Offline, read-only comparison of two exported infrastructure snapshots. It never invokes Terraform/OpenTofu, reads live cloud state, provisions, changes, or deletes resources. The caller supplies complete approved and observed exports in one local JSON file. Snapshot completeness and sensitivity labeling are claims of the exporter; this tool cannot verify them against a provider.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
node bin/infra-drift-snapshotter.mjs --root examples --input passing.json
node bin/infra-drift-snapshotter.mjs --root examples --input failing.json
npm run checkRead the result
--root is the realpath-confined input directory; --input is a relative path within it. Optional --human prints one summary to stderr. Stdout contains only the JSON report. There is no output-file option; redirect stdout deliberately if a file is wanted. Unknown/duplicate options or missing root/input: exit 2 with empty stdout. Unreadable, non-UTF-8, malformed, or unsupported input: incomplete JSON on stdout, exit 2. A completed clean comparison exits 0; evaluated drift exits 1. --help prints usage.
Scope
Maximum input/document size is 1,048,576 UTF-8 bytes, 100 resources per snapshot, JSON nesting depth 8 (root depth 0), and 5,000 ms wall time measured against an injectable library clock. Exact limits are accepted; N+1 is incomplete. Duplicate JSON object keys, including escaped spellings, are refused. UTF-8 decoding is fatal, not replacement-based. The CLI's file read also has a 5-second abort signal. No network or provider calls, no live plan execution, no auto-fix, no semantic interpretation of secrets. Sensitive key lists must be accurate; use an export pipeline that redacts secrets before handing it to this tool.