@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/src/plan-shape.test.ts

@@ -0,0 +1,148 @@
+/**
+ * `terraformPlanShape` (#4436), against the recorded `show -json` plans of
+ * terraform, tofu and choudoufu in `__fixtures__/change-set/` (see
+ * change-set.test.ts for how they were recorded).
+ */
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, test } from "vitest";
+import { planShapeCovers, planShapeDigest, type PlanShapeEntry } from "@intentius/chant/components/covered-round";
+import { terraformPlanShape } from "./plan-shape";
+
+const DIR = join(import.meta.dirname, "__fixtures__", "change-set");
+const read = (name: string): unknown => JSON.parse(readFileSync(join(DIR, name), "utf-8"));
+
+const T = "terraform_data";
+
+/** The fixture plan: a no-op, an update, an update of a sensitive value, a delete, a replace, two creates under a module. */
+const FIXTURE_ENTRIES: PlanShapeEntry[] = [
+  { logicalId: "module.app.terraform_data.instance[0]", action: "create", type: T, properties: ["id", "input", "output"], unknown: ["id", "output"] },
+  { logicalId: "module.app.terraform_data.instance[1]", action: "create", type: T, properties: ["id", "input", "output"], unknown: ["id", "output"] },
+  { logicalId: "terraform_data.config", action: "update", replacement: "false", type: T, properties: ["input", "output"], unknown: ["output"] },
+  { logicalId: "terraform_data.old", action: "delete", type: T, properties: [], unknown: [] },
+  { logicalId: "terraform_data.secret", action: "update", replacement: "false", type: T, properties: ["input", "output"], unknown: ["output"] },
+  { logicalId: "terraform_data.worker", action: "replace", replacement: "true", type: T, properties: ["id", "output", "triggers_replace"], unknown: ["id", "output"] },
+];
+
+describe("terraformPlanShape, on real plans", () => {
+  test.each(["terraform", "tofu", "choudoufu"] as const)("%s: one entry per change, none for the no-op", (planner) => {
+    expect(terraformPlanShape(read(`${planner}.plan.json`), "estate")).toEqual({ member: "estate", entries: FIXTURE_ENTRIES, unknownInputs: [] });
+  });
+
+  test("a table of the actions, replacement and attributes the fixture gives", () => {
+    const shape = terraformPlanShape(read("terraform.plan.json"), "estate");
+    expect(shape.entries.map((e) => [e.logicalId, e.action, e.replacement, e.properties, e.unknown])).toEqual(
+      FIXTURE_ENTRIES.map((e) => [e.logicalId, e.action, e.replacement, e.properties, e.unknown]),
+    );
+    // terraform_data.keep is a no-op, so it has no entry.
+    expect(shape.entries.some((e) => e.logicalId === "terraform_data.keep")).toBe(false);
+  });
+
+  test("the choudoufu set plan's embedded plan gives a shape too", () => {
+    const doc = read("choudoufu-set-plan.json") as { roots: Array<{ plan?: unknown }> };
+    expect(terraformPlanShape(doc.roots[0]!.plan, "estates/e01")).toEqual({
+      member: "estates/e01",
+      entries: [{ logicalId: "terraform_data.x", action: "create", properties: [], unknown: [] }],
+      unknownInputs: [],
+    });
+  });
+
+  test("a forget has an entry with no properties", () => {
+    const shape = terraformPlanShape(read("terraform.import-forget.plan.json"), "estate");
+    expect(shape.entries.find((e) => e.logicalId === "terraform_data.a")).toMatchObject({ action: "forget", properties: [], unknown: [] });
+  });
+
+  test("the digest of the same plan JSON is equal across two runs", () => {
+    const one = planShapeDigest(terraformPlanShape(read("terraform.plan.json"), "estate"));
+    const two = planShapeDigest(terraformPlanShape(read("terraform.plan.json"), "estate"));
+    expect(one).toBe(two);
+    expect(planShapeDigest(terraformPlanShape(read("tofu.plan.json"), "estate"))).toBe(one);
+  });
+
+  test("a shape is covered by itself, and not by a plan that adds a resource", () => {
+    const first = terraformPlanShape(read("terraform.plan.json"), "estate");
+    expect(planShapeCovers(first, terraformPlanShape(read("terraform.plan.json"), "estate"))).toBeUndefined();
+    const plan = read("terraform.plan.json") as { resource_changes: unknown[] };
+    const more = { ...plan, resource_changes: [...plan.resource_changes, { address: "terraform_data.extra", type: T, change: { actions: ["create"], before: null, after: { input: "x" }, after_unknown: {} } }] };
+    expect(planShapeCovers(first, terraformPlanShape(more, "estate"))).toContain("terraform_data.extra");
+  });
+
+  test("unknown and known inputs are the caller's, and enter the digest", () => {
+    const plan = read("terraform.plan.json");
+    const shape = terraformPlanShape(plan, "app", { unknownInputs: ["a.id"], knownInputs: { "net.cidr": "10.0.0.0/16" } });
+    expect(shape.unknownInputs).toEqual(["a.id"]);
+    expect(shape.knownInputs).toEqual({ "net.cidr": "10.0.0.0/16" });
+    expect(planShapeDigest(shape)).not.toBe(planShapeDigest(terraformPlanShape(plan, "app")));
+  });
+});
+
+/** A plan with one update whose `replace_paths` and `after_unknown` are as given. */
+function updatePlan(change: Record<string, unknown>, extra: Record<string, unknown> = {}): unknown {
+  return { resource_changes: [{ address: "aws_instance.web", type: "aws_instance", ...extra, change: { actions: ["update"], ...change } }] };
+}
+
+describe("terraformPlanShape replacement", () => {
+  test("an update with a replace_paths entry replaces", () => {
+    const plan = updatePlan({ before: { ami: "a" }, after: { ami: "b" }, after_unknown: {}, replace_paths: [["ami"]] });
+    expect(terraformPlanShape(plan, "m").entries[0]).toMatchObject({ action: "update", replacement: "true", type: "aws_instance", properties: ["ami"] });
+  });
+
+  test("an update whose replaced path is unknown after apply is conditional", () => {
+    const plan = updatePlan({ before: { ami: "a" }, after: {}, after_unknown: { ami: true }, replace_paths: [["ami"]] });
+    expect(terraformPlanShape(plan, "m").entries[0]).toMatchObject({ replacement: "conditional", properties: ["ami"], unknown: ["ami"] });
+  });
+
+  test("a nested replaced path is unknown when its own leaf is", () => {
+    const plan = updatePlan({ before: { tags: { env: "a" } }, after: { tags: {} }, after_unknown: { tags: { env: true } }, replace_paths: [["tags", "env"]] });
+    expect(terraformPlanShape(plan, "m").entries[0]!.replacement).toBe("conditional");
+  });
+
+  test("one known replaced path is enough to replace", () => {
+    const plan = updatePlan({
+      before: { ami: "a", zone: "x" },
+      after: { zone: "y" },
+      after_unknown: { ami: true },
+      replace_paths: [["ami"], ["zone"]],
+    });
+    expect(terraformPlanShape(plan, "m").entries[0]!.replacement).toBe("true");
+  });
+
+  test("an update with no replace_paths replaces nothing", () => {
+    const plan = updatePlan({ before: { ami: "a" }, after: { ami: "b" }, after_unknown: {} });
+    expect(terraformPlanShape(plan, "m").entries[0]!.replacement).toBe("false");
+  });
+
+  test("a delete and create pair with no replace_paths replaces", () => {
+    const plan = { resource_changes: [{ address: "x.y", type: "x", change: { actions: ["create", "delete"], before: { a: 1 }, after: { a: 2 }, after_unknown: {} } }] };
+    expect(terraformPlanShape(plan, "m").entries[0]).toMatchObject({ action: "replace", replacement: "true" });
+  });
+});
+
+describe("terraformPlanShape, edge cases", () => {
+  test("a deposed object's logical id carries its key", () => {
+    const plan = updatePlan({ before: { a: 1 }, after: null, actions: ["delete"] }, { deposed: "0123abcd" });
+    const [entry] = terraformPlanShape(plan, "m").entries;
+    expect(entry).toMatchObject({ logicalId: "aws_instance.web#0123abcd", action: "delete" });
+  });
+
+  test("read and no-op entries are left out", () => {
+    const plan = {
+      resource_changes: [
+        { address: "data.x.a", type: "x", change: { actions: ["read"] } },
+        { address: "x.b", type: "x", change: { actions: ["no-op"], before: {}, after: {} } },
+      ],
+    };
+    expect(terraformPlanShape(plan, "m").entries).toEqual([]);
+  });
+
+  test("anything that is not a plan has no entries", () => {
+    expect(terraformPlanShape(undefined, "m")).toEqual({ member: "m", entries: [], unknownInputs: [] });
+    expect(terraformPlanShape({}, "m").entries).toEqual([]);
+  });
+
+  test("sensitive values never enter the shape", () => {
+    const shape = terraformPlanShape(read("terraform.plan.json"), "estate");
+    expect(JSON.stringify(shape)).not.toContain("s3cr3t");
+  });
+});

package/src/plan-shape.ts

@@ -0,0 +1,128 @@
+/**
+ * The plan shape of a terraform-family root (#4436): what `terraform show
+ * -json` says a plan does, without the values, in the form core's
+ * `coveredRound` compares (#4419). `terraform-apply`'s `plan` returns it, and
+ * terragucci calls it for the plan JSON of a note (terragucci#1268).
+ *
+ * Like `./change-set`, this module imports only `@intentius/chant` subpaths,
+ * never the lexicon's entry point.
+ */
+
+import type { PlanShape, PlanShapeEntry, ShapeReplacement } from "@intentius/chant/components/covered-round";
+import { normalizePlanShape } from "@intentius/chant/components/covered-round";
+import { actionFor } from "./change-set";
+
+type Json = Record<string, unknown>;
+
+const isObject = (v: unknown): v is Json => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/** Whether an `after_unknown` value marks anything under it unknown. */
+function marks(v: unknown): boolean {
+  if (v === true) return true;
+  if (Array.isArray(v)) return v.some(marks);
+  if (isObject(v)) return Object.values(v).some(marks);
+  return false;
+}
+
+function sameJson(a: unknown, b: unknown): boolean {
+  if (a === b) return true;
+  if (Array.isArray(a) && Array.isArray(b)) return a.length === b.length && a.every((x, i) => sameJson(x, b[i]));
+  if (isObject(a) && isObject(b)) {
+    const ka = Object.keys(a);
+    return ka.length === Object.keys(b).length && ka.every((k) => k in b && sameJson(a[k], b[k]));
+  }
+  return false;
+}
+
+/** Whether the value at `path` in an `after_unknown` tree is unknown: `true` at the path or on a prefix of it. */
+function unknownAt(tree: unknown, path: unknown[]): boolean {
+  let at: unknown = tree;
+  for (const step of path) {
+    if (at === true) return true;
+    if (Array.isArray(at) && typeof step === "number") at = at[step];
+    else if (isObject(at) && typeof step === "string") at = at[step];
+    else return false;
+  }
+  return marks(at);
+}
+
+/**
+ * How a change replaces its resource. A `replace_paths` entry names an
+ * attribute whose change forces it. When every such attribute is unknown
+ * after apply, the plan cannot say the value will differ, so the replacement
+ * is `conditional`; one with a known forcing attribute is `true`. A delete
+ * and create pair with no `replace_paths` (a tainted object, `-replace`) is
+ * `true`. An update with none replaces nothing (`false`); a create or delete
+ * has no replacement to state.
+ */
+function replacementFor(change: Json, action: string): ShapeReplacement | undefined {
+  const paths = (Array.isArray(change.replace_paths) ? change.replace_paths : []).filter(Array.isArray) as unknown[][];
+  if (paths.length > 0) return paths.every((p) => unknownAt(change.after_unknown, p)) ? "conditional" : "true";
+  if (action === "replace") return "true";
+  if (action === "update") return "false";
+  return undefined;
+}
+
+export interface TerraformPlanShapeOptions {
+  /** The inputs the plan was made without, as `<component>.<output>`. */
+  unknownInputs?: string[];
+  /** The inputs the plan read with a value, by reference. */
+  knownInputs?: Record<string, unknown>;
+}
+
+/**
+ * The shape of `planJson` (`terraform show -json`, from terraform, tofu or
+ * choudoufu) for `member`.
+ *
+ * One entry per `resource_changes` item that is not `no-op` or `read`.
+ * `logicalId` is the address, with `#<deposed>` for a deposed object. `type`
+ * is the resource type. `properties` are the top-level attributes that differ
+ * between `before` and `after` (on a create, those the plan sets or leaves
+ * unknown), and `unknown` the ones `after_unknown` marks, so `unknown` is
+ * within `properties`. A delete has no properties. Values never enter it, so
+ * a sensitive attribute is only a name.
+ */
+export function terraformPlanShape(planJson: unknown, member: string, options: TerraformPlanShapeOptions = {}): PlanShape {
+  const plan = isObject(planJson) ? planJson : {};
+  const raw = Array.isArray(plan.resource_changes) ? plan.resource_changes : [];
+  const entries: PlanShapeEntry[] = [];
+  for (const r of raw) {
+    const rc = isObject(r) ? r : {};
+    const change = isObject(rc.change) ? rc.change : {};
+    const action = actionFor(change.actions);
+    if (action === "no-op" || action === "read") continue;
+    const address = String(rc.address ?? "");
+    const before = isObject(change.before) ? change.before : {};
+    const after = isObject(change.after) ? change.after : {};
+    const afterUnknown = isObject(change.after_unknown) ? change.after_unknown : {};
+    const properties: string[] = [];
+    const unknown: string[] = [];
+    if (action !== "delete" && action !== "forget") {
+      for (const k of new Set([...Object.keys(before), ...Object.keys(after), ...Object.keys(afterUnknown)])) {
+        const isUnknown = marks(afterUnknown[k]);
+        const differs =
+          action === "create"
+            ? isUnknown || (after[k] !== undefined && after[k] !== null)
+            : isUnknown || !sameJson(before[k] ?? null, after[k] ?? null);
+        if (!differs) continue;
+        properties.push(k);
+        if (isUnknown) unknown.push(k);
+      }
+    }
+    const replacement = replacementFor(change, action);
+    entries.push({
+      logicalId: typeof rc.deposed === "string" ? `${address}#${rc.deposed}` : address,
+      action,
+      ...(replacement ? { replacement } : {}),
+      ...(typeof rc.type === "string" ? { type: rc.type } : {}),
+      properties,
+      unknown,
+    });
+  }
+  return normalizePlanShape({
+    member,
+    entries,
+    unknownInputs: options.unknownInputs ?? [],
+    ...(options.knownInputs ? { knownInputs: options.knownInputs } : {}),
+  });
+}

package/src/plugin.ts

@@ -1,4 +1,3 @@
-import { lastMemberReport, readPulumiMember, setLastMemberReport } from "./workspace-member";
 import type { AuditEntitiesInput, LexiconPlugin } from "@intentius/chant/lexicon";
 import { terraformBehaviourKinds } from "./behaviour/kinds";
 import type { CompletionContext, HoverContext } from "@intentius/chant/lsp/types";
@@ -11,7 +10,7 @@ import { withCallersChain } from "./lint/post-synth/scope";
 import { terraformAuditCatalog } from "./lint/audit-catalog";
 import { completions } from "./lsp/completions";
 import { hover } from "./lsp/hover";
-import { terraformConfigSchema, type TerraformConfig } from "./config";
+import { ownRoots, terraformConfigSchema, type TerraformConfig } from "./config";
 import { renderTerraformRoots } from "./hcl/roots";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
@@ -20,6 +19,7 @@ import { descendModules } from "./hcl/descend";
 import { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership";
 import { terraformCommands } from "./commands";
 import { terraformCapabilityPack } from "./capabilities/adapter";
+import { TERRAFORM_REFERENCE_CATALOG } from "./behaviour/reference-catalog";
 
 const loadSkills = createSkillsLoader(import.meta.url, [
   {
@@ -79,6 +79,8 @@ export const terraformPlugin: LexiconPlugin = {
   behaviourKinds: terraformBehaviourKinds,
   name: "terraform",
   capabilityPack: terraformCapabilityPack,
+  // Keyed by provider type (#2360); see its module doc for which nodes it reads (#4535).
+  referenceCatalog: TERRAFORM_REFERENCE_CATALOG,
   serializer: terraformSerializer,
   configSchema: terraformConfigSchema,
 
@@ -141,6 +143,18 @@ export const terraformPlugin: LexiconPlugin = {
     return describeResources(options);
   },
 
+  /**
+   * Each root's drift, as drift-record stream lines (behold#995): a stock
+   * root through its state or a plan, a live root through `live-plan` (and a
+   * plan), one resource through `live-plan -resource`. `chant workspace
+   * drift` reaches it through `chant lifecycle drift` in a member's reader
+   * project. See `./drift-read.ts`.
+   */
+  async readDrift(options) {
+    const { readTerraformDrift } = await import("./drift-read");
+    return readTerraformDrift(options);
+  },
+
   /**
    * The prediction, for whichever estate `options.from` names (#2495). The
    * producer is `predictTerraformBehaviour` and this is its second caller, not
@@ -181,15 +195,9 @@ export const terraformPlugin: LexiconPlugin = {
    * project root, which is what relative `dir` paths resolve against.
    */
   async buildRoots(ctx): Promise<{ entities: Map<string, Declarable>; warnings: string[] }> {
-    setLastMemberReport(undefined);
     const namespace = (ctx.config as { terraform?: TerraformConfig }).terraform;
-    // A pulumi workspace member (#3179): its checked-in stack export, never the program.
-    if (namespace?.pulumiMember) {
-      const read = readPulumiMember({ member: namespace.pulumiMember });
-      setLastMemberReport(read.report);
-      return { entities: read.entities, warnings: read.warnings };
-    }
-    const roots = namespace?.roots ?? {};
+    // A `signalOnly` root (#4484) feeds change detection only, so it builds no entities here.
+    const roots = ownRoots(namespace?.roots);
     if (Object.keys(roots).length === 0) return { entities: new Map(), warnings: [] };
     return renderTerraformRoots({
       projectRoot: ctx.projectRoot,
@@ -200,11 +208,6 @@ export const terraformPlugin: LexiconPlugin = {
     });
   },
 
-  graphMeta() {
-    const report = lastMemberReport();
-    return report ? { pulumiMember: report } : undefined;
-  },
-
   /** `chant terraform pin-rollout` (#3189). */
   commands() {
     return terraformCommands;
@@ -213,13 +216,15 @@ export const terraformPlugin: LexiconPlugin = {
   /**
    * The `terraform.roots` a change touched (#3183): a changed file in the
    * root's directory, in a local module it calls, or one of its var files.
-   * See `./changed-roots.ts`.
+   * See `./changed-roots.ts`. Every root counts, a `signalOnly` one too
+   * (#4484): that is what it is declared for.
    */
   async changedUnits(ctx) {
-    const roots = (ctx.config as { terraform?: TerraformConfig }).terraform?.roots ?? {};
+    const tf = (ctx.config as { terraform?: TerraformConfig }).terraform;
+    const roots = tf?.roots ?? {};
     if (Object.keys(roots).length === 0) return [];
     const { changedRoots } = await import("./changed-roots");
-    return changedRoots(ctx.projectRoot, roots, ctx.changedFiles);
+    return changedRoots(ctx.projectRoot, roots, ctx.changedFiles, tf?.binary);
   },
 
   lintRules() {
@@ -294,12 +299,21 @@ export const terraformPlugin: LexiconPlugin = {
       // A local audit knows the root's directory, so it can say whether the
       // lock file is beside the `.tf` files (TF040); a fetched one cannot.
       const lockFile = input?.dir !== undefined ? existsSync(join(input.dir, LOCK_FILENAME)) : undefined;
-      const entities = await parseTerraformRootContent(content, root, undefined, lockFile === undefined ? undefined : { lockFile });
+      // An audit has no `terraform.binary` to follow (chant#4457). A root
+      // that carries a `.tofu` file is written for OpenTofu, so it is read
+      // as a tofu root; any other is read as terraform, the config default.
+      const binary = /^# file: .*\.tofu(\.json)?\s*$/m.test(content) ? "tofu" : undefined;
+      const modeOptions = {
+        ...(binary !== undefined ? { binary } : {}),
+        ...(lockFile !== undefined ? { lockFile } : {}),
+      };
+      const entities = await parseTerraformRootContent(content, root, undefined, Object.keys(modeOptions).length > 0 ? modeOptions : undefined);
       if (input?.dir === undefined) return entities;
       const { entities: children } = await descendModules(entities, {
         dir: input.dir,
         root,
         projectRoot: input.baseDir ?? input.dir,
+        ...(binary !== undefined ? { modeOptions: { binary } } : {}),
       });
       for (const [key, entity] of children) entities.set(key, entity);
       return entities;

package/src/report.test.ts

@@ -8,9 +8,13 @@
 import { mkdirSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+import { contract } from "../../../packages/core/src/workspace/__fixtures__/contract-repo";
 import { describe, expect, test } from "vitest";
+import { verifyChangeSetDigest } from "@intentius/chant/change-set";
 import { addToIndex, atmosOutputReads, atmosStackReads, dirStore, estateOfDir, httpStore, moduleEstates, runFactsFromEnv, slicePlan, terraformReport, topModule, writeReport } from "./report";
 import { parseReportArgs } from "./commands";
+import { generateReportFixture } from "./__fixtures__/report/generate";
+import { readdirSync } from "node:fs";
 
 const rc = (address: string, module: string, type: string, name: string, actions: string[], change: Record<string, unknown>) => ({
   address, module_address: module, mode: "managed", type, name, provider_name: "registry.terraform.io/hashicorp/aws", change: { actions, ...change },
@@ -287,7 +291,7 @@ describe("writing", () => {
     const store = dirStore(dir);
     const plan = terraformReport({ ...base, stage: "tf-plan" });
     const apply = terraformReport({ ...base, stage: "tf-apply", applied: AFTER, finished: "2026-10-24T10:05:00Z" });
-    expect(await writeReport(store, plan)).toEqual([`${RUN.project}/2026/10/abc123/tf-plan/report.json`, `${RUN.project}/index.json`, "index.json"]);
+    expect(await writeReport(store, plan)).toEqual([`${RUN.project}/2026/10/abc123/tf-plan/report.json`, `${RUN.project}/2026/10/abc123/tf-plan/change-set.json`, `${RUN.project}/index.json`, "index.json"]);
     await writeReport(store, apply);
     await writeReport(store, apply);
     const project = JSON.parse(readFileSync(join(dir, RUN.project, "index.json"), "utf8"));
@@ -322,6 +326,83 @@ describe("writing", () => {
   });
 });
 
+const SCHEMA_PATH = join(import.meta.dirname, "..", "..", "..", "packages", "core", "src", "workspace", "change-set.schema.json");
+const { validate: validateChangeSet } = contract(JSON.parse(readFileSync(SCHEMA_PATH, "utf8")));
+const FIXTURE_DIR = join(import.meta.dirname, "__fixtures__", "report");
+
+/** The change set must validate against chant's schema and be the document the report's digest names. */
+function expectChangeSet(doc: any, report: any): void {
+  expect(validateChangeSet(doc), JSON.stringify(validateChangeSet.errors, null, 2)).toBe(true);
+  expect(verifyChangeSetDigest(doc)).toBe(true);
+  expect(report.change_set).toBe(doc.digest);
+}
+
+describe("change-set.json beside the report", () => {
+  const apply = { ...base, stage: "tf-apply" as const, applied: AFTER, finished: "2026-10-24T10:05:00Z" };
+
+  test.each([["tf-plan", { ...base, stage: "tf-plan" as const }], ["tf-apply", apply]])("%s: the document validates and its digest is the report's", (_stage, input) => {
+    const r = terraformReport(input);
+    expectChangeSet(r.changeSet, r.report);
+  });
+
+  test("--out writes it next to report.json for both stages", async () => {
+    const dir = mkdtempSync(join(tmpdir(), "tf-report-cs-"));
+    const store = dirStore(dir);
+    for (const input of [{ ...base, stage: "tf-plan" as const }, apply]) {
+      const r = terraformReport(input);
+      await writeReport(store, r);
+      const at = join(dir, RUN.project, r.path);
+      expect(readdirSync(at).sort()).toEqual(["change-set.json", "report.json"]);
+      expectChangeSet(JSON.parse(readFileSync(join(at, "change-set.json"), "utf8")), JSON.parse(readFileSync(join(at, "report.json"), "utf8")));
+    }
+  });
+
+  test("--to puts it next to report.json for both stages", async () => {
+    const objects = new Map<string, string>();
+    const fake = (async (url: string, init?: RequestInit) => {
+      if (init?.method === "PUT") {
+        objects.set(url, String(init.body));
+        return new Response("", { status: 200 });
+      }
+      return objects.has(url) ? new Response(objects.get(url)!) : new Response("", { status: 404 });
+    }) as unknown as typeof fetch;
+    const store = httpStore("http://floci:4566/demo-reports/demo", fake);
+    for (const input of [{ ...base, stage: "tf-plan" as const }, apply]) {
+      const r = terraformReport(input);
+      await writeReport(store, r);
+      const at = `http://floci:4566/demo-reports/demo/${encodeURIComponent("forgejo:3000").replace(/%3A/g, "%3A")}/admin/demo-terragrunt-choudoufu/${r.path}`;
+      expectChangeSet(JSON.parse(objects.get(`${at}/change-set.json`)!), JSON.parse(objects.get(`${at}/report.json`)!));
+    }
+  });
+});
+
+describe("the report fixture behold renders", () => {
+  const read = (name: string): any => JSON.parse(readFileSync(join(FIXTURE_DIR, name), "utf8"));
+
+  test("is what the generator writes now; regenerate with `npx tsx lexicons/terraform/src/__fixtures__/report/generate.ts`", async () => {
+    const files = await generateReportFixture();
+    expect(Object.keys(files).sort()).toEqual(["tf-apply/change-set.json", "tf-apply/report.json", "tf-plan/change-set.json", "tf-plan/report.json"]);
+    for (const [name, body] of Object.entries(files)) expect(readFileSync(join(FIXTURE_DIR, name), "utf8"), `${name} is stale`).toBe(body);
+  });
+
+  test("both stages validate, and each digest is its report's", () => {
+    for (const stage of ["tf-plan", "tf-apply"]) expectChangeSet(read(`${stage}/change-set.json`), read(`${stage}/report.json`));
+  });
+
+  test("three members, two composed reads", () => {
+    const plan = read("tf-plan/report.json");
+    expect(read("tf-plan/change-set.json").members.map((m: any) => m.member)).toEqual(["estates/app", "estates/edge", "estates/network"]);
+    const reads = plan.roots.flatMap((r: any) => r.reads ?? []);
+    expect(reads.filter((r: any) => r.composed === true).length).toBeGreaterThanOrEqual(2);
+  });
+
+  test("an attribute unknown at plan has its value after the apply", () => {
+    const attr = (stage: string) => read(`${stage}/report.json`).roots.find((r: any) => r.path === "estates/network").changes.find((c: any) => c.address === "aws_subnet.new").attributes.find((a: any) => a.path === "id");
+    expect(attr("tf-plan")).toEqual({ path: "id", unknown: true });
+    expect(attr("tf-apply")).toEqual({ path: "id", after: "subnet-0a1b" });
+  });
+});
+
 describe("the run's facts and the verb's flags", () => {
   test("a Forgejo environment names the project as terragucci does", () => {
     const f = runFactsFromEnv({ GITHUB_REPOSITORY: "admin/demo", GITHUB_SERVER_URL: "http://forgejo:3000", GITHUB_SHA: "deadbeef", GITHUB_RUN_ID: "9", FORGEJO_ACTIONS: "true" }, { pullRequest: "12" });