@intentius/chant 0.112.1 → 0.114.0

package/dist/cli/handlers/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAE9E;AAmCD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyH/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C3E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+L3E;AA4rBD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAqR3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2L/E;AAsBD;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAgBD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAmE7E;AAiCD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8D/E"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/cli/handlers/lifecycle.ts"],"names":[],"mappings":"AA+CA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAKlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,MAAM,CAE9E;AAmCD;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAyH/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA4C3E;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B/E;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA+L3E;AAmsBD;;;;;;;;;GASG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAwR3E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2L/E;AAsBD;;GAEG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiB1E;AAgBD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAmE7E;AAiCD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAM9E;AAkBD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA8D/E"}

package/dist/lifecycle/change-set.d.ts

@@ -115,6 +115,13 @@ export interface ChangeSetEntry {
      * place" (a defaulted namespace, an endpoint override, the wrong region).
      */
     queried?: string;
+    /**
+     * The declared definition's fingerprint, for `action: "create"` (#3652),
+     * when the caller passed `definitions`. A create carries no deltas, so
+     * without it the plan says what it would create by name only, and the
+     * plan's digest does not move when the declaration does.
+     */
+    definition?: string;
     /** The declared entity this resource's owner chain resolves to, for `action: "runtime"` (#1077). */
     runtimeOwner?: string;
     /**

package/dist/lifecycle/change-set.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../../src/lifecycle/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAY,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAEvF;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,QAAQ,EAAE;QACR,oCAAoC;QACpC,QAAQ,EAAE,OAAO,CAAC;QAClB,oCAAoC;QACpC,UAAU,EAAE,OAAO,CAAC;QACpB,qDAAqD;QACrD,IAAI,EAAE,OAAO,CAAC;QACd;;;;;WAKG;QACH,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,6CAA6C;IAC7C,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,oDAAoD;IACpD,SAAS,EAAE,SAAS,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,sNAAsN;AACtN,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CA6GvG;AAID,gCAAgC;AAChC,wBAAgB,SAAS,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAarE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,EAAE,EAAE,SAAS,GAAG,cAAc,CAG5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,EAAE,CAO5D;AAwBD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAgDrD;AAsFD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CA0C7D"}
+{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../../src/lifecycle/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAY,KAAK,eAAe,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AACjF,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAC7E,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AACtF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEnH;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,GAAG,kBAAkB,CAAC;AAEvF;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,QAAQ,EAAE;QACR,oCAAoC;QACpC,QAAQ,EAAE,OAAO,CAAC;QAClB,oCAAoC;QACpC,UAAU,EAAE,OAAO,CAAC;QACpB,qDAAqD;QACrD,IAAI,EAAE,OAAO,CAAC;QACd;;;;;WAKG;QACH,QAAQ,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,6CAA6C;IAC7C,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B,oDAAoD;IACpD,SAAS,EAAE,SAAS,CAAC;IACrB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oGAAoG;IACpG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC,gGAAgG;IAChG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,4DAA4D;IAC5D,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,0GAA0G;IAC1G,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,sNAAsN;AACtN,MAAM,WAAW,aAAc,SAAQ,cAAc;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC;CACxB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,SAAS,CA+GvG;AAID,gCAAgC;AAChC,wBAAgB,SAAS,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAarE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uEAAuE;AACvE,wBAAgB,cAAc,CAAC,EAAE,EAAE,SAAS,GAAG,cAAc,CAG5D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,EAAE,CAO5D;AAwBD,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAgDrD;AAsFD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CA0C7D"}

package/dist/lifecycle/digest.d.ts

@@ -14,6 +14,18 @@ import type { BuildDigest, DigestDiff } from "./types.js";
  * hashes rather than throwing.
  */
 export declare function hashProps(props: unknown): string;
+/**
+ * The fingerprint of one entity's declared definition (#3652): its type and
+ * its build props, hashed by {@link hashProps}. A live diff and a lifecycle
+ * plan print it beside each create, so the plan digest a gate binds moves
+ * when what would be created changes, not only when its name does.
+ */
+export declare function definitionDigest(entityType: string, props: unknown): string;
+/** {@link definitionDigest} for every entity in `entities`, keyed by name. */
+export declare function declaredDefinitions(entities: Iterable<readonly [string, {
+    entityType: string;
+    props?: unknown;
+}]>): Record<string, string>;
 /**
  * Compute a full build digest from a BuildResult.
  */

package/dist/lifecycle/digest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/lifecycle/digest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAkB,UAAU,EAAE,MAAM,SAAS,CAAC;AAIvE;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGhD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CA4BxE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,WAAW,GAAG,SAAS,GAChC,UAAU,CAiCZ"}
+{"version":3,"file":"digest.d.ts","sourceRoot":"","sources":["../../src/lifecycle/digest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C,OAAO,KAAK,EAAE,WAAW,EAAkB,UAAU,EAAE,MAAM,SAAS,CAAC;AAKvE;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAGhD;AA0BD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAE3E;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,GAC7E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CA4BxE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,WAAW,EACpB,QAAQ,EAAE,WAAW,GAAG,SAAS,GAChC,UAAU,CAiCZ"}

package/dist/lifecycle/live-diff.d.ts

@@ -91,6 +91,14 @@ export interface LiveDiffResult {
      * namespace, and only this field makes that visible.
      */
     queried?: Record<string, string>;
+    /**
+     * The declared definition of each `missing` entity, fingerprinted (#3652):
+     * what applying the diff would create, not only its name. A plan digest is
+     * taken over the diff, and a create listed by name alone let an approval for
+     * "create events" stand after `events` was edited. Present only when the
+     * caller supplied {@link DiffLiveInput.definitions} and something is missing.
+     */
+    definitions?: Record<string, string>;
 }
 export interface DiffLiveInput {
     /** Entity names from the current build. */
@@ -111,6 +119,13 @@ export interface DiffLiveInput {
      * never consulted for classification.
      */
     queried?: Record<string, string>;
+    /**
+     * Each declared entity's definition fingerprint (#3652), from
+     * `declaredDefinitions` in ./digest.ts. Carried onto the result for the
+     * entities that are missing, so a diff that proposes a create names what it
+     * would create. Never consulted for classification.
+     */
+    definitions?: Record<string, string>;
 }
 /** The delta between two saved snapshots (#822): a two-way observed diff. */
 export interface SnapshotDiffResult {
@@ -131,6 +146,15 @@ export interface SnapshotDiffResult {
  */
 export declare function diffSnapshots(prev: Record<string, ResourceMetadata>, next: Record<string, ResourceMetadata>): SnapshotDiffResult;
 export declare function diffLive(input: DiffLiveInput): LiveDiffResult;
+/**
+ * One row of a live diff's MISSING section, as `chant lifecycle diff --live`
+ * prints it. The address the read went to (#1620) is the line between "not
+ * there" and "looked in the wrong place". The definition's fingerprint
+ * (#3652) is what the create would create: `ApplyOp` digests these rows, and
+ * a row naming the entity alone left an approval standing after the
+ * declaration changed.
+ */
+export declare function missingRow(diff: Pick<LiveDiffResult, "queried" | "definitions">, name: string): string;
 export interface LiveArtifactDiffResult {
     /** Observed now, not in previous snapshot. */
     added: string[];

package/dist/lifecycle/live-diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-diff.d.ts","sourceRoot":"","sources":["../../src/lifecycle/live-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,eAAe,EAAE,oBAAoB,EAAE,CAAC;IACxC,mDAAmD;IACnD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mEAAmE;IACnE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,oBAAoB,EAAE,aAAa,EAAE,CAAC;IACtC,sDAAsD;IACtD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;OAIG;IACH,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;IAC3D;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AA6DD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gCAAgC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oEAAoE;IACpE,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACrC,kBAAkB,CAiBpB;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAsI7D;AAID,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,sBAAsB,CAmCvF"}
+{"version":3,"file":"live-diff.d.ts","sourceRoot":"","sources":["../../src/lifecycle/live-diff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,wFAAwF;AACxF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,eAAe,EAAE,oBAAoB,EAAE,CAAC;IACxC,mDAAmD;IACnD,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,mEAAmE;IACnE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,oDAAoD;IACpD,oBAAoB,EAAE,aAAa,EAAE,CAAC;IACtC,sDAAsD;IACtD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB;;;;OAIG;IACH,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,aAAa;IAC5B,2CAA2C;IAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;IAC3D;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AA6DD,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,gCAAgC;IAChC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oEAAoE;IACpE,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EACtC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GACrC,kBAAkB,CAiBpB;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CAuI7D;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,aAAa,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAItG;AAeD,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iCAAiC;IACjC,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,mCAAmC;IACnC,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9C,2DAA2D;IAC3D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;CAC5D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,sBAAsB,CAmCvF"}

package/dist/op/activities/lifecycle.d.ts

@@ -23,8 +23,8 @@ export interface LifecycleDiffResult {
     exitCode: number;
     /**
      * True when the diff output contains any drift indicators
-     * (MISSING / ORPHAN / DRIFTED / DISAPPEARED section headers from
-     * `chant lifecycle diff --live`).
+     * (MISSING / ORPHAN / DRIFTED / DISAPPEARED / PROPERTY DRIFT section
+     * headers from `chant lifecycle diff --live`).
      */
     drifted: boolean;
     /**
@@ -55,13 +55,22 @@ export interface LifecycleDiffResult {
  * approval would be stale the moment it was written.
  */
 export declare function normalizeDiffChangeSet(output: string): string[];
+/** True when a `chant lifecycle diff` render carries any of {@link DRIFT_HEADERS}' sections. */
+export declare function detectDrift(output: string): boolean;
+/**
+ * The identity of one `chant lifecycle diff` result (#2300). The environment
+ * and the `--live` flag are hashed alongside the change set because they say
+ * what the change set is *of*: the same rows against `staging` are not an
+ * approval to apply against `prod`.
+ */
+export declare function lifecycleDiffDigest(args: LifecycleDiffArgs, output: string): string;
 /**
  * Run `chant lifecycle diff <env>` and return the output + structured drift
  * flag. Read-only; intended for use inside watch/observation Ops.
  * Uses fastIdempotent profile.
  *
  * The `drifted` field is computed by scanning the output for any of the
- * MISSING / ORPHAN / DRIFTED / DISAPPEARED section headers documented in
+ * MISSING / ORPHAN / DRIFTED / DISAPPEARED / PROPERTY DRIFT section headers documented in
  * cli/state.mdx. Pair with `outcomeAttribute: { name: "Drift", from: "drifted" }`
  * on a WatchOp activity step to surface drift as the run's `Drift` outcome.
  */

package/dist/op/activities/lifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/op/activities/lifecycle.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxG;AAED,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM/D;AAkCD;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAa/G"}
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../src/op/activities/lifecycle.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,qBAAqB;IACpC,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIxG;AAED,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ;;;OAGG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM/D;AAmBD,gGAAgG;AAChG,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMnF;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAa/G"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.112.1",
+  "version": "0.114.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/handlers/lifecycle.ts

@@ -18,8 +18,8 @@ import {
   type DeviationToAccept,
   type ObservationBaseline,
 } from "../../lifecycle/observation-baseline";
-import { computeBuildDigest, diffDigests } from "../../lifecycle/digest";
-import { diffLive, diffLiveArtifacts, diffSnapshots, type LiveDiffResult, type LiveArtifactDiffResult, type SnapshotDiffResult } from "../../lifecycle/live-diff";
+import { computeBuildDigest, declaredDefinitions, diffDigests } from "../../lifecycle/digest";
+import { diffLive, diffLiveArtifacts, diffSnapshots, missingRow, type LiveDiffResult, type LiveArtifactDiffResult, type SnapshotDiffResult } from "../../lifecycle/live-diff";
 import { buildChangeSet, renderChangeSet, renderChangeSetMarkdown, gitlabMrReport, unobservedPlanNotice, type ChangeSet, type HeldEntitySet } from "../../lifecycle/change-set";
 import { mergeReceiptEntries, observedValueResolver, planReceipts, readReceiptValue, type ReceiptReading } from "../../lifecycle/receipt-plan";
 import { annotateDisruption, disruptionNotices } from "../../lifecycle/disruption";
@@ -876,7 +876,17 @@ async function runLifecycleDiffLive(args: LiveDiffArgs): Promise<LiveDiffOutcome
       });
       const observedNow = observed.resources;
       const observedThen = prevSnapshot?.resources;
-      const diff = diffLive({ declared, observedNow, observedThen, unobserved: observed.unobserved, queried: observed.queried });
+      const diff = diffLive({
+        declared,
+        observedNow,
+        observedThen,
+        unobserved: observed.unobserved,
+        queried: observed.queried,
+        // What each create would create (#3652), so the diff, and the plan
+        // digest ApplyOp's gate binds to it, moves when a missing entity's
+        // declaration does.
+        definitions: declaredDefinitions(entities),
+      });
       // Unobserved entities are deliberately NOT drift: a hole in the read is
       // not a change in the cloud. They are reported separately (#1089) so a
       // "no drift detected" line can never be built on top of a failed read.
@@ -1128,10 +1138,7 @@ function renderLiveDiff(lexiconName: string, environment: string, diff: LiveDiff
   if (diff.missing.length > 0) {
     console.log(formatBold("\nMISSING (declared, provider reports not in cloud):"));
     for (const name of diff.missing) {
-      // The address the read actually went to (#1620) — the line between "not
-      // there" and "looked in the wrong place" (a defaulted namespace, say).
-      const queried = diff.queried?.[name];
-      console.log(`  - ${name}${queried ? ` [queried ${queried}]` : ""}`);
+      console.log(missingRow(diff, name));
     }
   }
   if (diff.orphan.length > 0) {
@@ -1415,6 +1422,9 @@ export async function runLifecyclePlan(ctx: CommandContext): Promise<number> {
         // The resolved read address rides every entry, not just unobserved
         // ones — the diff path already passes it (#1620); plan lost it.
         queried: observed.queried,
+        // A create carries its declaration's fingerprint (#3652), so the
+        // plan's digest moves when what it would create does.
+        definitions: declaredDefinitions(entities),
       }, {
         // Attribution survives the flat merge below (#1674).
         lexicon: lexiconName,

package/src/lifecycle/change-set.test.ts

@@ -11,6 +11,8 @@ import {
   type HeldEntitySet,
 } from "./change-set";
 import type { ResourceMetadata } from "../lexicon";
+import { declaredDefinitions, definitionDigest } from "./digest";
+import { lifecyclePlanPart } from "../change-set";
 
 const meta = (over: Partial<ResourceMetadata> = {}): ResourceMetadata => ({
   type: "Fake::Resource",
@@ -638,3 +640,40 @@ describe("ChangeSet.held (#2162)", () => {
     expect(renderChangeSetMarkdown(cs)).not.toContain("HELD");
   });
 });
+
+// #3652: a create carries no deltas, so the plan named what it would create
+// by name alone and its digest stood still when the declaration changed.
+describe("a create's declared definition (#3652)", () => {
+  const plan = (columns: Record<string, unknown>) =>
+    buildChangeSet("dev", {
+      declared: new Set(["events", "users"]),
+      observedNow: { users: meta() },
+      observedThen: undefined,
+      definitions: declaredDefinitions([
+        ["events", { entityType: "PG::Table", props: { columns } }],
+        ["users", { entityType: "PG::Table", props: { columns: { id: "int" } } }],
+      ]),
+    });
+
+  test("rides the create, and only the create", () => {
+    const cs = plan({ id: "int" });
+    const events = cs.entries.find((e) => e.name === "events")!;
+    const users = cs.entries.find((e) => e.name === "users")!;
+    expect(events.action).toBe("create");
+    expect(events.definition).toBe(definitionDigest("PG::Table", { columns: { id: "int" } }));
+    expect(users.action).toBe("noop");
+    expect(users.definition).toBeUndefined();
+  });
+
+  test("moves the lifecycle plan's digest when the created object's props change, and only then", () => {
+    const digest = (cs: ChangeSet) => lifecyclePlanPart({ member: "db", plan: cs }).member.planDigest;
+    expect(digest(plan({ id: "int" }))).toBe(digest(plan({ id: "int" })));
+    expect(digest(plan({ id: "int" }))).not.toBe(digest(plan({ id: "int", kind: "text" })));
+  });
+
+  test("is left off when the caller passes no definitions", () => {
+    const cs = buildChangeSet("dev", { declared: new Set(["events"]), observedNow: {}, observedThen: undefined });
+    expect(cs.entries[0].action).toBe("create");
+    expect("definition" in cs.entries[0]).toBe(false);
+  });
+});

package/src/lifecycle/change-set.ts

@@ -119,6 +119,13 @@ export interface ChangeSetEntry {
    * place" (a defaulted namespace, an endpoint override, the wrong region).
    */
   queried?: string;
+  /**
+   * The declared definition's fingerprint, for `action: "create"` (#3652),
+   * when the caller passed `definitions`. A create carries no deltas, so
+   * without it the plan says what it would create by name only, and the
+   * plan's digest does not move when the declaration does.
+   */
+  definition?: string;
   /** The declared entity this resource's owner chain resolves to, for `action: "runtime"` (#1077). */
   runtimeOwner?: string;
   /**
@@ -265,6 +272,7 @@ export function buildChangeSet(env: string, input: DiffLiveInput, options?: Chan
     // there is one, else the observation's queried map. Diagnostic only; the
     // classification above never reads it.
     const queried = unobservedEntry?.queried ?? input.queried?.[name];
+    const definition = action === "create" ? input.definitions?.[name] : undefined;
 
     // The provider's id for the row (#1674). Live first; the snapshot's only
     // when the resource is no longer live (a snapshot-only noop).
@@ -286,6 +294,7 @@ export function buildChangeSet(env: string, input: DiffLiveInput, options?: Chan
           }
         : {}),
       ...(queried ? { queried } : {}),
+      ...(definition ? { definition } : {}),
       ...(runtimeOwner ? { runtimeOwner } : {}),
     });
   }

package/src/lifecycle/digest.test.ts

@@ -2,6 +2,8 @@ import { describe, test, expect } from "vitest";
 import { computeBuildDigest, diffDigests, hashProps } from "./digest";
 import type { BuildResult } from "../build";
 import type { BuildDigest } from "./types";
+import { AttrRef } from "../attrref";
+import { LOGICAL_NAME_SYMBOL } from "../utils";
 
 function makeBuildResult(entitiesByLexicon: Record<string, Array<{ name: string; type: string; props: unknown }>>): BuildResult {
   const entities = new Map();
@@ -37,6 +39,30 @@ describe("hashProps", () => {
   test("produces different hashes for different props", () => {
     expect(hashProps({ a: 1 })).not.toBe(hashProps({ a: 2 }));
   });
+
+  // #3642: a sql index's `columns` holds AttrRefs the build never names, and
+  // their toJSON throws, so a snapshot of the project failed.
+  describe("an AttrRef the build did not name", () => {
+    const parent = { [LOGICAL_NAME_SYMBOL]: "orders" };
+
+    test("hashes instead of throwing, as the envelope named by its parent", () => {
+      const nested = { columns: [new AttrRef(parent, "status")] };
+      expect(() => JSON.stringify(nested)).toThrow(/logical name not set/);
+      const named = new AttrRef({}, "status");
+      named._setLogicalName("orders");
+      expect(hashProps(nested)).toBe(hashProps({ columns: [named] }));
+    });
+
+    test("tells two attributes apart", () => {
+      expect(hashProps({ c: [new AttrRef(parent, "status")] })).not.toBe(hashProps({ c: [new AttrRef(parent, "amount")] }));
+    });
+
+    test("hashes a named AttrRef as it always has", () => {
+      const ref = new AttrRef({}, "arn");
+      ref._setLogicalName("bucket");
+      expect(hashProps({ a: ref })).toBe(hashProps({ a: { __attrRef: { entity: "bucket", attribute: "arn" } } }));
+    });
+  });
 });
 
 describe("computeBuildDigest", () => {

package/src/lifecycle/digest.ts

@@ -9,6 +9,7 @@ import type { Declarable } from "../declarable";
 import type { BuildDigest, ResourceDigest, DigestDiff } from "./types";
 import { canonicalJson } from "../effect-receipt";
 import { contentDigest } from "../content-digest";
+import { isAttrRefLike, LOGICAL_NAME_SYMBOL } from "../utils";
 
 /**
  * Hash an entity's props deterministically: bare hex SHA-256 over their
@@ -18,10 +19,53 @@ import { contentDigest } from "../content-digest";
  * hashes rather than throwing.
  */
 export function hashProps(props: unknown): string {
-  const plain: unknown = JSON.parse(JSON.stringify(props) ?? "null");
+  const plain: unknown = JSON.parse(JSON.stringify(namedRefs(props)) ?? "null");
   return contentDigest(canonicalJson(plain)).slice("sha256:".length);
 }
 
+/**
+ * `props` with each AttrRef that has no logical name of its own written as
+ * the envelope its `toJSON` gives, named by its parent's logical name. The
+ * build names only an entity's top-level AttrRefs; one held in a record,
+ * such as a sql table's `columns`, is never named, and `toJSON` throws on
+ * it (chant#3642). Plain objects and arrays are walked; anything else is
+ * left for `JSON.stringify`, so a named AttrRef hashes as it always has.
+ */
+function namedRefs(value: unknown): unknown {
+  if (isAttrRefLike(value)) {
+    if (value.getLogicalName()) return value;
+    const parent = value.parent.deref() as Record<symbol, unknown> | undefined;
+    const entity = parent?.[LOGICAL_NAME_SYMBOL];
+    return { __attrRef: { entity: typeof entity === "string" ? entity : null, attribute: value.attribute } };
+  }
+  if (Array.isArray(value)) return value.map(namedRefs);
+  if (value !== null && typeof value === "object") {
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null) return value;
+    return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, namedRefs(v)]));
+  }
+  return value;
+}
+
+/**
+ * The fingerprint of one entity's declared definition (#3652): its type and
+ * its build props, hashed by {@link hashProps}. A live diff and a lifecycle
+ * plan print it beside each create, so the plan digest a gate binds moves
+ * when what would be created changes, not only when its name does.
+ */
+export function definitionDigest(entityType: string, props: unknown): string {
+  return hashProps({ type: entityType, props: props ?? {} });
+}
+
+/** {@link definitionDigest} for every entity in `entities`, keyed by name. */
+export function declaredDefinitions(
+  entities: Iterable<readonly [string, { entityType: string; props?: unknown }]>,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [name, entity] of entities) out[name] = definitionDigest(entity.entityType, entity.props);
+  return out;
+}
+
 /**
  * Compute a full build digest from a BuildResult.
  */

package/src/lifecycle/live-diff.test.ts

@@ -1,5 +1,5 @@
 import { describe, test, expect } from "vitest";
-import { diffLive, diffLiveArtifacts, diffSnapshots } from "./live-diff";
+import { diffLive, diffLiveArtifacts, diffSnapshots, missingRow } from "./live-diff";
 import type { ResourceMetadata, ArtifactMetadata } from "../lexicon";
 
 const meta = (overrides: Partial<ResourceMetadata> = {}): ResourceMetadata => ({
@@ -409,3 +409,27 @@ describe("attribute comparison is key-order insensitive (#1279)", () => {
     expect(result.driftedSinceSnapshot).toHaveLength(1);
   });
 });
+
+describe("diffLive definitions (#3652)", () => {
+  test("carries the fingerprint of each missing entity, and of nothing else", () => {
+    const diff = diffLive({
+      declared: new Set(["a", "b"]),
+      observedNow: { b: { type: "T", status: "OK" } },
+      observedThen: undefined,
+      definitions: { a: "aaa", b: "bbb" },
+    });
+    expect(diff.missing).toEqual(["a"]);
+    expect(diff.definitions).toEqual({ a: "aaa" });
+    expect(missingRow(diff, "a")).toBe("  - a [definition aaa]");
+  });
+
+  test("is absent when nothing is missing, so a no-op diff is unchanged", () => {
+    const diff = diffLive({
+      declared: new Set(["b"]),
+      observedNow: { b: { type: "T", status: "OK" } },
+      observedThen: undefined,
+      definitions: { b: "bbb" },
+    });
+    expect("definitions" in diff).toBe(false);
+  });
+});

package/src/lifecycle/live-diff.ts

@@ -96,6 +96,14 @@ export interface LiveDiffResult {
    * namespace, and only this field makes that visible.
    */
   queried?: Record<string, string>;
+  /**
+   * The declared definition of each `missing` entity, fingerprinted (#3652):
+   * what applying the diff would create, not only its name. A plan digest is
+   * taken over the diff, and a create listed by name alone let an approval for
+   * "create events" stand after `events` was edited. Present only when the
+   * caller supplied {@link DiffLiveInput.definitions} and something is missing.
+   */
+  definitions?: Record<string, string>;
 }
 
 export interface DiffLiveInput {
@@ -117,6 +125,13 @@ export interface DiffLiveInput {
    * never consulted for classification.
    */
   queried?: Record<string, string>;
+  /**
+   * Each declared entity's definition fingerprint (#3652), from
+   * `declaredDefinitions` in ./digest.ts. Carried onto the result for the
+   * entities that are missing, so a diff that proposes a create names what it
+   * would create. Never consulted for classification.
+   */
+  definitions?: Record<string, string>;
 }
 
 const TRACKED_FIELDS: Array<keyof ResourceMetadata> = [
@@ -351,9 +366,35 @@ export function diffLive(input: DiffLiveInput): LiveDiffResult {
     unchanged: unchanged.sort(),
     unobserved: unobserved.sort((a, b) => a.name.localeCompare(b.name)),
     ...(input.queried && Object.keys(input.queried).length > 0 ? { queried: input.queried } : {}),
+    ...missingDefinitions(missing, input.definitions),
   };
 }
 
+/**
+ * One row of a live diff's MISSING section, as `chant lifecycle diff --live`
+ * prints it. The address the read went to (#1620) is the line between "not
+ * there" and "looked in the wrong place". The definition's fingerprint
+ * (#3652) is what the create would create: `ApplyOp` digests these rows, and
+ * a row naming the entity alone left an approval standing after the
+ * declaration changed.
+ */
+export function missingRow(diff: Pick<LiveDiffResult, "queried" | "definitions">, name: string): string {
+  const queried = diff.queried?.[name];
+  const definition = diff.definitions?.[name];
+  return `  - ${name}${queried ? ` [queried ${queried}]` : ""}${definition ? ` [definition ${definition}]` : ""}`;
+}
+
+/** `{ definitions }` for the missing entities that have one, or nothing at all. */
+function missingDefinitions(missing: readonly string[], definitions: Record<string, string> | undefined): { definitions?: Record<string, string> } {
+  if (!definitions) return {};
+  const out: Record<string, string> = {};
+  for (const name of [...missing].sort()) {
+    const d = definitions[name];
+    if (d !== undefined) out[name] = d;
+  }
+  return Object.keys(out).length > 0 ? { definitions: out } : {};
+}
+
 // ── Artifact diff (no `declared` axis) ──────────────────────────────────────
 
 export interface LiveArtifactDiffResult {

package/src/op/activities/lifecycle.test.ts

@@ -0,0 +1,83 @@
+import { describe, expect, test } from "vitest";
+import { detectDrift, lifecycleDiffDigest } from "./lifecycle";
+import { declaredDefinitions } from "../../lifecycle/digest";
+import { diffLive, missingRow } from "../../lifecycle/live-diff";
+import type { ResourceMetadata } from "../../lexicon";
+
+const BOLD = "\u001b[1m";
+const RESET = "\u001b[0m";
+
+// Renders as `chant lifecycle diff <env> --live` printed them against the sql
+// emulator (#3642), bold headers included: the activity reads them off a
+// child process, colour and all.
+const HEAD = `${BOLD}sql${RESET} — environment: watch\n`;
+const CLEAN = `${HEAD}0 missing, 0 orphan, 0 disappeared, 0 newly observed, 0 drifted, 3 unchanged\n${"-".repeat(80)}\n\u001b[32mNo drift detected across 1 lexicon(s)${RESET}`;
+const PROPERTY = `${HEAD}0 missing, 0 orphan, 0 disappeared, 0 newly observed, 0 drifted, 3 unchanged\n${"-".repeat(80)}\n\n${BOLD}sql (properties)${RESET}\n1 property drift across 1 resource(s), 0 accepted, 2 unchanged\n${"-".repeat(80)}\n${BOLD}\nPROPERTY DRIFT (declared vs live; baseline shown where one exists):${RESET}\n  - events (ClickHouse::Table)\n      ttl: ts + INTERVAL 180 DAY → ts + toIntervalDay(30) [from: authored]`;
+const MISSING = `${HEAD}1 missing, 0 orphan, 0 disappeared, 0 newly observed, 0 drifted, 2 unchanged\n${"-".repeat(80)}\n${BOLD}\nMISSING (declared, provider reports not in cloud):${RESET}\n  - byKind [queried http://127.0.0.1:8123 yodel_3642.by_kind]`;
+
+describe("detectDrift", () => {
+  test("a clean render is not drift", () => {
+    expect(detectDrift(CLEAN)).toBe(false);
+  });
+
+  test("an owned object's property changed out of band is drift (PROPERTY DRIFT)", () => {
+    expect(detectDrift(PROPERTY)).toBe(true);
+  });
+
+  test("a declared object gone from the server is drift (MISSING)", () => {
+    expect(detectDrift(MISSING)).toBe(true);
+  });
+
+  test("the counts line alone, lower case, is not drift", () => {
+    expect(detectDrift("1 property drift across 1 resource(s)")).toBe(false);
+  });
+});
+
+// #3652: the digest ApplyOp's gate binds is taken over the diff render. A
+// create used to be listed by name only, so an approval for "create events"
+// stood after `events` was edited. The MISSING row now carries the declared
+// definition's fingerprint, and the digest moves with it.
+describe("lifecycleDiffDigest over a create (#3652)", () => {
+  const env = { env: "dev", live: true };
+  const eventsA = { entityType: "ClickHouse::Table", props: { name: "events", columns: { id: { type: "UInt64" } } } };
+  const eventsB = {
+    entityType: "ClickHouse::Table",
+    props: { name: "events", columns: { id: { type: "UInt64" }, kind: { type: "String" } } },
+  };
+
+  function render(events: { entityType: string; props: Record<string, unknown> }, live: Record<string, ResourceMetadata> = {}): string {
+    const entities = new Map([["events", events]]);
+    const diff = diffLive({
+      declared: new Set(entities.keys()),
+      observedNow: live,
+      observedThen: undefined,
+      queried: { events: "http://emulator:8123 yodel_3652.events" },
+      definitions: declaredDefinitions(entities),
+    });
+    const rows = diff.missing.map((name) => missingRow(diff, name));
+    return `${HEAD}${diff.missing.length} missing\n${rows.length > 0 ? `MISSING (declared, provider reports not in cloud):\n${rows.join("\n")}` : ""}`;
+  }
+
+  test("a create of different props is a different plan", () => {
+    expect(lifecycleDiffDigest(env, render(eventsA))).not.toBe(lifecycleDiffDigest(env, render(eventsB)));
+  });
+
+  test("a create of the same props is the same plan, whatever order the props were written in", () => {
+    const reordered = { entityType: "ClickHouse::Table", props: { columns: { id: { type: "UInt64" } }, name: "events" } };
+    expect(lifecycleDiffDigest(env, render(eventsA))).toBe(lifecycleDiffDigest(env, render(reordered)));
+  });
+
+  test("a create of another type with the same props is a different plan", () => {
+    const view = { ...eventsA, entityType: "ClickHouse::View" };
+    expect(lifecycleDiffDigest(env, render(eventsA))).not.toBe(lifecycleDiffDigest(env, render(view)));
+  });
+
+  test("a no-op prints no definition, so its digest is what it was before #3652 and stable across runs", () => {
+    const live = { events: { type: "ClickHouse::Table", status: "present" } as ResourceMetadata };
+    const once = render(eventsA, live);
+    expect(once).not.toContain("[definition");
+    expect(lifecycleDiffDigest(env, once)).toBe(lifecycleDiffDigest(env, render(eventsA, live)));
+    // An edit to an object that exists is the deep read's to report, not this row's.
+    expect(lifecycleDiffDigest(env, once)).toBe(lifecycleDiffDigest(env, render(eventsB, live)));
+  });
+});

package/src/op/activities/lifecycle.ts

@@ -36,8 +36,8 @@ export interface LifecycleDiffResult {
   exitCode: number;
   /**
    * True when the diff output contains any drift indicators
-   * (MISSING / ORPHAN / DRIFTED / DISAPPEARED section headers from
-   * `chant lifecycle diff --live`).
+   * (MISSING / ORPHAN / DRIFTED / DISAPPEARED / PROPERTY DRIFT section
+   * headers from `chant lifecycle diff --live`).
    */
   drifted: boolean;
   /**
@@ -85,12 +85,16 @@ const DRIFT_HEADERS = [
   "ORPHAN",
   "DISAPPEARED",
   "DRIFTED",
+  // An owned resource whose live properties differ from its declaration (the
+  // deep read): a sql table's TTL changed out of band, say (#3642).
+  "PROPERTY DRIFT",
   "ARTIFACTS ADDED",
   "ARTIFACTS REMOVED",
   "ARTIFACTS CHANGED",
 ];
 
-function detectDrift(output: string): boolean {
+/** True when a `chant lifecycle diff` render carries any of {@link DRIFT_HEADERS}' sections. */
+export function detectDrift(output: string): boolean {
   return DRIFT_HEADERS.some((h) => output.includes(`${h} (`) || output.includes(`\n${h}`));
 }
 
@@ -100,7 +104,7 @@ function detectDrift(output: string): boolean {
  * what the change set is *of*: the same rows against `staging` are not an
  * approval to apply against `prod`.
  */
-function lifecycleDiffDigest(args: LifecycleDiffArgs, output: string): string {
+export function lifecycleDiffDigest(args: LifecycleDiffArgs, output: string): string {
   return computePlanDigest("lifecycle-diff", {
     env: args.env,
     live: args.live === true,
@@ -114,7 +118,7 @@ function lifecycleDiffDigest(args: LifecycleDiffArgs, output: string): string {
  * Uses fastIdempotent profile.
  *
  * The `drifted` field is computed by scanning the output for any of the
- * MISSING / ORPHAN / DRIFTED / DISAPPEARED section headers documented in
+ * MISSING / ORPHAN / DRIFTED / DISAPPEARED / PROPERTY DRIFT section headers documented in
  * cli/state.mdx. Pair with `outcomeAttribute: { name: "Drift", from: "drifted" }`
  * on a WatchOp activity step to surface drift as the run's `Drift` outcome.
  */