feat(ql3): persist cluster secret transition receipts

packages/ql3-runtime-core/src/plugin-package/secret-binding/transitionPlan.ts

@@ -1,4 +1,5 @@
 import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
 
 import { normalizePluginPackageResourceGeneration } from '../pluginPackageResourceGeneration';
 import {
@@ -466,7 +467,7 @@ export function normalizePluginPackageSecretBindingTransitionPlan(
     nextBindingPlan,
   );
   if (
-    JSON.stringify(plan.changes) !== JSON.stringify(unsigned.changes) ||
+    !isDeepStrictEqual(plan.changes, unsigned.changes) ||
     plan.kind !== unsigned.kind
   ) {
     return invalid('derived transition classification does not match content');

packages/ql3-runtime-core/test/pluginPackageSecretBindingTransitionPlan.test.cjs

@@ -104,6 +104,20 @@ function transition(assignments, overrides = {}) {
   });
 }
 
+function postgresJsonbRoundTrip(value) {
+  if (Array.isArray(value)) {
+    return value.map(postgresJsonbRoundTrip);
+  }
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(
+      Object.entries(value)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, entry]) => [key, postgresJsonbRoundTrip(entry)]),
+    );
+  }
+  return value;
+}
+
 test('derives an exact carry-forward for an unchanged next generation', () => {
   const value = transition([
     { name: 'OPTIONAL_TOKEN', secretRef: null },
@@ -136,6 +150,19 @@ test('derives an exact carry-forward for an unchanged next generation', () => {
   );
 });
 
+test('normalizes a transition after PostgreSQL jsonb reorders object keys', () => {
+  const value = transition([
+    { name: 'OPTIONAL_TOKEN', secretRef: null },
+    { name: 'TOKEN', secretRef: secret('runtime-token', 3) },
+  ]);
+  assert.deepEqual(
+    normalizePluginPackageSecretBindingTransitionPlan(
+      postgresJsonbRoundTrip(value),
+    ),
+    value,
+  );
+});
+
 test('distinguishes forward rotation from rebind and version rollback', () => {
   const rotated = transition([
     { name: 'OPTIONAL_TOKEN', secretRef: null },