@intentius/chant-lexicon-terraform 0.101.0 → 0.104.0

package/src/__fixtures__/terragrunt/recorded/wave-1/plan-report.json

@@ -0,0 +1,22 @@
+[
+  {
+    "Started": "2026-10-03T21:52:46.408006-06:00",
+    "Ended": "2026-10-03T21:52:46.541637-06:00",
+    "Name": "live/dev/vpc",
+    "Result": "succeeded",
+    "Cmd": "plan",
+    "Args": [
+      "-no-color"
+    ]
+  },
+  {
+    "Started": "2026-10-03T21:52:46.408024-06:00",
+    "Ended": "2026-10-03T21:52:46.53842-06:00",
+    "Name": "live/prod/vpc",
+    "Result": "succeeded",
+    "Cmd": "plan",
+    "Args": [
+      "-no-color"
+    ]
+  }
+]

package/src/__fixtures__/terragrunt/recorded/wave-2/json/live/dev/db/tfplan.json

@@ -0,0 +1 @@
+{"format_version":"1.2","terraform_version":"1.12.5","variables":{"name":{"value":"live-dev-db"},"upstream":{"value":["live-dev-vpc-id"]}},"planned_values":{"outputs":{"id":{"sensitive":false,"type":"string","value":"live-dev-db-id"}},"root_module":{"resources":[{"address":"terraform_data.this","mode":"managed","type":"terraform_data","name":"this","provider_name":"terraform.io/builtin/terraform","schema_version":0,"values":{"input":{"name":"live-dev-db","upstream":["live-dev-vpc-id"]},"triggers_replace":null},"sensitive_values":{"input":{"upstream":[false]},"output":{}}}]}},"resource_changes":[{"address":"terraform_data.this","mode":"managed","type":"terraform_data","name":"this","provider_name":"terraform.io/builtin/terraform","change":{"actions":["create"],"before":null,"after":{"input":{"name":"live-dev-db","upstream":["live-dev-vpc-id"]},"triggers_replace":null},"after_unknown":{"id":true,"input":{"upstream":[false]},"output":true},"before_sensitive":false,"after_sensitive":{"input":{"upstream":[false]},"output":{}}}}],"output_changes":{"id":{"actions":["create"],"before":null,"after":"live-dev-db-id","after_unknown":false,"before_sensitive":false,"after_sensitive":false}},"prior_state":{"format_version":"1.0","terraform_version":"1.12.5","values":{"outputs":{"id":{"sensitive":false,"value":"live-dev-db-id","type":"string"}},"root_module":{}}},"configuration":{"provider_config":{"terraform":{"name":"terraform","full_name":"terraform.io/builtin/terraform"}},"root_module":{"outputs":{"id":{"expression":{"references":["var.name"]}}},"resources":[{"address":"terraform_data.this","mode":"managed","type":"terraform_data","name":"this","provider_config_key":"terraform","expressions":{"input":{"references":["var.name","var.upstream"]}},"schema_version":0}],"variables":{"name":{"type":"string","required":true},"upstream":{"type":["list","string"],"default":[]}}}},"timestamp":"2026-10-04T03:52:47Z","errored":false}

package/src/__fixtures__/terragrunt/recorded/wave-2/json/live/prod/app/tfplan.json

@@ -0,0 +1 @@
+{"format_version":"1.2","terraform_version":"1.12.5","variables":{"name":{"value":"live-prod-app"},"upstream":{"value":["live-prod-vpc-id"]}},"planned_values":{"outputs":{"id":{"sensitive":false,"type":"string","value":"live-prod-app-id"}},"root_module":{"resources":[{"address":"terraform_data.this","mode":"managed","type":"terraform_data","name":"this","provider_name":"terraform.io/builtin/terraform","schema_version":0,"values":{"input":{"name":"live-prod-app","upstream":["live-prod-vpc-id"]},"triggers_replace":null},"sensitive_values":{"input":{"upstream":[false]},"output":{}}}]}},"resource_changes":[{"address":"terraform_data.this","mode":"managed","type":"terraform_data","name":"this","provider_name":"terraform.io/builtin/terraform","change":{"actions":["create"],"before":null,"after":{"input":{"name":"live-prod-app","upstream":["live-prod-vpc-id"]},"triggers_replace":null},"after_unknown":{"id":true,"input":{"upstream":[false]},"output":true},"before_sensitive":false,"after_sensitive":{"input":{"upstream":[false]},"output":{}}}}],"output_changes":{"id":{"actions":["create"],"before":null,"after":"live-prod-app-id","after_unknown":false,"before_sensitive":false,"after_sensitive":false}},"prior_state":{"format_version":"1.0","terraform_version":"1.12.5","values":{"outputs":{"id":{"sensitive":false,"value":"live-prod-app-id","type":"string"}},"root_module":{}}},"configuration":{"provider_config":{"terraform":{"name":"terraform","full_name":"terraform.io/builtin/terraform"}},"root_module":{"outputs":{"id":{"expression":{"references":["var.name"]}}},"resources":[{"address":"terraform_data.this","mode":"managed","type":"terraform_data","name":"this","provider_config_key":"terraform","expressions":{"input":{"references":["var.name","var.upstream"]}},"schema_version":0}],"variables":{"name":{"type":"string","required":true},"upstream":{"type":["list","string"],"default":[]}}}},"timestamp":"2026-10-04T03:52:47Z","errored":false}

package/src/__fixtures__/terragrunt/recorded/wave-2/plan-report.json

@@ -0,0 +1,22 @@
+[
+  {
+    "Started": "2026-10-03T21:52:47.031211-06:00",
+    "Ended": "2026-10-03T21:52:47.180184-06:00",
+    "Name": "live/dev/db",
+    "Result": "succeeded",
+    "Cmd": "plan",
+    "Args": [
+      "-no-color"
+    ]
+  },
+  {
+    "Started": "2026-10-03T21:52:47.031218-06:00",
+    "Ended": "2026-10-03T21:52:47.199669-06:00",
+    "Name": "live/prod/app",
+    "Result": "succeeded",
+    "Cmd": "plan",
+    "Args": [
+      "-no-color"
+    ]
+  }
+]

package/src/change-set-combined-run.test.ts

@@ -0,0 +1,156 @@
+/**
+ * One change set for a combined run, and the gate binds its digest (#3181).
+ *
+ * The workspace has three members: `delivery`, a chant project on the aws
+ * lexicon; `estate`, a choudoufu estate; and `warden`, a github-warden whose
+ * plan is a reconcile change set in a file. One Op plans all three, joins
+ * them with `composeChangeSet`, and gates the apply on the document's digest.
+ *
+ * The plans are the real fixtures the adapter tests pin: chant's `lifecycle
+ * plan --json` against floci (`packages/core/src/__fixtures__/change-set`),
+ * choudoufu 0.16.0's `show -json` and the warden's reconcile change set. The
+ * two planner activities that need a cloud are stand-ins returning what the
+ * real ones return for those plans. `composeChangeSet` and
+ * `readChangeSetPart` are the real activities. The scenario is #2300's on a
+ * set: approve, change one member's plan, re-run, and the run stops naming
+ * both digests.
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { lifecyclePlanPart, type ChangeSetDocument } from "@intentius/chant/change-set";
+import type { ChangeSet as LifecycleChangeSet } from "@intentius/chant/lifecycle/change-set";
+import type { GateResolutionRecord, PendingGateRecord } from "@intentius/chant/lifecycle/gate-ledger";
+import {
+  composeChangeSet,
+  gate,
+  lifecyclePlanChangeSet,
+  readChangeSetPart,
+  runOpLocally,
+  stepOutput,
+  type ActivityProfile,
+  type GateLedgerPort,
+  type OpConfig,
+} from "@intentius/chant/op";
+import * as coreActivities from "@intentius/chant/op/activities";
+import { terraformChangeSetPart } from "./change-set";
+import { terraformPlan } from "./op/builders";
+
+const REPO = join(import.meta.dirname, "..", "..", "..");
+const CORE_FIXTURES = join(REPO, "packages", "core", "src", "__fixtures__", "change-set");
+const TF_FIXTURES = join(import.meta.dirname, "__fixtures__", "change-set");
+const PROFILES: Record<string, ActivityProfile> = {
+  longInfra: { timeout: "5m", retry: { maximumAttempts: 1 } },
+  fastIdempotent: { timeout: "5m", retry: { maximumAttempts: 1 } },
+};
+
+/** `chant approve` between two runs: a resolution the next run reads. */
+function approvableLedger(): GateLedgerPort & { approve(planDigest: string, at: string): void } {
+  const resolutions: GateResolutionRecord[] = [];
+  const pending: PendingGateRecord[] = [];
+  return {
+    approve(planDigest, at) {
+      resolutions.push({ version: 1, op: "combined-apply", gate: "approve-run", resolvedBy: "alex", timestamp: at, planDigest });
+    },
+    async read() {
+      return { resolutions: [...resolutions], pending: [...pending] };
+    },
+    async appendPending(input) {
+      const record: PendingGateRecord = { version: 1, kind: "pending", ...input };
+      pending.push(record);
+      return { record, pushed: true };
+    },
+  };
+}
+
+function harness() {
+  const estatePlan = JSON.parse(readFileSync(join(TF_FIXTURES, "choudoufu.plan.json"), "utf-8")) as {
+    resource_changes: Array<{ address: string; change: { after: Record<string, unknown> | null } }>;
+  };
+  const deliveryPlan = JSON.parse(readFileSync(join(CORE_FIXTURES, "lifecycle-plan.floci.json"), "utf-8")) as LifecycleChangeSet;
+  const applied: string[] = [];
+  const documents: ChangeSetDocument[] = [];
+
+  const activities = new Map<string, (args: Record<string, unknown>) => Promise<unknown>>([
+    ["composeChangeSet", async (args) => {
+      const out = await coreActivities.composeChangeSet(args as never);
+      documents.push(out.document);
+      return out;
+    }],
+    ["readChangeSetPart", coreActivities.readChangeSetPart as never],
+    // Stand-ins for the two planners that need a cloud, returning what the real activities return.
+    ["terraformPlan", async (args) => ({
+      planFile: "chant.tfplan",
+      changeSet: terraformChangeSetPart({ member: String(args.root), plan: estatePlan, planner: "choudoufu", scope: "est-estate" }),
+    })],
+    ["lifecyclePlanChangeSet", async (args) => ({ part: lifecyclePlanPart({ member: String(args.member), plan: deliveryPlan }) })],
+    ["applyAll", async () => { applied.push("applied"); return {}; }],
+  ]);
+
+  const estate = terraformPlan("estate", { id: "estate" });
+  const delivery = lifecyclePlanChangeSet({ member: "delivery", env: "dev", id: "delivery" });
+  const warden = readChangeSetPart({ member: "warden", planner: "warden", file: join(CORE_FIXTURES, "warden.plan.json"), id: "warden" });
+  const changeSet = composeChangeSet({
+    parts: [estate.out.changeSet, delivery.out.part, warden.out.part],
+    id: "change-set",
+  });
+  const config: OpConfig = {
+    name: "combined-apply",
+    overview: "",
+    phases: [
+      { name: "Plan", steps: [estate, delivery, warden, changeSet] },
+      { name: "Approve", steps: [gate("approve-run", { plan: stepOutput("change-set", "digest") })] },
+      { name: "Apply", steps: [{ kind: "activity", fn: "applyAll", args: {} }] },
+    ],
+  };
+  /** The document the latest run composed. */
+  const latest = (): ChangeSetDocument => documents[documents.length - 1];
+  return { estatePlan, applied, activities, config, latest };
+}
+
+describe("a combined run over a chant member, a choudoufu member and a warden (#3181)", () => {
+  test("one change set, and the gate records its digest", async () => {
+    const { activities, config, applied, latest } = harness();
+    const gates = approvableLedger();
+    const first = await runOpLocally(config, activities, PROFILES, undefined, { gates, now: "2026-10-03T12:00:00.000Z" });
+    expect(first.status).toBe("gated");
+    expect(applied).toEqual([]);
+
+    const doc = latest();
+    expect(doc.members.map((m) => [m.member, m.planner])).toEqual([["delivery", "chant"], ["estate", "choudoufu"], ["warden", "warden"]]);
+    expect(doc.summary.deletes.map((d) => `${d.member}:${d.address}`)).toEqual(["estate:terraform_data.old", "warden:team.contractors"]);
+    expect(first.gate?.planDigest).toBe(doc.digest);
+  });
+
+  test("approve the digest, re-run unchanged, and it applies", async () => {
+    const { activities, config, applied, latest } = harness();
+    const gates = approvableLedger();
+    await runOpLocally(config, activities, PROFILES, undefined, { gates, now: "2026-10-03T12:00:00.000Z" });
+    gates.approve(latest().digest, "2026-10-03T12:05:00.000Z");
+    const second = await runOpLocally(config, activities, PROFILES, undefined, { gates, now: "2026-10-03T12:10:00.000Z" });
+    expect(second.status).toBe("ok");
+    expect(applied).toEqual(["applied"]);
+  });
+
+  test("approve, change the choudoufu member's plan, re-run: the run stops, naming both digests", async () => {
+    const { estatePlan, activities, config, applied, latest } = harness();
+    const gates = approvableLedger();
+    await runOpLocally(config, activities, PROFILES, undefined, { gates, now: "2026-10-03T12:00:00.000Z" });
+    const approved = latest().digest;
+    gates.approve(approved, "2026-10-03T12:05:00.000Z");
+
+    // The estate's config input moves from "large" to "xlarge": one value in one member.
+    const config2 = estatePlan.resource_changes.find((r) => r.address === "terraform_data.config")!;
+    config2.change.after = { ...config2.change.after, input: { size: "xlarge", tags: { team: "core" } } };
+
+    const second = await runOpLocally(config, activities, PROFILES, undefined, { gates, now: "2026-10-03T12:10:00.000Z" });
+    const planned = latest().digest;
+    expect(planned).not.toBe(approved);
+    expect(second.status).toBe("gated");
+    expect(applied).toEqual([]);
+    const refusal = second.records.find((r) => r.fn === "gate:approve-run")?.refusal;
+    expect(refusal).toContain(`approved: ${approved}`);
+    expect(refusal).toContain(`planned: ${planned}`);
+  });
+});

package/src/change-set.test.ts

@@ -0,0 +1,151 @@
+/**
+ * The terraform-family change-set adapters (#3181), against real plans.
+ *
+ * `__fixtures__/change-set/{terraform,tofu,choudoufu}.plan.json` are `show
+ * -json` output from terraform 1.15.8, OpenTofu 1.12.5 and choudoufu 0.16.0:
+ * `v1.tf.txt` applied, then `v2.tf.txt` (with `v2-module-app.tf.txt` as
+ * `modules/app/main.tf`) planned. The plan has a no-op, an in-place update, an
+ * update of a sensitive value, a delete-then-create replacement, a delete and
+ * two creates under a module with `count`. `choudoufu-set-plan.json` is
+ * choudoufu's own golden for `live-plan-set -json`
+ * (`internal/live/setplan/testdata/document.golden.json` at choudoufu
+ * 0dc53834d5): two planned roots and one that failed at init.
+ *
+ * The `*.golden.json` files are what the adapters produce. Regenerate them
+ * with `UPDATE_GOLDEN=1`. `packages/core/src/change-set.test.ts` validates
+ * them against the change-set schema.
+ */
+
+import { readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { composeChangeSet, type ChangeSetPart } from "@intentius/chant/change-set";
+import { actionFor, choudoufuSetPlanParts, parseTerraformAddress, plannerForBinary, terraformChangeSetPart } from "./change-set";
+import { terraformPlanDigest } from "./plan-digest";
+
+const DIR = join(import.meta.dirname, "__fixtures__", "change-set");
+const read = (name: string): unknown => JSON.parse(readFileSync(join(DIR, name), "utf-8"));
+
+function golden(name: string, value: unknown): void {
+  const path = join(DIR, name);
+  const text = JSON.stringify(value, null, 2) + "\n";
+  if (process.env.UPDATE_GOLDEN) writeFileSync(path, text);
+  expect(text).toBe(readFileSync(path, "utf-8"));
+}
+
+describe("terraformChangeSetPart, on real plans", () => {
+  test.each(["terraform", "tofu", "choudoufu"] as const)("%s show -json matches its golden part", (planner) => {
+    const plan = read(`${planner}.plan.json`);
+    const part = terraformChangeSetPart({ member: "estate", plan, planner });
+    golden(`${planner}.part.golden.json`, part);
+    expect(part.member.planDigest).toBe(terraformPlanDigest(plan));
+  });
+
+  test("the three binaries' plans project to the same entries", () => {
+    const entries = (planner: "terraform" | "tofu" | "choudoufu") =>
+      terraformChangeSetPart({ member: "estate", plan: read(`${planner}.plan.json`), planner }).entries.map((e) => ({ ...e, planner: undefined, attributes: e.attributes.map((a) => a.path) }));
+    expect(entries("tofu")).toEqual(entries("terraform"));
+    expect(entries("choudoufu")).toEqual(entries("terraform"));
+  });
+
+  test("actions, disruption, module and index, and a sensitive value left out", () => {
+    const { entries } = terraformChangeSetPart({ member: "estate", plan: read("tofu.plan.json"), planner: "tofu" });
+    const at = (address: string) => entries.find((e) => e.address === address)!;
+    expect(at("terraform_data.keep")).toMatchObject({ action: "no-op", attributes: [] });
+    expect(at("terraform_data.old")).toMatchObject({ action: "delete", disruption: "destroy" });
+    expect(at("terraform_data.worker")).toMatchObject({ action: "replace", disruption: "destroy" });
+    expect(at("terraform_data.worker").attributes.find((a) => a.path === "triggers_replace")).toEqual({
+      path: "triggers_replace", before: ["build-1"], after: ["build-2"], forcesReplacement: true,
+    });
+    expect(at("terraform_data.config")).toMatchObject({ action: "update", disruption: "in-place" });
+    expect(at("terraform_data.config").attributes.find((a) => a.path === "input")).toEqual({
+      path: "input", before: { size: "small", tags: { team: "core" } }, after: { size: "large", tags: { team: "core" } },
+    });
+    const secret = at("terraform_data.secret").attributes.find((a) => a.path === "input")!;
+    expect(secret).toEqual({ path: "input", sensitive: true });
+    expect(JSON.stringify(secret)).not.toContain("s3cr3t");
+    // Redaction follows the planner's marks. All three binaries leave
+    // terraform_data's `output` unmarked in before_sensitive, so its old value
+    // is carried, as it is in the plan JSON itself.
+    expect(at("terraform_data.secret").attributes.find((a) => a.path === "output")).toEqual({ path: "output", before: "s3cr3t-1", unknown: true });
+    expect(at("module.app.terraform_data.instance[1]")).toMatchObject({ action: "create", module: "module.app", name: "instance", index: 1 });
+  });
+});
+
+describe("imports, forgets and triggered actions", () => {
+  // terraform 1.15.8 show -json: a `removed` block with destroy = false (action
+  // "forget"), an `import` block (change.importing, action "update") and a
+  // create. The plan has no field named for a forget beyond its action.
+  const plan = read("terraform.import-forget.plan.json") as { resource_changes: unknown[] };
+
+  test("a forget keeps the action forget and an import is flagged beside its own action", () => {
+    const { entries } = terraformChangeSetPart({ member: "root", plan });
+    const at = (address: string) => entries.find((e) => e.address === address)!;
+    expect(at("terraform_data.a")).toMatchObject({ action: "forget", attributes: [] });
+    expect(at("terraform_data.a").importing).toBeUndefined();
+    expect(at("terraform_data.b")).toMatchObject({ action: "update", importing: true });
+    expect(at("terraform_data.c").importing).toBeUndefined();
+  });
+
+  test("action_invocations become side effects, and bind the plan digest only when present", () => {
+    const invocation = { address: "action.aws_lambda_invoke.notify", type: "aws_lambda_invoke", lifecycle_action_trigger: { triggering_resource_address: "aws_lambda_function.worker", action_trigger_event: "after_update", actions_block_index: 0, action_trigger_block_index: 0 } };
+    const withAction = { ...plan, action_invocations: [invocation] };
+    const part = terraformChangeSetPart({ member: "root", plan: withAction });
+    expect(part.sideEffects).toEqual([{ address: "action.aws_lambda_invoke.notify", type: "aws_lambda_invoke", trigger: "aws_lambda_function.worker", event: "after_update" }]);
+    expect(terraformChangeSetPart({ member: "root", plan }).sideEffects).toBeUndefined();
+    expect(terraformPlanDigest(withAction)).not.toBe(terraformPlanDigest(plan));
+    expect(terraformPlanDigest({ ...plan, action_invocations: [] })).toBe(terraformPlanDigest(plan));
+    expect(composeChangeSet([part]).sideEffects).toEqual([{ member: "root", ...part.sideEffects![0] }]);
+  });
+});
+
+describe("choudoufuSetPlanParts, on choudoufu's golden set plan", () => {
+  test("one part per root, the failed root a failed member, and the golden document", () => {
+    const parts = choudoufuSetPlanParts({ document: read("choudoufu-set-plan.json") });
+    expect(parts.map((p) => [p.member.member, p.member.status, p.member.scope])).toEqual([
+      ["estates/e01", "planned", "est-e01"],
+      ["estates/e02", "planned", "est-e02"],
+      ["estates/e03", "failed", "est-e03"],
+    ]);
+    expect(parts[2].member).toMatchObject({ planDigest: null, error: "e03 broke at init on purpose" });
+    // choudoufu's own root digest rides along; the member's plan digest is chant's.
+    expect(parts[0].member.nativeDigest).toBe("sha256:bbe048fb0f7df99fcd65f00351d8b3c3be9b8a2a25a99a706b1c16d81277bb97");
+    // The golden plan carries only address and actions, so type and name come off the address.
+    expect(parts[0].entries[0]).toMatchObject({ address: "terraform_data.x", type: "terraform_data", name: "x", action: "create" });
+    const doc = composeChangeSet(parts);
+    expect(doc.summary.failed).toEqual(["estates/e03"]);
+    golden("choudoufu-set-plan.change-set.golden.json", doc);
+  });
+
+  test("memberFor names the workspace member a root belongs to", () => {
+    const parts: ChangeSetPart[] = choudoufuSetPlanParts({ document: read("choudoufu-set-plan.json"), memberFor: (root) => root.replace("estates/", "") });
+    expect(parts.map((p) => p.member.member)).toEqual(["e01", "e02", "e03"]);
+  });
+
+  test("a document without roots is refused", () => {
+    expect(() => choudoufuSetPlanParts({ document: { format_version: "1" } })).toThrow(/no top-level "roots"/);
+  });
+});
+
+describe("address and action parsing", () => {
+  test.each([
+    ["aws_s3_bucket.logs", { type: "aws_s3_bucket", name: "logs" }],
+    ["data.aws_iam_policy_document.p", { type: "aws_iam_policy_document", name: "p" }],
+    ["module.net.module.sub[2].aws_subnet.a[0]", { module: "module.net.module.sub[2]", type: "aws_subnet", name: "a", index: 0 }],
+    ['module.app["eu.west"].aws_instance.web["a.b"]', { module: 'module.app["eu.west"]', type: "aws_instance", name: "web", index: "a.b" }],
+  ])("%s", (address, expected) => {
+    expect(parseTerraformAddress(address)).toEqual(expected);
+  });
+
+  test("create-before-destroy is a replace with replace disruption, and an unknown action is refused", () => {
+    const plan = { resource_changes: [{ address: "a.b", type: "a", name: "b", change: { actions: ["create", "delete"], before: {}, after: {} } }] };
+    expect(terraformChangeSetPart({ member: "m", plan }).entries[0]).toMatchObject({ action: "replace", disruption: "replace" });
+    expect(() => actionFor(["teleport"])).toThrow(/no action/);
+  });
+
+  test("the planner a binary names", () => {
+    expect(plannerForBinary("/usr/local/bin/tofu")).toBe("tofu");
+    expect(plannerForBinary("choudoufu")).toBe("choudoufu");
+    expect(plannerForBinary(undefined)).toBe("terraform");
+  });
+});

package/src/change-set.ts

@@ -0,0 +1,273 @@
+/**
+ * Change-set adapters for the terraform family (#3181): a `terraform show
+ * -json` plan from terraform, tofu or choudoufu, and a choudoufu set plan
+ * document (`live-plan-set -json`, choudoufu#1752), each into
+ * `@intentius/chant/change-set` parts.
+ *
+ * A member's plan digest is {@link terraformPlanDigest}, the value a
+ * `TerraformApplyOp` gate on that root binds (#2300), so a change set over
+ * one root and a gate over the same root agree on what changed.
+ *
+ * This module imports `./plan-digest` and chant's `change-set` and
+ * `lifecycle/plan-digest` subpaths, never the lexicon's entry point, so it
+ * bundles without TypeScript or the lint rules (#3421).
+ */
+
+import type {
+  ChangeSetAction,
+  ChangeSetAttribute,
+  ChangeSetDisruption,
+  ChangeSetEntry,
+  ChangeSetPart,
+  ChangeSetPlanner,
+  ChangeSetSideEffect,
+} from "@intentius/chant/change-set";
+import { terraformPlanDigest } from "./plan-digest";
+
+type Json = Record<string, unknown>;
+
+const isObject = (v: unknown): v is Json => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** Whether a sensitivity or unknown map marks anything under it `true`. */
+function marks(v: unknown): boolean {
+  if (v === true) return true;
+  if (Array.isArray(v)) return v.some(marks);
+  if (isObject(v)) return Object.values(v).some(marks);
+  return false;
+}
+
+function sameJson(a: unknown, b: unknown): boolean {
+  if (a === b) return true;
+  if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((x, i) => sameJson(x, b[i]));
+  if (isObject(a) && isObject(b)) {
+    const ka = Object.keys(a);
+    return ka.length === Object.keys(b).length && ka.every((k) => k in b && sameJson(a[k], b[k]));
+  }
+  return false;
+}
+
+/**
+ * The planner a root's binary names: `choudoufu` and `tofu` by name, and
+ * `terraform` for anything else, a path to terraform included.
+ */
+export function plannerForBinary(binary: string | undefined): ChangeSetPlanner {
+  const base = (binary ?? "terraform").split(/[\\/]/).pop() ?? "";
+  if (base.startsWith("choudoufu")) return "choudoufu";
+  if (base.startsWith("tofu")) return "tofu";
+  return "terraform";
+}
+
+/**
+ * The action a `resource_changes` entry's `actions` array means. Delete then
+ * create and create then delete are both a replace; the order is the
+ * disruption ({@link disruptionFor}).
+ */
+export function actionFor(actions: unknown): ChangeSetAction {
+  const a = Array.isArray(actions) ? actions.map(String) : [];
+  if (a.length === 2 && a.includes("delete") && a.includes("create")) return "replace";
+  if (a.length === 1) {
+    switch (a[0]) {
+      case "create": case "update": case "delete": case "read": case "no-op": case "forget":
+        return a[0];
+    }
+  }
+  throw new Error(`a plan entry has actions ${JSON.stringify(actions)}, which the change set has no action for`);
+}
+
+function disruptionFor(actions: unknown, action: ChangeSetAction): ChangeSetDisruption | undefined {
+  switch (action) {
+    case "update": return "in-place";
+    case "delete": return "destroy";
+    case "replace": return (actions as string[])[0] === "create" ? "replace" : "destroy";
+    default: return undefined;
+  }
+}
+
+/** A resource address's module path, name and index, read off the address when the entry does not carry them. */
+export function parseTerraformAddress(address: string): { module?: string; type: string; name: string; index?: string | number } {
+  // Module segments, then [data.]type.name[index]. Index brackets may hold a quoted key with dots in it.
+  const re = /^((?:module\.[^.[\]]+(?:\[(?:"(?:[^"\\]|\\.)*"|\d+)\])?\.)*)(?:data\.)?([^.[\]]+)\.([^.[\]]+)(?:\[("(?:[^"\\]|\\.)*"|\d+)\])?$/;
+  const m = re.exec(address);
+  if (!m) return { type: "unknown", name: address };
+  const module = m[1] ? m[1].slice(0, -1) : undefined;
+  const index = m[4] === undefined ? undefined : m[4].startsWith('"') ? (JSON.parse(m[4]) as string) : Number(m[4]);
+  return { ...(module ? { module } : {}), type: m[2], name: m[3], ...(index !== undefined ? { index } : {}) };
+}
+
+/** The attributes one change writes, top-level, with sensitive values left out. */
+function attributesFor(change: Json, action: ChangeSetAction): ChangeSetAttribute[] {
+  if (action === "delete" || action === "no-op" || action === "forget" || action === "read") return [];
+  const before = isObject(change.before) ? change.before : {};
+  const after = isObject(change.after) ? change.after : {};
+  const afterUnknown = isObject(change.after_unknown) ? change.after_unknown : {};
+  const beforeSensitive = isObject(change.before_sensitive) ? change.before_sensitive : {};
+  const afterSensitive = isObject(change.after_sensitive) ? change.after_sensitive : {};
+  const forcing = new Set(
+    (Array.isArray(change.replace_paths) ? change.replace_paths : [])
+      .map((p) => (Array.isArray(p) ? p[0] : undefined))
+      .filter((k): k is string => typeof k === "string"),
+  );
+  const keys = [...new Set([...Object.keys(before), ...Object.keys(after), ...Object.keys(afterUnknown)])].sort();
+  const out: ChangeSetAttribute[] = [];
+  for (const k of keys) {
+    const unknown = marks(afterUnknown[k]);
+    const hasBefore = action !== "create" && before[k] !== undefined && before[k] !== null;
+    const hasAfter = after[k] !== undefined && after[k] !== null;
+    if (action === "create" ? !hasAfter && !unknown : !unknown && sameJson(before[k] ?? null, after[k] ?? null)) continue;
+    const sensitive = marks(beforeSensitive[k]) || marks(afterSensitive[k]);
+    out.push({
+      path: k,
+      ...(sensitive ? { sensitive: true as const } : {
+        ...(hasBefore ? { before: before[k] } : {}),
+        ...(hasAfter && !unknown ? { after: after[k] } : {}),
+      }),
+      ...(unknown ? { unknown: true as const } : {}),
+      ...(forcing.has(k) ? { forcesReplacement: true as const } : {}),
+    });
+  }
+  return out;
+}
+
+function regionOf(change: Json): string | undefined {
+  for (const side of [change.after, change.before]) {
+    if (isObject(side) && typeof side.region === "string" && side.region !== "") return side.region;
+  }
+  return undefined;
+}
+
+export interface TerraformChangeSetPartInput {
+  /** The member's name: the root's name in `terraform.roots`, which a workspace member of kind terraform or choudoufu shares. */
+  member: string;
+  /** `terraform show -json <planfile>`, parsed. */
+  plan: unknown;
+  /** The binary that planned it, or the planner by name. Default `terraform`. */
+  planner?: ChangeSetPlanner;
+  /** The estate or workspace the root plans into. */
+  scope?: string;
+  /** The planner's own digest of this plan, when it printed one. */
+  nativeDigest?: string;
+}
+
+/**
+ * One terraform-family root's part, from its `show -json` plan.
+ *
+ * Every `resource_changes` entry becomes an entry, no-op and read included.
+ * A plan stock marked `errored` is a failed member: its entries are kept,
+ * but nothing should apply it.
+ */
+export function terraformChangeSetPart(input: TerraformChangeSetPartInput): ChangeSetPart {
+  const plan = isObject(input.plan) ? input.plan : {};
+  const planner = input.planner ?? "terraform";
+  const raw = Array.isArray(plan.resource_changes) ? plan.resource_changes : [];
+  const entries: ChangeSetEntry[] = raw.map((r): ChangeSetEntry => {
+    const rc = isObject(r) ? r : {};
+    const change = isObject(rc.change) ? rc.change : {};
+    const address = String(rc.address ?? "");
+    const parsed = parseTerraformAddress(address);
+    const action = actionFor(change.actions);
+    const disruption = disruptionFor(change.actions, action);
+    const region = regionOf(change);
+    const index = rc.index !== undefined && rc.index !== null ? (rc.index as string | number) : parsed.index;
+    const module = typeof rc.module_address === "string" ? rc.module_address : parsed.module;
+    return {
+      member: input.member,
+      lexicon: "terraform",
+      planner,
+      address,
+      type: typeof rc.type === "string" ? rc.type : parsed.type,
+      name: typeof rc.name === "string" ? rc.name : parsed.name,
+      ...(index !== undefined ? { index } : {}),
+      ...(module ? { module } : {}),
+      ...(typeof rc.deposed === "string" ? { deposed: rc.deposed } : {}),
+      action,
+      ...(isObject(change.importing) ? { importing: true as const } : {}),
+      ...(disruption ? { disruption } : {}),
+      ...(region ? { region } : {}),
+      ...(input.scope ? { scope: input.scope } : {}),
+      attributes: attributesFor(change, action),
+    };
+  });
+  const sideEffects = (Array.isArray(plan.action_invocations) ? plan.action_invocations : []).map(sideEffectFor);
+  const errored = plan.errored === true;
+  return {
+    member: {
+      member: input.member,
+      lexicon: "terraform",
+      planner,
+      ...(input.scope ? { scope: input.scope } : {}),
+      status: errored ? "failed" : "planned",
+      ...(errored ? { error: `${planner} marked the plan errored` } : {}),
+      planDigest: terraformPlanDigest(plan),
+      ...(input.nativeDigest ? { nativeDigest: input.nativeDigest } : {}),
+      holes: [],
+    },
+    entries,
+    ...(sideEffects.length > 0 ? { sideEffects } : {}),
+  };
+}
+
+/**
+ * One `action_invocations` entry of a plan (Terraform 1.14): the action's
+ * address and type, and, for a lifecycle trigger, the resource and event.
+ */
+function sideEffectFor(raw: unknown): Omit<ChangeSetSideEffect, "member"> {
+  const inv = isObject(raw) ? raw : {};
+  const type = typeof inv.type === "string" ? inv.type : "unknown";
+  const lifecycle = isObject(inv.lifecycle_action_trigger) ? inv.lifecycle_action_trigger : {};
+  return {
+    address: typeof inv.address === "string" ? inv.address : type,
+    type,
+    ...(typeof lifecycle.triggering_resource_address === "string" ? { trigger: lifecycle.triggering_resource_address } : {}),
+    ...(typeof lifecycle.action_trigger_event === "string" ? { event: lifecycle.action_trigger_event } : {}),
+  };
+}
+
+/** One root of a choudoufu set plan document: the fields the adapter reads. */
+interface SetPlanRoot {
+  root: string;
+  estate?: string;
+  status?: string;
+  error?: string;
+  stage?: string;
+  plan?: unknown;
+  digest?: string;
+}
+
+export interface ChoudoufuSetPlanInput {
+  /** `choudoufu live-plan-set -json`, parsed. */
+  document: unknown;
+  /** The member a root belongs to. Default: the root's directory as the set names it. */
+  memberFor?: (root: string, estate: string | undefined) => string;
+}
+
+/**
+ * One part per root of a choudoufu set plan (choudoufu#1752). A planned
+ * root is {@link terraformChangeSetPart} over its embedded plan, with the
+ * estate as scope and choudoufu's own root digest as `nativeDigest`. A
+ * failed root is a failed member with its error and no plan digest.
+ */
+export function choudoufuSetPlanParts(input: ChoudoufuSetPlanInput): ChangeSetPart[] {
+  const doc = isObject(input.document) ? input.document : {};
+  if (!Array.isArray(doc.roots)) throw new Error('not a choudoufu set plan document: no top-level "roots"');
+  return (doc.roots as SetPlanRoot[]).map((r) => {
+    const member = input.memberFor ? input.memberFor(r.root, r.estate || undefined) : r.root;
+    const scope = r.estate || undefined;
+    if (r.status === "planned" && isObject(r.plan)) {
+      return terraformChangeSetPart({ member, plan: r.plan, planner: "choudoufu", ...(scope ? { scope } : {}), ...(r.digest ? { nativeDigest: r.digest } : {}) });
+    }
+    return {
+      member: {
+        member,
+        lexicon: "terraform",
+        planner: "choudoufu" as const,
+        ...(scope ? { scope } : {}),
+        status: "failed" as const,
+        error: r.error || `the root did not plan (${r.status ?? "no status"}${r.stage ? `, at ${r.stage}` : ""})`,
+        planDigest: null,
+        ...(r.digest ? { nativeDigest: r.digest } : {}),
+        holes: [],
+      },
+      entries: [],
+    };
+  });
+}