Module snapshot 

Available on crate feature catalog only.

Config-change preview (#374): build a redacted snapshot of the resolved + expanded config, and diff the current config against the last recorded one.

faucet run / replicate / schedule record a ConfigSnapshot on every successful invocation (best-effort — see super::record_config_snapshot). faucet plan --diff re-expands the current config, loads the last snapshot, and renders a semantic, per-row diff (rows created / changed / removed, and within each changed row the exact fields that differ).

Two properties make this trustworthy where a raw YAML text-diff is not:

• Resolved, not textual. The snapshot is built from the expanded nodes (post extends/vars/${env:} interpolation and matrix fan-out), so a one-line ${vars.x} edit that fans out across many rows shows up as the real per-row effect, and two textually-different files that resolve to the same movement show no diff.
• Secret-safe. Every secret-sourced value is replaced with a stable <secret:sha256:…> token before storage (see redact_value). No secret material is ever persisted, and a rotated secret surfaces as a changed hash (“secret rotated”) rather than printing either value.

Structs

DiffSummary

Roll-up counts, terraform plan-style.

FieldChange

One field-level change within a changed row.

RowDiff

One row’s entry in the diff.

SnapshotDiff

The full config diff, serialized verbatim by --json.

Enums

RowStatus

Per-row status in a config diff, terraform plan-style.

Functions

build_snapshot

Build a redacted snapshot from the resolved + expanded nodes. pipeline and on_error are passed in (via resolve_name / on_error_str) so every call site keys snapshots identically; clock is the record time (passed in so callers stay deterministic in tests).

diff

Diff current against the last recorded snapshot (previous). With no previous snapshot every row is New (first-run, like terraform plan on fresh state).

on_error_str

The execution.on_error policy as a stable string ("stop" / "continue").

record_if_ok

Build + record the config snapshot for a run that finished cleanly, when a catalog is configured. Best-effort — never fails the run (mirrors super::record). This is the single place run / replicate / schedule funnel through, so the record logic is exercised by one test rather than three untested call sites.

redact_value

Recursively replace every secret-sourced string in value with a stable <secret:sha256:…> token. Non-secret strings pass through verbatim, so real config changes (paths, table names, page sizes) stay visible in the diff.

render_human

Render the diff as human-readable text (the default plan --diff output).

resolve_name

The canonical pipeline name used to key snapshots — identical logic to the run / replicate / schedule observability label, so the record side and the plan --diff side always agree on the key: the explicit name:, else the config file stem, else "pipeline".