keys(row.attributes).length > 0 ? row.attributes : void 0;
 		resources[row.logicalId] = {
 			physicalId: row.physicalId,
 			resourceType: row.resourceType,
 			properties: tmplResource.Properties ?? {},
-			attributes: {},
+			attributes: rowAttributes ?? priorAttributes ?? {},
 			dependencies: deps,
 			provisionedBy: "sdk"
 		};
@@ -62017,7 +62138,7 @@ function reorderArgs(argv) {
 async function main() {
 	installPipeCloseHandler();
 	const program = new Command();
-	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.252.0");
+	program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.252.2");
 	program.addCommand(createBootstrapCommand());
 	program.addCommand(createSynthCommand());
 	program.addCommand(createListCommand());