@intentius/chant 0.105.1 → 0.106.3

package/dist/workspace/member-pipeline.d.ts

@@ -67,8 +67,11 @@ export declare function memberPipelineDir(provider: string): string | undefined;
  * The default path of a member's component pipeline for one environment,
  * relative to the repository root: `chant-<member>-<env>.yml` in the forge's
  * workflow directory, or `.gitlab/ci/chant-<member>-<env>.gitlab-ci.yml`.
+ * A pull-request pipeline (`kind` `"pr"`, #3465) is `chant-pr.<member>.<env>`, with the dots the apply group uses so no
+ * two member and environment pairs share one name, and it sits beside the
+ * member's deploy pipeline for the same environment.
  */
-export declare function memberPipelineFile(provider: string, member: string, env: string): string | undefined;
+export declare function memberPipelineFile(provider: string, member: string, env: string, kind?: "components" | "pr"): string | undefined;
 /** A repository-relative path for an absolute one. */
 export declare function repoRelative(ctx: MemberContext, absolute: string): string;
 /** Read a member's generated-file record, or an empty one. */
@@ -107,6 +110,17 @@ export interface ComponentPlanInput {
     output?: string;
     params?: string[];
     paramsFile?: string;
+    /** `--pr-loop`, with its `--gate` and `--branch` (#3465). */
+    prLoop?: {
+        gate?: string;
+        branch?: string;
+    };
+    /** `--wave-gate` with its `--canary` and `--base` (#3049). */
+    waveGate?: {
+        gate: string;
+        canary?: string[];
+        base?: string;
+    };
 }
 /**
  * Plan a member's component pipeline: which member, which file and which

package/dist/workspace/member-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"member-pipeline.d.ts","sourceRoot":"","sources":["../../src/workspace/member-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAA+E,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAG3I;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,CAAC;IACV,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAqBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,aAAa,GAAG,SAAS,CA0B9G;AAUD,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIpG;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAKvE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAS9F;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,aAAa,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAKD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,GAAG,SAAS,CA8BtG;AAED,8FAA8F;AAC9F,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI1F;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,YAAY,GAAG,SAAS,CAsB3B;AAED,0IAA0I;AAC1I,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,EAAE,CAY5G;AAED,oHAAoH;AACpH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAGlD"}
+{"version":3,"file":"member-pipeline.d.ts","sourceRoot":"","sources":["../../src/workspace/member-pipeline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAA+E,KAAK,WAAW,EAAE,KAAK,MAAM,EAAE,MAAM,eAAe,CAAC;AAG3I;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAE7D,wCAAwC;AACxC,MAAM,WAAW,kBAAkB;IACjC,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,CAAC,CAAC;IACV,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAED,0DAA0D;AAC1D,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,WAAW,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,aAAa,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAqBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,mBAAmB,GAAG,aAAa,GAAG,SAAS,CA0B9G;AAUD,gJAAgJ;AAChJ,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,YAAY,GAAG,IAAmB,GAAG,MAAM,GAAG,SAAS,CAK9I;AAED,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,8DAA8D;AAC9D,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,eAAe,CAKvE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAS9F;AAED,uEAAuE;AACvE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,+FAA+F;AAC/F,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,aAAa,CAAC;IACnB,mDAAmD;IACnD,MAAM,EAAE,cAAc,CAAC;IACvB,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,8DAA8D;IAC9D,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/D;AAKD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,GAAG,SAAS,CAwCtG;AAED,8FAA8F;AAC9F,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAI1F;AAED,0EAA0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,aAAa,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;IACvB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uFAAuF;AACvF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,YAAY,GAAG,SAAS,CAsB3B;AAED,0IAA0I;AAC1I,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,MAAM,EAAE,CAY5G;AAED,oHAAoH;AACpH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAGlD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.105.1",
+  "version": "0.106.3",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/__fixtures__/change-set/lifecycle.change-set.golden.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://intentius.io/chant/schemas/workspace/change-set/v1/change-set.schema.json",
   "contract": 1,
-  "digest": "jcs1-sha256:5c2c5c9f6b07d3520f46f9b706bde78e47cd3424bb08adcd964c2ee8ebb6e1b4",
+  "digest": "jcs1-sha256:a66846faed3900cffc37cfa1c31d2735358875375b7218faa7c605502a17a529",
   "members": [
     {
       "member": "delivery",

package/src/__fixtures__/change-set/warden.change-set.golden.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://intentius.io/chant/schemas/workspace/change-set/v1/change-set.schema.json",
   "contract": 1,
-  "digest": "jcs1-sha256:c3f30feb61c9337a7ddbeaa752cf1ff67ec8efefd7d705516e4bcca6840a8a50",
+  "digest": "jcs1-sha256:266dbcb79b7922940f2b18bae4bebda8418422d4a5539eeeed119759694bd3a3",
   "members": [
     {
       "member": "warden",
@@ -9,7 +9,7 @@
       "planner": "warden",
       "scope": "acme",
       "status": "planned",
-      "planDigest": "jcs1-sha256:f86dc7f2ad51397bba9a6259ea7c1d98070ee1d1d2e61f11e1e753fa8c006d86",
+      "planDigest": "jcs1-sha256:0ae7141f1c5543916126f5162bd2ce3c9d3f240155b6b9965886280a9fc56e62",
       "holes": []
     }
   ],

package/src/__fixtures__/change-set/warden.plan.json

@@ -1,44 +1,51 @@
-{
-  "org": "acme",
-  "entries": [
-    {
-      "kind": "update",
-      "resourceType": "team",
-      "key": "platform",
-      "before": {
-        "privacy": "secret",
-        "description": "Platform team"
+[
+  {
+    "org": "acme",
+    "entries": [
+      {
+        "kind": "delete",
+        "resourceType": "team",
+        "key": "contractors",
+        "before": {
+          "privacy": "closed",
+          "description": "Old contractors"
+        },
+        "verb": "membership"
       },
-      "after": {
-        "privacy": "closed",
-        "description": "Platform team"
+      {
+        "kind": "update",
+        "resourceType": "team",
+        "key": "platform",
+        "before": {
+          "privacy": "secret",
+          "description": "Platform team"
+        },
+        "after": {
+          "privacy": "closed",
+          "description": "Platform team"
+        },
+        "fields": [
+          {
+            "field": "privacy",
+            "before": "secret",
+            "after": "closed"
+          }
+        ],
+        "verb": "membership"
       },
-      "fields": [
-        {
-          "field": "privacy",
-          "before": "secret",
-          "after": "closed"
-        }
-      ]
-    },
-    {
-      "kind": "create",
-      "resourceType": "team",
-      "key": "release",
-      "after": {
-        "privacy": "secret",
-        "description": "Release managers"
-      }
-    },
-    {
-      "kind": "delete",
-      "resourceType": "team",
-      "key": "contractors",
-      "before": {
-        "privacy": "closed",
-        "description": "Old contractors"
+      {
+        "kind": "create",
+        "resourceType": "team",
+        "key": "release",
+        "after": {
+          "privacy": "secret",
+          "description": "Release managers"
+        },
+        "verb": "membership"
       }
+    ],
+    "managedCounts": {
+      "team": 2
     }
-  ],
-  "managedCount": 2
-}
+  }
+]

package/src/__fixtures__/plan-summary/normalization-vectors.json

@@ -5,7 +5,8 @@
     "Each repo keeps its own grouping code and runs every row in CI.",
     "rootPairs: a and b are two roots of a choudoufu live-plan-set -json document; summarize a set holding exactly the two, and they must land in one group iff group is true.",
     "instancePairs: a and b are two resource_changes of one terraform show -json plan; summarize that plan, and the two instances must land in one group iff group is true.",
-    "Red first: a naive grouper (equal raw resource_changes) must fail every rootPairs row with group true, and a grouper that blanks every string value in before and after must falsely group exactly the rootPairs rows named in overEagerFalselyGroups."
+    "Red first: a naive grouper (equal raw resource_changes) must fail every rootPairs row with group true, and a grouper that blanks every string value in before and after must falsely group exactly the rootPairs rows named in overEagerFalselyGroups.",
+    "sensitive attribute: chant's change-set carries no value for an attribute marked in before_sensitive or after_sensitive, so two sensitive attributes group by path alone, and a sensitive attribute never groups with an unmarked one. read entry: a data source read carries no attributes, so reads of one address group whatever they returned."
   ],
   "rootPairs": [
     {
@@ -1379,6 +1380,277 @@
           ]
         }
       }
+    },
+    {
+      "name": "sensitive attribute with different values",
+      "group": true,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "aws_db_instance.main",
+              "change": {
+                "actions": [
+                  "update"
+                ],
+                "before": {
+                  "password": "old-a",
+                  "instance_class": "db.t3.small"
+                },
+                "after": {
+                  "password": "new-a",
+                  "instance_class": "db.t3.small"
+                },
+                "before_sensitive": {
+                  "password": true
+                },
+                "after_sensitive": {
+                  "password": true
+                }
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "aws_db_instance.main",
+              "change": {
+                "actions": [
+                  "update"
+                ],
+                "before": {
+                  "password": "old-b",
+                  "instance_class": "db.t3.small"
+                },
+                "after": {
+                  "password": "new-b",
+                  "instance_class": "db.t3.small"
+                },
+                "before_sensitive": {
+                  "password": true
+                },
+                "after_sensitive": {
+                  "password": true
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "name": "sensitive against not sensitive on the same attribute",
+      "group": false,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "aws_db_instance.main",
+              "change": {
+                "actions": [
+                  "update"
+                ],
+                "before": {
+                  "password": "same-old",
+                  "instance_class": "db.t3.small"
+                },
+                "after": {
+                  "password": "same-new",
+                  "instance_class": "db.t3.small"
+                },
+                "before_sensitive": {
+                  "password": true
+                },
+                "after_sensitive": {
+                  "password": true
+                }
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "aws_db_instance.main",
+              "change": {
+                "actions": [
+                  "update"
+                ],
+                "before": {
+                  "password": "same-old",
+                  "instance_class": "db.t3.small"
+                },
+                "after": {
+                  "password": "same-new",
+                  "instance_class": "db.t3.small"
+                }
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "name": "read entries whose results differ",
+      "group": true,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.base",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0aaa111",
+                  "image_id": "ami-0aaa111",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.base",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0bbb222",
+                  "image_id": "ami-0bbb222",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "name": "a read of a different data source",
+      "group": false,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.base",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0aaa111",
+                  "image_id": "ami-0aaa111",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.other",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0aaa111",
+                  "image_id": "ami-0aaa111",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      }
+    },
+    {
+      "name": "a read against a plan with no entry for it",
+      "group": false,
+      "a": {
+        "root": "roots/acme",
+        "estate": "acme",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": [
+            {
+              "address": "data.aws_ami.base",
+              "change": {
+                "actions": [
+                  "read"
+                ],
+                "after": {
+                  "id": "ami-0aaa111",
+                  "image_id": "ami-0aaa111",
+                  "owner": "amazon"
+                },
+                "after_unknown": {}
+              }
+            }
+          ]
+        }
+      },
+      "b": {
+        "root": "roots/globex",
+        "estate": "globex",
+        "status": "planned",
+        "plan": {
+          "format_version": "1.2",
+          "resource_changes": []
+        }
+      }
     }
   ],
   "instancePairs": [
@@ -1588,6 +1860,7 @@
     "different policy document",
     "different tag value that does not carry the estate",
     "a tofu-estate marker naming some other estate",
-    "the estate name inside a longer word is not the estate"
+    "the estate name inside a longer word is not the estate",
+    "sensitive against not sensitive on the same attribute"
   ]
 }

package/src/__fixtures__/pr-loop/pr-apply-applied.note.golden.md

@@ -10,7 +10,7 @@ Applied 2 members. Head `222222222222`, measured from `111111111111`.
 
 A member whose inputs moved applied the plan it was approved with. The next run plans it against the new values.
 
-Plan digest: `jcs1-sha256:46bff52773a158dffa5c895b98f8760d601a2f9dc6af7dc235dbf65496f7bf65`
+Plan digest: `jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0`
 
 Approved by `github:alice` for this digest.
 

package/src/__fixtures__/pr-loop/pr-apply-refused.note.golden.md

@@ -3,14 +3,14 @@
 
 The apply refused. Head `222222222222`, measured from `111111111111`.
 
-> The plan changed after review, so nothing was applied. approved: jcs1-sha256:0000000000000000000000000000000000000000000000000000000000000063; planned now: jcs1-sha256:46bff52773a158dffa5c895b98f8760d601a2f9dc6af7dc235dbf65496f7bf65. Read the new plan, and if it is right, approve it: chant approve pr-12 pr-apply --plan jcs1-sha256:46bff52773a158dffa5c895b98f8760d601a2f9dc6af7dc235dbf65496f7bf65 --approver <you> --sign; then run the apply again.
+> The plan changed after review, so nothing was applied. approved: jcs1-sha256:0000000000000000000000000000000000000000000000000000000000000063; planned now: jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0. Read the new plan, and if it is right, approve it: chant approve pr-12 pr-apply --plan jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0 --approver <you> --sign; then run the apply again.
 
 | Member | Component | Status | Create | Update | Replace | Delete |
 |---|---|---|---:|---:|---:|---:|
 | `a` | a | planned | 0 | 1 | 0 | 0 |
 | `app` | app | planned | 0 | 0 | 0 | 0 |
 
-Plan digest: `jcs1-sha256:46bff52773a158dffa5c895b98f8760d601a2f9dc6af7dc235dbf65496f7bf65`
+Plan digest: `jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0`
 
 An approval stands for `jcs1-sha256:0000000000000000000000000000000000000000000000000000000000000063`, not for this digest: the plan changed since it was approved.
 

package/src/__fixtures__/pr-loop/pr-plan.golden.json

@@ -8,7 +8,7 @@
   "head": "2222222222222222222222222222222222222222",
   "op": "pr-12",
   "gate": "pr-apply",
-  "digest": "jcs1-sha256:46bff52773a158dffa5c895b98f8760d601a2f9dc6af7dc235dbf65496f7bf65",
+  "digest": "jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0",
   "status": "planned",
   "approval": {
     "status": "pending"
@@ -60,7 +60,7 @@
   "changeSet": {
     "$schema": "https://intentius.io/chant/schemas/workspace/change-set/v1/change-set.schema.json",
     "contract": 1,
-    "digest": "jcs1-sha256:46bff52773a158dffa5c895b98f8760d601a2f9dc6af7dc235dbf65496f7bf65",
+    "digest": "jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0",
     "members": [
       {
         "member": "a",

package/src/__fixtures__/pr-loop/pr-plan.note.golden.md

@@ -8,14 +8,14 @@ Planned 2 members. Head `222222222222`, measured from `111111111111`.
 | `a` | a | planned | 0 | 1 | 0 | 0 |
 | `app` | app | planned | 0 | 0 | 0 | 0 |
 
-Plan digest: `jcs1-sha256:46bff52773a158dffa5c895b98f8760d601a2f9dc6af7dc235dbf65496f7bf65`
+Plan digest: `jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0`
 
 Not approved yet.
 
 A reviewer who approved this pull request approves the plan with:
 
 ```
-chant approve pr-12 pr-apply --plan jcs1-sha256:46bff52773a158dffa5c895b98f8760d601a2f9dc6af7dc235dbf65496f7bf65 --approver github:<your-login> --sign
+chant approve pr-12 pr-apply --plan jcs1-sha256:7623a8677afb0bf98d77c602521a3abfa96f76cff25675d350a28c2e26a7bad0 --approver github:<your-login> --sign
 ```
 
 It applies on merge if the plan is still this one. If it moved, the apply refuses and names both digests.

package/src/build.test.ts

@@ -253,7 +253,7 @@ export const testEntity = {
     const result = await build(testDir, []);
 
     expect(result.warnings.length).toBeGreaterThan(0);
-    expect(result.warnings[0]).toContain('No serializer found for lexicon "unknown"');
+    expect(result.warnings[0]).toContain('No serializer found for lexicon "unknown". List the lexicon in chant.config.ts.');
   });
 });
 

package/src/build.ts

@@ -897,7 +897,7 @@ async function buildFromDiscoveryResult(
       // designed shape until a lexicon materializes the receipt (#1835), not
       // a missing-serializer problem.
     } else {
-      warnings.push(`No serializer found for lexicon "${lexiconName}"`);
+      warnings.push(`No serializer found for lexicon "${lexiconName}". List the lexicon in chant.config.ts.`);
     }
   }
 

package/src/change-set.test.ts

@@ -10,10 +10,11 @@
  * update. The update, delete, effect and hole mappings are pinned on typed
  * entries below.
  *
- * `warden.plan.json` is the reconcile change set chant's own
- * `diffCollection` produces for a warden's teams cycle: one create, one
- * update and one owned delete. github-warden prints its plan as text today,
- * so this is the shape it would write.
+ * `warden.plan.json` is what github-warden's `reconcile --plan-json` wrote
+ * (github-warden#66) for a teams cycle in an org that declares `owned: true`:
+ * one create, one update and one owned delete, as a JSON array of reconcile
+ * change sets. It was produced by warden's own `runReconcile` and
+ * `teamsCycle` against a stubbed live state, not built here.
  *
  * Goldens regenerate with `UPDATE_GOLDEN=1`.
  */
@@ -24,6 +25,7 @@ import { describe, expect, test } from "vitest";
 import {
   CHANGE_SET_SCHEMA_ID,
   changeSetDigest,
+  changeSetDocumentDigest,
   composeChangeSet,
   lifecyclePlanPart,
   reconcilePlanPart,
@@ -140,10 +142,8 @@ describe("lifecyclePlanPart", () => {
 });
 
 describe("reconcilePlanPart", () => {
-  test("a warden's teams cycle, as chant's reconcile primitives plan it", () => {
-    const plan = wardenPlan();
-    golden("warden.plan.json", plan);
-    const part = reconcilePlanPart({ member: "warden", plan: read(DIR, "warden.plan.json") as ReconcileChangeSet });
+  test("a warden's teams cycle, as `reconcile --plan-json` wrote it", () => {
+    const part = reconcilePlanPart({ member: "warden", plan: read(DIR, "warden.plan.json") as ReconcileChangeSet[] });
     expect(part.entries.map((e) => [e.address, e.action, e.disruption ?? null])).toEqual([
       ["team.contractors", "delete", "destroy"],
       ["team.platform", "update", "unknown"],
@@ -167,11 +167,20 @@ describe("the digest", () => {
   const warden = () => reconcilePlanPart({ member: "warden", plan: wardenPlan() });
   const tofu = () => read(TF_DIR, "tofu.part.golden.json") as ChangeSetPart;
 
-  test("is the set digest over { member, planDigest }, whatever order the parts come in", () => {
+  test("binds the set digest over { member, planDigest }, the members' status and holes, the entries and the side effects, whatever order the parts come in", () => {
     const doc = composeChangeSet([lifecycle(), warden(), tofu()]);
     expect(composeChangeSet([tofu(), warden(), lifecycle()])).toEqual(doc);
     const pairs = doc.members.map((m) => ({ member: m.member, planDigest: m.planDigest }));
-    expect(doc.digest).toBe(computePlanDigest("change-set", pairs));
+    expect(changeSetDigest(doc.members)).toBe(computePlanDigest("change-set", pairs));
+    expect(doc.digest).toBe(
+      computePlanDigest("change-set-document", {
+        set: computePlanDigest("change-set", pairs),
+        members: doc.members.map((m) => ({ member: m.member, status: m.status, holes: m.holes })),
+        entries: doc.entries,
+        sideEffects: [],
+      }),
+    );
+    expect(doc.digest).toBe(changeSetDocumentDigest({ ...doc, entries: [...doc.entries].reverse() }));
     expect(doc.digest).toMatch(/^jcs1-sha256:[0-9a-f]{64}$/);
     expect(verifyChangeSetDigest(doc)).toBe(true);
     expect(verifyChangeSetDigest({ ...doc, digest: changeSetDigest(doc.members.slice(1)) })).toBe(false);
@@ -183,8 +192,29 @@ describe("the digest", () => {
     const moved = wardenPlan();
     moved.entries[0] = { ...moved.entries[0], after: { privacy: "closed", description: "Release engineers" } };
     expect(composeChangeSet([lifecycle(), reconcilePlanPart({ member: "warden", plan: moved })]).digest).not.toBe(base);
-    // A wave is a subset of members: its digest is the same function over them.
-    expect(changeSetDigest([lifecycle().member])).toBe(composeChangeSet([lifecycle()]).digest);
+    // A wave is a subset of members: its digest is the set digest over them, which the document's digest binds.
+    expect(changeSetDigest([lifecycle().member])).toBe(computePlanDigest("change-set", [{ member: "delivery", planDigest: lifecycle().member.planDigest }]));
+    expect(changeSetDigest([lifecycle().member])).not.toBe(composeChangeSet([lifecycle()]).digest);
+  });
+
+  test("moves when an entry, a hole, a member's status or a side effect does, so a document with edited entries does not verify (#3555)", () => {
+    const doc = composeChangeSet([lifecycle(), warden()]);
+    const [first, ...rest] = doc.entries;
+    const edited = [
+      { ...doc, entries: rest },
+      { ...doc, entries: [{ ...first, action: first.action === "delete" ? ("create" as const) : ("delete" as const) }, ...rest] },
+      { ...doc, entries: [{ ...first, attributes: [...first.attributes, { path: "planted", after: "x" }] }, ...rest] },
+      { ...doc, entries: [...doc.entries, { ...first, address: `${first.address}-planted` }] },
+      { ...doc, members: doc.members.map((m) => ({ ...m, holes: [...m.holes, { address: "planted", reason: "unobserved" }] })) },
+      { ...doc, members: doc.members.map((m, i) => (i === 0 ? { ...m, status: "failed" as const } : m)) },
+      { ...doc, sideEffects: [{ member: doc.members[0].member, address: "action.aws_lambda_invoke.planted", type: "aws_lambda_invoke" }] },
+    ];
+    expect(verifyChangeSetDigest(doc)).toBe(true);
+    for (const e of edited) {
+      expect(changeSetDocumentDigest(e)).not.toBe(doc.digest);
+      expect(verifyChangeSetDigest(e)).toBe(false);
+    }
+    expect(verifyChangeSetDigest({ ...doc, members: [...doc.members, doc.members[0]] })).toBe(false);
   });
 
   test("leaves provisional members out, so approving the document never covers them", () => {