@intentius/chant-lexicon-terraform 0.124.59 → 0.124.61

package/dist/components/capability-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4HG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAiC,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AA0BlI,OAAO,EAA0D,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIjH,0CAA0C;AAC1C,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+HAA+H;IAC/H,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gHAAgH;IAChH,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAyGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAerE;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAEhI;AAID;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,kBAInC,CAAC;AA4BF,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,iHAAiH;AACjH,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAsFD;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAEpB,IAAI,EAAE,MAAM;IADxC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YAA4B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxD;CACF;AA6DD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CAwHlG,CAAC;AAEF,eAAO,MAAM,uBAAuB;aAClC,KAAK,YAAG,iBAAiB;aAEzB,KAAK,YAAG,wBAAwB,EAAE,sBAAsB;aACxD,IAAI,YAAG,gBAAgB;aAEvB,MAAM,YAAG,kBAAkB;CACnB,CAAC;AAEX,eAAO,MAAM,yBAAyB,EAAE,gBAcvC,CAAC"}
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4HG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAiC,cAAc,EAAE,MAAM,wCAAwC,CAAC;AAExH,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,2CAA2C,CAAC;AAInD,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AACzG,OAAO,KAAK,EAAmB,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,kDAAkD,CAAC;AA0BlI,OAAO,EAA0D,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIjH,0CAA0C;AAC1C,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+HAA+H;IAC/H,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,WAAW,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;IAC7B,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gHAAgH;IAChH,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;CAC9B;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAyGD;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,CAerE;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,GAAG,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,oBAAoB,CAEhI;AAID;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,kBAInC,CAAC;AA4BF,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,0BAA0B,CAAC;AAEzD,iHAAiH;AACjH,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,IAAI,EAAE,uBAAuB,CAAC;CAC/B;AAsFD;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aAEpB,IAAI,EAAE,MAAM;IADxC,QAAQ,CAAC,SAAS,QAAQ;IAC1B,YAA4B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAGxD;CACF;AA6DD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CA0HlG,CAAC;AAEF,eAAO,MAAM,uBAAuB;aAClC,KAAK,YAAG,iBAAiB;aAEzB,KAAK,YAAG,wBAAwB,EAAE,sBAAsB;aACxD,IAAI,YAAG,gBAAgB;aAEvB,MAAM,YAAG,kBAAkB;CACnB,CAAC;AAEX,eAAO,MAAM,yBAAyB,EAAE,gBAcvC,CAAC"}

package/dist/components/capability-plugin.js

@@ -128,6 +128,7 @@ import { dirname, join, resolve } from "node:path";
 import { loadChantConfigUpward } from "@intentius/chant/config";
 import { PlanShapeMovedError, planShapeDifferences, planShapeDigest, } from "@intentius/chant/components/covered-round";
 import { computePlanDigest } from "@intentius/chant/lifecycle/plan-digest";
+import { terraformResourceDigests } from "../plan-digest.js";
 import { ownPackageVersion } from "@intentius/chant/components/capability-plugin";
 import { choudoufuMemberOutputs, choudoufuMemberPlanSet, choudoufuPlanSet, choudoufuWaveApply, choudoufuWaveRoot, terraformApply, terraformInit, terraformOutputs, terraformPlan, } from "../op/activities/terraform.js";
 import { terraformPlanMoved } from "../exit-codes.js";
@@ -501,6 +502,8 @@ export const terraformApplyCapability = {
             planDigest: planned.planDigest,
             artifact: { ...planned, ...(lockRows ? { lockRows } : {}) },
             ...(changeSet ? { changeSet } : {}),
+            // plywood#55: each changed resource's own digest, which a merged wave compares with the pull request's per resource.
+            resourceDigests: terraformResourceDigests(json),
             outputs: terraformPlannedOutputs(json),
             shape: terraformPlanShape(json, input.root),
             ...(targets ? { targets } : {}),

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "9d0b2a34e8ab7ef946ff820f524b61023dcbfde27bb6c087f18536fab7356b53",
+    "manifest.json": "252ecd1770b5886b1e634e159d6c5108b6fabc34894d051f45854bdbb3e464ff",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "7c10245b2c3335253b48ee7d8b075d89f43116bde20313a5d1031b343fef1282",
@@ -59,5 +59,5 @@
     "rules/tf047.ts": "bfa86f85c4c5efff297280fc2f15104d6319fa96dfc444a31829fb7353224092",
     "skills/chant-terraform.md": "53dd11c7b289652f92fdaf2c03766abda46d8964e31fe709e8b142ced4f19c50"
   },
-  "composite": "2c430036fefe238c43a24320fc630c35a3430dd1cdaf4e6a54c9fac464699b0a"
+  "composite": "e8e8db4d9b31ae4fa9fcb0380cc57a39a5ab5bf520d313a67109a23bbfaf07f9"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.124.59",
+  "version": "0.124.61",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/plan-digest.d.ts

@@ -25,6 +25,15 @@ export interface TerraformPlannedChange {
     replace_paths: unknown;
     importing: unknown;
 }
+/**
+ * `after` without the values the plan says are known only after apply
+ * (plywood#56). terraform and tofu leave such a value out of `after` and mark
+ * it in `after_unknown`; a renderer that prints a stand-in instead (a null, a
+ * placeholder string, a value drawn while planning) would otherwise make two
+ * plans of one create differ. The mark itself stays in the digest, so a
+ * value turning from known to unknown still changes it.
+ */
+export declare function withoutUnknown(after: unknown, unknown: unknown): unknown;
 /**
  * The change set a `terraform show -json` plan describes, canonicalised
  * (#2300): every proposed change, at its address, with the values that would
@@ -56,4 +65,13 @@ export declare function terraformPlanChangeSet(planJson: unknown): {
  * is the same plan both times.
  */
 export declare function terraformPlanDigest(planJson: unknown): string;
+/**
+ * The digest of each resource the plan changes, by address (plywood#55): its
+ * change as {@link terraformPlanChangeSet} projects it, a deposed object apart
+ * from the live one, and each action invocation by its address. A no-op or
+ * read entry is not in it, and neither is an output, so what a pull request
+ * left alone never makes its plan differ from one made after another change
+ * landed on it.
+ */
+export declare function terraformResourceDigests(planJson: unknown): Record<string, string>;
 //# sourceMappingURL=plan-digest.d.ts.map

package/dist/plan-digest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plan-digest.d.ts","sourceRoot":"","sources":["../src/plan-digest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG;IACzD,eAAe,EAAE,sBAAsB,EAAE,CAAC;IAC1C,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;CAC/B,CAkCA;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAE7D"}
+{"version":3,"file":"plan-digest.d.ts","sourceRoot":"","sources":["../src/plan-digest.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAQxE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,OAAO,GAAG;IACzD,eAAe,EAAE,sBAAsB,EAAE,CAAC;IAC1C,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,CAAC,EAAE,OAAO,EAAE,CAAC;CAC/B,CAkCA;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAE7D;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAalF"}

package/dist/plan-digest.js

@@ -6,6 +6,25 @@
  * what lets terragucci bundle it into one file (#3421).
  */
 import { computePlanDigest } from "@intentius/chant/lifecycle/plan-digest";
+/**
+ * `after` without the values the plan says are known only after apply
+ * (plywood#56). terraform and tofu leave such a value out of `after` and mark
+ * it in `after_unknown`; a renderer that prints a stand-in instead (a null, a
+ * placeholder string, a value drawn while planning) would otherwise make two
+ * plans of one create differ. The mark itself stays in the digest, so a
+ * value turning from known to unknown still changes it.
+ */
+export function withoutUnknown(after, unknown) {
+    if (unknown === true)
+        return undefined;
+    if (Array.isArray(after) && Array.isArray(unknown))
+        return after.map((v, i) => (unknown[i] === true ? null : withoutUnknown(v, unknown[i])));
+    if (after !== null && typeof after === "object" && !Array.isArray(after) && unknown !== null && typeof unknown === "object" && !Array.isArray(unknown)) {
+        const marks = unknown;
+        return Object.fromEntries(Object.entries(after).filter(([k]) => marks[k] !== true).map(([k, v]) => [k, withoutUnknown(v, marks[k])]));
+    }
+    return after;
+}
 /**
  * The change set a `terraform show -json` plan describes, canonicalised
  * (#2300): every proposed change, at its address, with the values that would
@@ -37,7 +56,7 @@ export function terraformPlanChangeSet(planJson) {
             deposed: e.deposed,
             actions: change.actions,
             before: change.before,
-            after: change.after,
+            after: withoutUnknown(change.after, change.after_unknown),
             after_unknown: change.after_unknown,
             replace_paths: change.replace_paths,
             importing: change.importing,
@@ -65,3 +84,26 @@ export function terraformPlanChangeSet(planJson) {
 export function terraformPlanDigest(planJson) {
     return computePlanDigest("terraform-plan", terraformPlanChangeSet(planJson));
 }
+/**
+ * The digest of each resource the plan changes, by address (plywood#55): its
+ * change as {@link terraformPlanChangeSet} projects it, a deposed object apart
+ * from the live one, and each action invocation by its address. A no-op or
+ * read entry is not in it, and neither is an output, so what a pull request
+ * left alone never makes its plan differ from one made after another change
+ * landed on it.
+ */
+export function terraformResourceDigests(planJson) {
+    const { resourceChanges, actionInvocations } = terraformPlanChangeSet(planJson);
+    const out = {};
+    for (const c of resourceChanges) {
+        const actions = Array.isArray(c.actions) ? c.actions : [];
+        if (actions.length === 0 || actions.every((a) => a === "no-op" || a === "read"))
+            continue;
+        out[`${String(c.address)}${c.deposed ? `#deposed:${String(c.deposed)}` : ""}`] = computePlanDigest("terraform-resource", c);
+    }
+    for (const a of actionInvocations ?? []) {
+        const address = a?.address;
+        out[`action:${typeof address === "string" ? address : JSON.stringify(a)}`] = computePlanDigest("terraform-action", a);
+    }
+    return Object.fromEntries(Object.entries(out).sort(([x], [y]) => (x < y ? -1 : x > y ? 1 : 0)));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.124.59",
+  "version": "0.124.61",
   "type": "module",
   "files": [
     "src/",
@@ -93,7 +93,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.59",
+    "@intentius/chant": "^0.124.61",
     "zod": "^4.3.6"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/components/capability-plugin.test.ts

@@ -217,6 +217,7 @@ describe("terraform-apply", () => {
       member: "app",
       planDigest: "jcs1-sha256:app",
       artifact: { planFile: "chant.tfplan", planDigest: "jcs1-sha256:app" },
+      resourceDigests: {},
       outputs: { known: {}, unknown: [] },
       shape: { member: "app", entries: [], unknownInputs: [] },
     });

package/src/components/capability-plugin.ts

@@ -136,6 +136,7 @@ import {
 } from "@intentius/chant/components/covered-round";
 import type { ChangeSetPart } from "@intentius/chant/change-set";
 import { computePlanDigest } from "@intentius/chant/lifecycle/plan-digest";
+import { terraformResourceDigests } from "../plan-digest";
 import { ownPackageVersion, type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
 import type { EngineMemberRef, EngineOutputSource, EnginePlannedOutputs } from "@intentius/chant/components/verbs/member-outputs";
 import {
@@ -580,6 +581,8 @@ export const terraformApplyCapability: Capability<TerraformApplyStepInput, Terra
       planDigest: planned.planDigest,
       artifact: { ...planned, ...(lockRows ? { lockRows } : {}) },
       ...(changeSet ? { changeSet } : {}),
+      // plywood#55: each changed resource's own digest, which a merged wave compares with the pull request's per resource.
+      resourceDigests: terraformResourceDigests(json),
       outputs: terraformPlannedOutputs(json),
       shape: terraformPlanShape(json, input.root),
       ...(targets ? { targets } : {}),

package/src/plan-digest.test.ts

@@ -0,0 +1,89 @@
+/**
+ * What a terraform or tofu plan's digest leaves out (plywood#56): the values
+ * the plan says are known only after apply. A create of a resource with a
+ * generated name (`name_prefix`, a random id, a computed output) has to give
+ * the same digest in every plan of the same change.
+ */
+import { describe, expect, test } from "vitest";
+import { terraformPlanDigest, terraformResourceDigests, withoutUnknown } from "./plan-digest";
+
+function plan(after: Record<string, unknown>, unknown: Record<string, unknown> = { id: true, name: true }) {
+  return {
+    format_version: "1.2",
+    terraform_version: "1.9.0",
+    timestamp: "2026-10-31T00:00:00Z",
+    resource_changes: [
+      { address: "aws_sqs_queue.worker", mode: "managed", type: "aws_sqs_queue", name: "worker", provider_name: "registry.opentofu.org/hashicorp/aws", change: { actions: ["create"], before: null, after, after_unknown: unknown } },
+      { address: "random_id.suffix", mode: "managed", type: "random_id", name: "suffix", provider_name: "registry.opentofu.org/hashicorp/random", change: { actions: ["create"], before: null, after: { byte_length: 4, keepers: null }, after_unknown: { id: true, hex: true } } },
+    ],
+    output_changes: {},
+  };
+}
+
+describe("a create's digest leaves out values known only after apply", () => {
+  test("the same create planned twice has one digest, whatever stood in for the unknowns", () => {
+    const first = plan({ visibility_timeout_seconds: 30, tags: { team: "a" } });
+    const second = plan({ visibility_timeout_seconds: 30, tags: { team: "a" }, name: "worker-20261031120000", id: "placeholder-1" });
+    const third = plan({ visibility_timeout_seconds: 30, tags: { team: "a" }, name: null, id: null });
+    expect(terraformPlanDigest(second)).toBe(terraformPlanDigest(first));
+    expect(terraformPlanDigest(third)).toBe(terraformPlanDigest(first));
+  });
+
+  test("a changed input a reviewer saw still changes it", () => {
+    const base = plan({ visibility_timeout_seconds: 30 });
+    expect(terraformPlanDigest(plan({ visibility_timeout_seconds: 60 }))).not.toBe(terraformPlanDigest(base));
+    expect(terraformPlanDigest(plan({ visibility_timeout_seconds: 30, delay_seconds: 5 }))).not.toBe(terraformPlanDigest(base));
+  });
+
+  test("a value turning from known to unknown changes it", () => {
+    const known = plan({ visibility_timeout_seconds: 30, name: "worker" }, { id: true });
+    const unknown = plan({ visibility_timeout_seconds: 30 }, { id: true, name: true });
+    expect(terraformPlanDigest(known)).not.toBe(terraformPlanDigest(unknown));
+  });
+
+  test("nested and listed unknowns are left out, known neighbours are kept", () => {
+    expect(withoutUnknown({ a: { b: "x", c: "gen" }, l: ["p", "gen", "q"] }, { a: { c: true }, l: [false, true, false] })).toEqual({ a: { b: "x" }, l: ["p", null, "q"] });
+    expect(withoutUnknown({ a: 1 }, {})).toEqual({ a: 1 });
+    expect(withoutUnknown(null, { id: true })).toBeNull();
+  });
+});
+
+describe("the digest of each changed resource (plywood#55)", () => {
+  const two = (queueAfter: Record<string, unknown>, bucketActions: string[]) => ({
+    resource_changes: [
+      { address: "aws_sqs_queue.worker", type: "aws_sqs_queue", name: "worker", change: { actions: ["create"], before: null, after: queueAfter, after_unknown: { id: true, name: true } } },
+      { address: "aws_s3_bucket.logs", type: "aws_s3_bucket", name: "logs", change: { actions: bucketActions, before: { acl: "private" }, after: { acl: bucketActions[0] === "update" ? "public-read" : "private" }, after_unknown: {} } },
+    ],
+    action_invocations: [{ address: "action.aws_lambda_invoke.warm", type: "aws_lambda_invoke" }],
+  });
+
+  test("a no-op is not in it, and an create of unknown values has one digest across plans", () => {
+    const a = terraformResourceDigests(two({ delay_seconds: 0 }, ["no-op"]));
+    const b = terraformResourceDigests(two({ delay_seconds: 0, name: "placeholder", id: "x" }, ["no-op"]));
+    expect(Object.keys(a)).toEqual(["action:action.aws_lambda_invoke.warm", "aws_sqs_queue.worker"]);
+    expect(b).toEqual(a);
+  });
+
+  test("a change to another resource leaves this one's digest as it was", () => {
+    const quiet = terraformResourceDigests(two({ delay_seconds: 0 }, ["no-op"]));
+    const busy = terraformResourceDigests(two({ delay_seconds: 0 }, ["update"]));
+    expect(busy["aws_sqs_queue.worker"]).toBe(quiet["aws_sqs_queue.worker"]);
+    expect(Object.keys(busy)).toContain("aws_s3_bucket.logs");
+  });
+
+  test("a reviewed input changes it", () => {
+    const a = terraformResourceDigests(two({ delay_seconds: 0 }, ["no-op"]));
+    const b = terraformResourceDigests(two({ delay_seconds: 9 }, ["no-op"]));
+    expect(b["aws_sqs_queue.worker"]).not.toBe(a["aws_sqs_queue.worker"]);
+  });
+
+  test("a deposed object is kept apart from the live one", () => {
+    const doc = {
+      resource_changes: [
+        { address: "aws_x.a", change: { actions: ["create"], before: null, after: {}, after_unknown: {} } },
+        { address: "aws_x.a", deposed: "abc", change: { actions: ["delete"], before: {}, after: null, after_unknown: {} } },
+      ],
+    };
+    expect(Object.keys(terraformResourceDigests(doc))).toEqual(["aws_x.a", "aws_x.a#deposed:abc"]);
+  });
+});

package/src/plan-digest.ts

@@ -29,6 +29,24 @@ export interface TerraformPlannedChange {
   importing: unknown;
 }
 
+/**
+ * `after` without the values the plan says are known only after apply
+ * (plywood#56). terraform and tofu leave such a value out of `after` and mark
+ * it in `after_unknown`; a renderer that prints a stand-in instead (a null, a
+ * placeholder string, a value drawn while planning) would otherwise make two
+ * plans of one create differ. The mark itself stays in the digest, so a
+ * value turning from known to unknown still changes it.
+ */
+export function withoutUnknown(after: unknown, unknown: unknown): unknown {
+  if (unknown === true) return undefined;
+  if (Array.isArray(after) && Array.isArray(unknown)) return after.map((v, i) => (unknown[i] === true ? null : withoutUnknown(v, unknown[i])));
+  if (after !== null && typeof after === "object" && !Array.isArray(after) && unknown !== null && typeof unknown === "object" && !Array.isArray(unknown)) {
+    const marks = unknown as Record<string, unknown>;
+    return Object.fromEntries(Object.entries(after as Record<string, unknown>).filter(([k]) => marks[k] !== true).map(([k, v]) => [k, withoutUnknown(v, marks[k])]));
+  }
+  return after;
+}
+
 /**
  * The change set a `terraform show -json` plan describes, canonicalised
  * (#2300): every proposed change, at its address, with the values that would
@@ -64,7 +82,7 @@ export function terraformPlanChangeSet(planJson: unknown): {
       deposed: e.deposed,
       actions: change.actions,
       before: change.before,
-      after: change.after,
+      after: withoutUnknown(change.after, change.after_unknown),
       after_unknown: change.after_unknown,
       replace_paths: change.replace_paths,
       importing: change.importing,
@@ -97,3 +115,26 @@ export function terraformPlanChangeSet(planJson: unknown): {
 export function terraformPlanDigest(planJson: unknown): string {
   return computePlanDigest("terraform-plan", terraformPlanChangeSet(planJson));
 }
+
+/**
+ * The digest of each resource the plan changes, by address (plywood#55): its
+ * change as {@link terraformPlanChangeSet} projects it, a deposed object apart
+ * from the live one, and each action invocation by its address. A no-op or
+ * read entry is not in it, and neither is an output, so what a pull request
+ * left alone never makes its plan differ from one made after another change
+ * landed on it.
+ */
+export function terraformResourceDigests(planJson: unknown): Record<string, string> {
+  const { resourceChanges, actionInvocations } = terraformPlanChangeSet(planJson);
+  const out: Record<string, string> = {};
+  for (const c of resourceChanges) {
+    const actions = Array.isArray(c.actions) ? c.actions : [];
+    if (actions.length === 0 || actions.every((a) => a === "no-op" || a === "read")) continue;
+    out[`${String(c.address)}${c.deposed ? `#deposed:${String(c.deposed)}` : ""}`] = computePlanDigest("terraform-resource", c);
+  }
+  for (const a of actionInvocations ?? []) {
+    const address = (a as { address?: unknown } | null)?.address;
+    out[`action:${typeof address === "string" ? address : JSON.stringify(a)}`] = computePlanDigest("terraform-action", a);
+  }
+  return Object.fromEntries(Object.entries(out).sort(([x], [y]) => (x < y ? -1 : x > y ? 1 : 0)));
+}