Merge #20282: Enforce expected behaviors for provider PlanResourceChange

An exception remains for the legacy SDK, which does not meet all of these requirements.

command/apply_test.go

@@ -341,10 +341,7 @@ func TestApply_error(t *testing.T) {
 
 	var lock sync.Mutex
 	errored := false
-	p.ApplyFn = func(
+	p.ApplyFn = func(info *terraform.InstanceInfo, s *terraform.InstanceState, d *terraform.InstanceDiff) (*terraform.InstanceState, error) {
-		info *terraform.InstanceInfo,
-		s *terraform.InstanceState,
-		d *terraform.InstanceDiff) (*terraform.InstanceState, error) {
 		lock.Lock()
 		defer lock.Unlock()
 
@@ -353,19 +350,34 @@ func TestApply_error(t *testing.T) {
 			return nil, fmt.Errorf("error")
 		}
 
-		return &terraform.InstanceState{ID: "foo"}, nil
+		newState := &terraform.InstanceState{
+			ID:         "foo",
+			Attributes: map[string]string{},
+		}
+		newState.Attributes["id"] = newState.ID
+		if ad, ok := d.Attributes["ami"]; ok {
+			newState.Attributes["ami"] = ad.New
+		}
+		if ad, ok := d.Attributes["error"]; ok {
+			newState.Attributes["error"] = ad.New
+		}
+		return newState, nil
 	}
-	p.DiffFn = func(
+	p.DiffFn = func(info *terraform.InstanceInfo, s *terraform.InstanceState, rc *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
-		*terraform.InstanceInfo,
+		ret := &terraform.InstanceDiff{
-		*terraform.InstanceState,
+			Attributes: map[string]*terraform.ResourceAttrDiff{},
-		*terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
+		}
-		return &terraform.InstanceDiff{
+		if new, ok := rc.Get("ami"); ok {
-			Attributes: map[string]*terraform.ResourceAttrDiff{
+			ret.Attributes["ami"] = &terraform.ResourceAttrDiff{
-				"ami": &terraform.ResourceAttrDiff{
+				New: new.(string),
-					New: "bar",
+			}
-				},
+		}
-			},
+		if new, ok := rc.Get("error"); ok {
-		}, nil
+			ret.Attributes["error"] = &terraform.ResourceAttrDiff{
+				New: fmt.Sprintf("%t", new.(bool)),
+			}
+		}
+		return ret, nil
 	}
 	p.GetSchemaReturn = &terraform.ProviderSchema{
 		ResourceTypes: map[string]*configschema.Block{
@@ -1102,6 +1114,7 @@ func TestApply_vars(t *testing.T) {
 		},
 	}
 
+	actual := ""
 	p.GetSchemaReturn = &terraform.ProviderSchema{
 		ResourceTypes: map[string]*configschema.Block{
 			"test_instance": {
@@ -1116,17 +1129,11 @@ func TestApply_vars(t *testing.T) {
 			NewState: req.PlannedState,
 		}
 	}
-
+	p.PlanResourceChangeFn = func(req providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse {
-	actual := ""
+		actual = req.ProposedNewState.GetAttr("value").AsString()
-	p.DiffFn = func(
+		return providers.PlanResourceChangeResponse{
-		info *terraform.InstanceInfo,
+			PlannedState: req.ProposedNewState,
-		s *terraform.InstanceState,
-		c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
-		if v, ok := c.Config["value"]; ok {
-			actual = v.(string)
 		}
-
-		return &terraform.InstanceDiff{}, nil
 	}
 
 	args := []string{
@@ -1161,6 +1168,7 @@ func TestApply_varFile(t *testing.T) {
 		},
 	}
 
+	actual := ""
 	p.GetSchemaReturn = &terraform.ProviderSchema{
 		ResourceTypes: map[string]*configschema.Block{
 			"test_instance": {
@@ -1175,17 +1183,11 @@ func TestApply_varFile(t *testing.T) {
 			NewState: req.PlannedState,
 		}
 	}
-
+	p.PlanResourceChangeFn = func(req providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse {
-	actual := ""
+		actual = req.ProposedNewState.GetAttr("value").AsString()
-	p.DiffFn = func(
+		return providers.PlanResourceChangeResponse{
-		info *terraform.InstanceInfo,
+			PlannedState: req.ProposedNewState,
-		s *terraform.InstanceState,
-		c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
-		if v, ok := c.Config["value"]; ok {
-			actual = v.(string)
 		}
-
-		return &terraform.InstanceDiff{}, nil
 	}
 
 	args := []string{
@@ -1230,6 +1232,7 @@ func TestApply_varFileDefault(t *testing.T) {
 		},
 	}
 
+	actual := ""
 	p.GetSchemaReturn = &terraform.ProviderSchema{
 		ResourceTypes: map[string]*configschema.Block{
 			"test_instance": {
@@ -1244,17 +1247,11 @@ func TestApply_varFileDefault(t *testing.T) {
 			NewState: req.PlannedState,
 		}
 	}
-
+	p.PlanResourceChangeFn = func(req providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse {
-	actual := ""
+		actual = req.ProposedNewState.GetAttr("value").AsString()
-	p.DiffFn = func(
+		return providers.PlanResourceChangeResponse{
-		info *terraform.InstanceInfo,
+			PlannedState: req.ProposedNewState,
-		s *terraform.InstanceState,
-		c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
-		if v, ok := c.Config["value"]; ok {
-			actual = v.(string)
 		}
-
-		return &terraform.InstanceDiff{}, nil
 	}
 
 	args := []string{
@@ -1298,6 +1295,7 @@ func TestApply_varFileDefaultJSON(t *testing.T) {
 		},
 	}
 
+	actual := ""
 	p.GetSchemaReturn = &terraform.ProviderSchema{
 		ResourceTypes: map[string]*configschema.Block{
 			"test_instance": {
@@ -1312,17 +1310,11 @@ func TestApply_varFileDefaultJSON(t *testing.T) {
 			NewState: req.PlannedState,
 		}
 	}
-
+	p.PlanResourceChangeFn = func(req providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse {
-	actual := ""
+		actual = req.ProposedNewState.GetAttr("value").AsString()
-	p.DiffFn = func(
+		return providers.PlanResourceChangeResponse{
-		info *terraform.InstanceInfo,
+			PlannedState: req.ProposedNewState,
-		s *terraform.InstanceState,
-		c *terraform.ResourceConfig) (*terraform.InstanceDiff, error) {
-		if v, ok := c.Config["value"]; ok {
-			actual = v.(string)
 		}
-
-		return &terraform.InstanceDiff{}, nil
 	}
 
 	args := []string{

configs/configschema/implied_type.go

@@ -19,3 +19,24 @@ func (b *Block) ImpliedType() cty.Type {
 
 	return hcldec.ImpliedType(b.DecoderSpec())
 }
+
+// ContainsSensitive returns true if any of the attributes of the receiving
+// block or any of its descendent blocks are marked as sensitive.
+//
+// Blocks themselves cannot be sensitive as a whole -- sensitivity is a
+// per-attribute idea -- but sometimes we want to include a whole object
+// decoded from a block in some UI output, and that is safe to do only if
+// none of the contained attributes are sensitive.
+func (b *Block) ContainsSensitive() bool {
+	for _, attrS := range b.Attributes {
+		if attrS.Sensitive {
+			return true
+		}
+	}
+	for _, blockS := range b.BlockTypes {
+		if blockS.ContainsSensitive() {
+			return true
+		}
+	}
+	return false
+}

helper/plugin/grpc_provider.go

@@ -475,6 +475,14 @@ func (s *GRPCProviderServer) ReadResource(_ context.Context, req *proto.ReadReso
 func (s *GRPCProviderServer) PlanResourceChange(_ context.Context, req *proto.PlanResourceChange_Request) (*proto.PlanResourceChange_Response, error) {
 	resp := &proto.PlanResourceChange_Response{}
 
+	// This is a signal to Terraform Core that we're doing the best we can to
+	// shim the legacy type system of the SDK onto the Terraform type system
+	// but we need it to cut us some slack. This setting should not be taken
+	// forward to any new SDK implementations, since setting it prevents us
+	// from catching certain classes of provider bug that can lead to
+	// confusing downstream errors.
+	resp.LegacyTypeSystem = true
+
 	res := s.provider.ResourcesMap[req.TypeName]
 	block := res.CoreConfigSchema()
 

internal/tfplugin5/tfplugin5.pb.go

@@ -46,7 +46,7 @@ func (x Diagnostic_Severity) String() string {
 	return proto.EnumName(Diagnostic_Severity_name, int32(x))
 }
 func (Diagnostic_Severity) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{1, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{1, 0}
 }
 
 type Schema_NestedBlock_NestingMode int32
@@ -78,7 +78,7 @@ func (x Schema_NestedBlock_NestingMode) String() string {
 	return proto.EnumName(Schema_NestedBlock_NestingMode_name, int32(x))
 }
 func (Schema_NestedBlock_NestingMode) EnumDescriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{5, 2, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{5, 2, 0}
 }
 
 // DynamicValue is an opaque encoding of terraform data, with the field name
@@ -95,7 +95,7 @@ func (m *DynamicValue) Reset()         { *m = DynamicValue{} }
 func (m *DynamicValue) String() string { return proto.CompactTextString(m) }
 func (*DynamicValue) ProtoMessage()    {}
 func (*DynamicValue) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{0}
 }
 func (m *DynamicValue) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_DynamicValue.Unmarshal(m, b)
@@ -143,7 +143,7 @@ func (m *Diagnostic) Reset()         { *m = Diagnostic{} }
 func (m *Diagnostic) String() string { return proto.CompactTextString(m) }
 func (*Diagnostic) ProtoMessage()    {}
 func (*Diagnostic) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{1}
 }
 func (m *Diagnostic) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Diagnostic.Unmarshal(m, b)
@@ -202,7 +202,7 @@ func (m *AttributePath) Reset()         { *m = AttributePath{} }
 func (m *AttributePath) String() string { return proto.CompactTextString(m) }
 func (*AttributePath) ProtoMessage()    {}
 func (*AttributePath) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{2}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{2}
 }
 func (m *AttributePath) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_AttributePath.Unmarshal(m, b)
@@ -244,7 +244,7 @@ func (m *AttributePath_Step) Reset()         { *m = AttributePath_Step{} }
 func (m *AttributePath_Step) String() string { return proto.CompactTextString(m) }
 func (*AttributePath_Step) ProtoMessage()    {}
 func (*AttributePath_Step) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{2, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{2, 0}
 }
 func (m *AttributePath_Step) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_AttributePath_Step.Unmarshal(m, b)
@@ -404,7 +404,7 @@ func (m *Stop) Reset()         { *m = Stop{} }
 func (m *Stop) String() string { return proto.CompactTextString(m) }
 func (*Stop) ProtoMessage()    {}
 func (*Stop) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{3}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{3}
 }
 func (m *Stop) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Stop.Unmarshal(m, b)
@@ -434,7 +434,7 @@ func (m *Stop_Request) Reset()         { *m = Stop_Request{} }
 func (m *Stop_Request) String() string { return proto.CompactTextString(m) }
 func (*Stop_Request) ProtoMessage()    {}
 func (*Stop_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{3, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{3, 0}
 }
 func (m *Stop_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Stop_Request.Unmarshal(m, b)
@@ -465,7 +465,7 @@ func (m *Stop_Response) Reset()         { *m = Stop_Response{} }
 func (m *Stop_Response) String() string { return proto.CompactTextString(m) }
 func (*Stop_Response) ProtoMessage()    {}
 func (*Stop_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{3, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{3, 1}
 }
 func (m *Stop_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Stop_Response.Unmarshal(m, b)
@@ -507,7 +507,7 @@ func (m *RawState) Reset()         { *m = RawState{} }
 func (m *RawState) String() string { return proto.CompactTextString(m) }
 func (*RawState) ProtoMessage()    {}
 func (*RawState) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{4}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{4}
 }
 func (m *RawState) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_RawState.Unmarshal(m, b)
@@ -558,7 +558,7 @@ func (m *Schema) Reset()         { *m = Schema{} }
 func (m *Schema) String() string { return proto.CompactTextString(m) }
 func (*Schema) ProtoMessage()    {}
 func (*Schema) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{5}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{5}
 }
 func (m *Schema) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Schema.Unmarshal(m, b)
@@ -605,7 +605,7 @@ func (m *Schema_Block) Reset()         { *m = Schema_Block{} }
 func (m *Schema_Block) String() string { return proto.CompactTextString(m) }
 func (*Schema_Block) ProtoMessage()    {}
 func (*Schema_Block) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{5, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{5, 0}
 }
 func (m *Schema_Block) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Schema_Block.Unmarshal(m, b)
@@ -663,7 +663,7 @@ func (m *Schema_Attribute) Reset()         { *m = Schema_Attribute{} }
 func (m *Schema_Attribute) String() string { return proto.CompactTextString(m) }
 func (*Schema_Attribute) ProtoMessage()    {}
 func (*Schema_Attribute) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{5, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{5, 1}
 }
 func (m *Schema_Attribute) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Schema_Attribute.Unmarshal(m, b)
@@ -747,7 +747,7 @@ func (m *Schema_NestedBlock) Reset()         { *m = Schema_NestedBlock{} }
 func (m *Schema_NestedBlock) String() string { return proto.CompactTextString(m) }
 func (*Schema_NestedBlock) ProtoMessage()    {}
 func (*Schema_NestedBlock) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{5, 2}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{5, 2}
 }
 func (m *Schema_NestedBlock) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Schema_NestedBlock.Unmarshal(m, b)
@@ -812,7 +812,7 @@ func (m *GetProviderSchema) Reset()         { *m = GetProviderSchema{} }
 func (m *GetProviderSchema) String() string { return proto.CompactTextString(m) }
 func (*GetProviderSchema) ProtoMessage()    {}
 func (*GetProviderSchema) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{6}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{6}
 }
 func (m *GetProviderSchema) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_GetProviderSchema.Unmarshal(m, b)
@@ -842,7 +842,7 @@ func (m *GetProviderSchema_Request) Reset()         { *m = GetProviderSchema_Req
 func (m *GetProviderSchema_Request) String() string { return proto.CompactTextString(m) }
 func (*GetProviderSchema_Request) ProtoMessage()    {}
 func (*GetProviderSchema_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{6, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{6, 0}
 }
 func (m *GetProviderSchema_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_GetProviderSchema_Request.Unmarshal(m, b)
@@ -876,7 +876,7 @@ func (m *GetProviderSchema_Response) Reset()         { *m = GetProviderSchema_Re
 func (m *GetProviderSchema_Response) String() string { return proto.CompactTextString(m) }
 func (*GetProviderSchema_Response) ProtoMessage()    {}
 func (*GetProviderSchema_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{6, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{6, 1}
 }
 func (m *GetProviderSchema_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_GetProviderSchema_Response.Unmarshal(m, b)
@@ -934,7 +934,7 @@ func (m *PrepareProviderConfig) Reset()         { *m = PrepareProviderConfig{} }
 func (m *PrepareProviderConfig) String() string { return proto.CompactTextString(m) }
 func (*PrepareProviderConfig) ProtoMessage()    {}
 func (*PrepareProviderConfig) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{7}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{7}
 }
 func (m *PrepareProviderConfig) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_PrepareProviderConfig.Unmarshal(m, b)
@@ -965,7 +965,7 @@ func (m *PrepareProviderConfig_Request) Reset()         { *m = PrepareProviderCo
 func (m *PrepareProviderConfig_Request) String() string { return proto.CompactTextString(m) }
 func (*PrepareProviderConfig_Request) ProtoMessage()    {}
 func (*PrepareProviderConfig_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{7, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{7, 0}
 }
 func (m *PrepareProviderConfig_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_PrepareProviderConfig_Request.Unmarshal(m, b)
@@ -1004,7 +1004,7 @@ func (m *PrepareProviderConfig_Response) Reset()         { *m = PrepareProviderC
 func (m *PrepareProviderConfig_Response) String() string { return proto.CompactTextString(m) }
 func (*PrepareProviderConfig_Response) ProtoMessage()    {}
 func (*PrepareProviderConfig_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{7, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{7, 1}
 }
 func (m *PrepareProviderConfig_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_PrepareProviderConfig_Response.Unmarshal(m, b)
@@ -1048,7 +1048,7 @@ func (m *UpgradeResourceState) Reset()         { *m = UpgradeResourceState{} }
 func (m *UpgradeResourceState) String() string { return proto.CompactTextString(m) }
 func (*UpgradeResourceState) ProtoMessage()    {}
 func (*UpgradeResourceState) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{8}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{8}
 }
 func (m *UpgradeResourceState) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_UpgradeResourceState.Unmarshal(m, b)
@@ -1087,7 +1087,7 @@ func (m *UpgradeResourceState_Request) Reset()         { *m = UpgradeResourceSta
 func (m *UpgradeResourceState_Request) String() string { return proto.CompactTextString(m) }
 func (*UpgradeResourceState_Request) ProtoMessage()    {}
 func (*UpgradeResourceState_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{8, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{8, 0}
 }
 func (m *UpgradeResourceState_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_UpgradeResourceState_Request.Unmarshal(m, b)
@@ -1146,7 +1146,7 @@ func (m *UpgradeResourceState_Response) Reset()         { *m = UpgradeResourceSt
 func (m *UpgradeResourceState_Response) String() string { return proto.CompactTextString(m) }
 func (*UpgradeResourceState_Response) ProtoMessage()    {}
 func (*UpgradeResourceState_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{8, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{8, 1}
 }
 func (m *UpgradeResourceState_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_UpgradeResourceState_Response.Unmarshal(m, b)
@@ -1190,7 +1190,7 @@ func (m *ValidateResourceTypeConfig) Reset()         { *m = ValidateResourceType
 func (m *ValidateResourceTypeConfig) String() string { return proto.CompactTextString(m) }
 func (*ValidateResourceTypeConfig) ProtoMessage()    {}
 func (*ValidateResourceTypeConfig) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{9}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{9}
 }
 func (m *ValidateResourceTypeConfig) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ValidateResourceTypeConfig.Unmarshal(m, b)
@@ -1222,7 +1222,7 @@ func (m *ValidateResourceTypeConfig_Request) Reset()         { *m = ValidateReso
 func (m *ValidateResourceTypeConfig_Request) String() string { return proto.CompactTextString(m) }
 func (*ValidateResourceTypeConfig_Request) ProtoMessage()    {}
 func (*ValidateResourceTypeConfig_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{9, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{9, 0}
 }
 func (m *ValidateResourceTypeConfig_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ValidateResourceTypeConfig_Request.Unmarshal(m, b)
@@ -1267,7 +1267,7 @@ func (m *ValidateResourceTypeConfig_Response) Reset()         { *m = ValidateRes
 func (m *ValidateResourceTypeConfig_Response) String() string { return proto.CompactTextString(m) }
 func (*ValidateResourceTypeConfig_Response) ProtoMessage()    {}
 func (*ValidateResourceTypeConfig_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{9, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{9, 1}
 }
 func (m *ValidateResourceTypeConfig_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ValidateResourceTypeConfig_Response.Unmarshal(m, b)
@@ -1304,7 +1304,7 @@ func (m *ValidateDataSourceConfig) Reset()         { *m = ValidateDataSourceConf
 func (m *ValidateDataSourceConfig) String() string { return proto.CompactTextString(m) }
 func (*ValidateDataSourceConfig) ProtoMessage()    {}
 func (*ValidateDataSourceConfig) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{10}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{10}
 }
 func (m *ValidateDataSourceConfig) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ValidateDataSourceConfig.Unmarshal(m, b)
@@ -1336,7 +1336,7 @@ func (m *ValidateDataSourceConfig_Request) Reset()         { *m = ValidateDataSo
 func (m *ValidateDataSourceConfig_Request) String() string { return proto.CompactTextString(m) }
 func (*ValidateDataSourceConfig_Request) ProtoMessage()    {}
 func (*ValidateDataSourceConfig_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{10, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{10, 0}
 }
 func (m *ValidateDataSourceConfig_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ValidateDataSourceConfig_Request.Unmarshal(m, b)
@@ -1381,7 +1381,7 @@ func (m *ValidateDataSourceConfig_Response) Reset()         { *m = ValidateDataS
 func (m *ValidateDataSourceConfig_Response) String() string { return proto.CompactTextString(m) }
 func (*ValidateDataSourceConfig_Response) ProtoMessage()    {}
 func (*ValidateDataSourceConfig_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{10, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{10, 1}
 }
 func (m *ValidateDataSourceConfig_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ValidateDataSourceConfig_Response.Unmarshal(m, b)
@@ -1418,7 +1418,7 @@ func (m *Configure) Reset()         { *m = Configure{} }
 func (m *Configure) String() string { return proto.CompactTextString(m) }
 func (*Configure) ProtoMessage()    {}
 func (*Configure) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{11}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{11}
 }
 func (m *Configure) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Configure.Unmarshal(m, b)
@@ -1450,7 +1450,7 @@ func (m *Configure_Request) Reset()         { *m = Configure_Request{} }
 func (m *Configure_Request) String() string { return proto.CompactTextString(m) }
 func (*Configure_Request) ProtoMessage()    {}
 func (*Configure_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{11, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{11, 0}
 }
 func (m *Configure_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Configure_Request.Unmarshal(m, b)
@@ -1495,7 +1495,7 @@ func (m *Configure_Response) Reset()         { *m = Configure_Response{} }
 func (m *Configure_Response) String() string { return proto.CompactTextString(m) }
 func (*Configure_Response) ProtoMessage()    {}
 func (*Configure_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{11, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{11, 1}
 }
 func (m *Configure_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_Configure_Response.Unmarshal(m, b)
@@ -1532,7 +1532,7 @@ func (m *ReadResource) Reset()         { *m = ReadResource{} }
 func (m *ReadResource) String() string { return proto.CompactTextString(m) }
 func (*ReadResource) ProtoMessage()    {}
 func (*ReadResource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{12}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{12}
 }
 func (m *ReadResource) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ReadResource.Unmarshal(m, b)
@@ -1564,7 +1564,7 @@ func (m *ReadResource_Request) Reset()         { *m = ReadResource_Request{} }
 func (m *ReadResource_Request) String() string { return proto.CompactTextString(m) }
 func (*ReadResource_Request) ProtoMessage()    {}
 func (*ReadResource_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{12, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{12, 0}
 }
 func (m *ReadResource_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ReadResource_Request.Unmarshal(m, b)
@@ -1610,7 +1610,7 @@ func (m *ReadResource_Response) Reset()         { *m = ReadResource_Response{} }
 func (m *ReadResource_Response) String() string { return proto.CompactTextString(m) }
 func (*ReadResource_Response) ProtoMessage()    {}
 func (*ReadResource_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{12, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{12, 1}
 }
 func (m *ReadResource_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ReadResource_Response.Unmarshal(m, b)
@@ -1654,7 +1654,7 @@ func (m *PlanResourceChange) Reset()         { *m = PlanResourceChange{} }
 func (m *PlanResourceChange) String() string { return proto.CompactTextString(m) }
 func (*PlanResourceChange) ProtoMessage()    {}
 func (*PlanResourceChange) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{13}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{13}
 }
 func (m *PlanResourceChange) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_PlanResourceChange.Unmarshal(m, b)
@@ -1689,7 +1689,7 @@ func (m *PlanResourceChange_Request) Reset()         { *m = PlanResourceChange_R
 func (m *PlanResourceChange_Request) String() string { return proto.CompactTextString(m) }
 func (*PlanResourceChange_Request) ProtoMessage()    {}
 func (*PlanResourceChange_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{13, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{13, 0}
 }
 func (m *PlanResourceChange_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_PlanResourceChange_Request.Unmarshal(m, b)
@@ -1745,20 +1745,32 @@ func (m *PlanResourceChange_Request) GetPriorPrivate() []byte {
 }
 
 type PlanResourceChange_Response struct {
-	PlannedState         *DynamicValue    `protobuf:"bytes,1,opt,name=planned_state,json=plannedState,proto3" json:"planned_state,omitempty"`
+	PlannedState    *DynamicValue    `protobuf:"bytes,1,opt,name=planned_state,json=plannedState,proto3" json:"planned_state,omitempty"`
-	RequiresReplace      []*AttributePath `protobuf:"bytes,2,rep,name=requires_replace,json=requiresReplace,proto3" json:"requires_replace,omitempty"`
+	RequiresReplace []*AttributePath `protobuf:"bytes,2,rep,name=requires_replace,json=requiresReplace,proto3" json:"requires_replace,omitempty"`
-	PlannedPrivate       []byte           `protobuf:"bytes,3,opt,name=planned_private,json=plannedPrivate,proto3" json:"planned_private,omitempty"`
+	PlannedPrivate  []byte           `protobuf:"bytes,3,opt,name=planned_private,json=plannedPrivate,proto3" json:"planned_private,omitempty"`
-	Diagnostics          []*Diagnostic    `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
+	Diagnostics     []*Diagnostic    `protobuf:"bytes,4,rep,name=diagnostics,proto3" json:"diagnostics,omitempty"`
-	XXX_NoUnkeyedLiteral struct{}         `json:"-"`
+	// This may be set only by the helper/schema "SDK" in the main Terraform
-	XXX_unrecognized     []byte           `json:"-"`
+	// repository, to request that Terraform Core >=0.12 permit additional
-	XXX_sizecache        int32            `json:"-"`
+	// inconsistencies that can result from the legacy SDK type system
+	// and its imprecise mapping to the >=0.12 type system.
+	// The change in behavior implied by this flag makes sense only for the
+	// specific details of the legacy SDK type system, and are not a general
+	// mechanism to avoid proper type handling in providers.
+	//
+	//     ====              DO NOT USE THIS              ====
+	//     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+	//     ====              DO NOT USE THIS              ====
+	LegacyTypeSystem     bool     `protobuf:"varint,5,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
+	XXX_NoUnkeyedLiteral struct{} `json:"-"`
+	XXX_unrecognized     []byte   `json:"-"`
+	XXX_sizecache        int32    `json:"-"`
 }
 
 func (m *PlanResourceChange_Response) Reset()         { *m = PlanResourceChange_Response{} }
 func (m *PlanResourceChange_Response) String() string { return proto.CompactTextString(m) }
 func (*PlanResourceChange_Response) ProtoMessage()    {}
 func (*PlanResourceChange_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{13, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{13, 1}
 }
 func (m *PlanResourceChange_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_PlanResourceChange_Response.Unmarshal(m, b)
@@ -1806,6 +1818,13 @@ func (m *PlanResourceChange_Response) GetDiagnostics() []*Diagnostic {
 	return nil
 }
 
+func (m *PlanResourceChange_Response) GetLegacyTypeSystem() bool {
+	if m != nil {
+		return m.LegacyTypeSystem
+	}
+	return false
+}
+
 type ApplyResourceChange struct {
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
@@ -1816,7 +1835,7 @@ func (m *ApplyResourceChange) Reset()         { *m = ApplyResourceChange{} }
 func (m *ApplyResourceChange) String() string { return proto.CompactTextString(m) }
 func (*ApplyResourceChange) ProtoMessage()    {}
 func (*ApplyResourceChange) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{14}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{14}
 }
 func (m *ApplyResourceChange) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ApplyResourceChange.Unmarshal(m, b)
@@ -1851,7 +1870,7 @@ func (m *ApplyResourceChange_Request) Reset()         { *m = ApplyResourceChange
 func (m *ApplyResourceChange_Request) String() string { return proto.CompactTextString(m) }
 func (*ApplyResourceChange_Request) ProtoMessage()    {}
 func (*ApplyResourceChange_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{14, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{14, 0}
 }
 func (m *ApplyResourceChange_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ApplyResourceChange_Request.Unmarshal(m, b)
@@ -1918,9 +1937,9 @@ type ApplyResourceChange_Response struct {
 	// specific details of the legacy SDK type system, and are not a general
 	// mechanism to avoid proper type handling in providers.
 	//
-	//     ====                DO NOT USE THIS            ====
+	//     ====              DO NOT USE THIS              ====
 	//     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
-	//     ====                DO NOT USE THIS            ====
+	//     ====              DO NOT USE THIS              ====
 	LegacyTypeSystem     bool     `protobuf:"varint,4,opt,name=legacy_type_system,json=legacyTypeSystem,proto3" json:"legacy_type_system,omitempty"`
 	XXX_NoUnkeyedLiteral struct{} `json:"-"`
 	XXX_unrecognized     []byte   `json:"-"`
@@ -1931,7 +1950,7 @@ func (m *ApplyResourceChange_Response) Reset()         { *m = ApplyResourceChang
 func (m *ApplyResourceChange_Response) String() string { return proto.CompactTextString(m) }
 func (*ApplyResourceChange_Response) ProtoMessage()    {}
 func (*ApplyResourceChange_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{14, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{14, 1}
 }
 func (m *ApplyResourceChange_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ApplyResourceChange_Response.Unmarshal(m, b)
@@ -1989,7 +2008,7 @@ func (m *ImportResourceState) Reset()         { *m = ImportResourceState{} }
 func (m *ImportResourceState) String() string { return proto.CompactTextString(m) }
 func (*ImportResourceState) ProtoMessage()    {}
 func (*ImportResourceState) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{15}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{15}
 }
 func (m *ImportResourceState) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ImportResourceState.Unmarshal(m, b)
@@ -2021,7 +2040,7 @@ func (m *ImportResourceState_Request) Reset()         { *m = ImportResourceState
 func (m *ImportResourceState_Request) String() string { return proto.CompactTextString(m) }
 func (*ImportResourceState_Request) ProtoMessage()    {}
 func (*ImportResourceState_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{15, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{15, 0}
 }
 func (m *ImportResourceState_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ImportResourceState_Request.Unmarshal(m, b)
@@ -2068,7 +2087,7 @@ func (m *ImportResourceState_ImportedResource) Reset()         { *m = ImportReso
 func (m *ImportResourceState_ImportedResource) String() string { return proto.CompactTextString(m) }
 func (*ImportResourceState_ImportedResource) ProtoMessage()    {}
 func (*ImportResourceState_ImportedResource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{15, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{15, 1}
 }
 func (m *ImportResourceState_ImportedResource) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ImportResourceState_ImportedResource.Unmarshal(m, b)
@@ -2121,7 +2140,7 @@ func (m *ImportResourceState_Response) Reset()         { *m = ImportResourceStat
 func (m *ImportResourceState_Response) String() string { return proto.CompactTextString(m) }
 func (*ImportResourceState_Response) ProtoMessage()    {}
 func (*ImportResourceState_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{15, 2}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{15, 2}
 }
 func (m *ImportResourceState_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ImportResourceState_Response.Unmarshal(m, b)
@@ -2165,7 +2184,7 @@ func (m *ReadDataSource) Reset()         { *m = ReadDataSource{} }
 func (m *ReadDataSource) String() string { return proto.CompactTextString(m) }
 func (*ReadDataSource) ProtoMessage()    {}
 func (*ReadDataSource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{16}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{16}
 }
 func (m *ReadDataSource) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ReadDataSource.Unmarshal(m, b)
@@ -2197,7 +2216,7 @@ func (m *ReadDataSource_Request) Reset()         { *m = ReadDataSource_Request{}
 func (m *ReadDataSource_Request) String() string { return proto.CompactTextString(m) }
 func (*ReadDataSource_Request) ProtoMessage()    {}
 func (*ReadDataSource_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{16, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{16, 0}
 }
 func (m *ReadDataSource_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ReadDataSource_Request.Unmarshal(m, b)
@@ -2243,7 +2262,7 @@ func (m *ReadDataSource_Response) Reset()         { *m = ReadDataSource_Response
 func (m *ReadDataSource_Response) String() string { return proto.CompactTextString(m) }
 func (*ReadDataSource_Response) ProtoMessage()    {}
 func (*ReadDataSource_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{16, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{16, 1}
 }
 func (m *ReadDataSource_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ReadDataSource_Response.Unmarshal(m, b)
@@ -2287,7 +2306,7 @@ func (m *GetProvisionerSchema) Reset()         { *m = GetProvisionerSchema{} }
 func (m *GetProvisionerSchema) String() string { return proto.CompactTextString(m) }
 func (*GetProvisionerSchema) ProtoMessage()    {}
 func (*GetProvisionerSchema) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{17}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{17}
 }
 func (m *GetProvisionerSchema) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_GetProvisionerSchema.Unmarshal(m, b)
@@ -2317,7 +2336,7 @@ func (m *GetProvisionerSchema_Request) Reset()         { *m = GetProvisionerSche
 func (m *GetProvisionerSchema_Request) String() string { return proto.CompactTextString(m) }
 func (*GetProvisionerSchema_Request) ProtoMessage()    {}
 func (*GetProvisionerSchema_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{17, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{17, 0}
 }
 func (m *GetProvisionerSchema_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_GetProvisionerSchema_Request.Unmarshal(m, b)
@@ -2349,7 +2368,7 @@ func (m *GetProvisionerSchema_Response) Reset()         { *m = GetProvisionerSch
 func (m *GetProvisionerSchema_Response) String() string { return proto.CompactTextString(m) }
 func (*GetProvisionerSchema_Response) ProtoMessage()    {}
 func (*GetProvisionerSchema_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{17, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{17, 1}
 }
 func (m *GetProvisionerSchema_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_GetProvisionerSchema_Response.Unmarshal(m, b)
@@ -2393,7 +2412,7 @@ func (m *ValidateProvisionerConfig) Reset()         { *m = ValidateProvisionerCo
 func (m *ValidateProvisionerConfig) String() string { return proto.CompactTextString(m) }
 func (*ValidateProvisionerConfig) ProtoMessage()    {}
 func (*ValidateProvisionerConfig) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{18}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{18}
 }
 func (m *ValidateProvisionerConfig) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ValidateProvisionerConfig.Unmarshal(m, b)
@@ -2424,7 +2443,7 @@ func (m *ValidateProvisionerConfig_Request) Reset()         { *m = ValidateProvi
 func (m *ValidateProvisionerConfig_Request) String() string { return proto.CompactTextString(m) }
 func (*ValidateProvisionerConfig_Request) ProtoMessage()    {}
 func (*ValidateProvisionerConfig_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{18, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{18, 0}
 }
 func (m *ValidateProvisionerConfig_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ValidateProvisionerConfig_Request.Unmarshal(m, b)
@@ -2462,7 +2481,7 @@ func (m *ValidateProvisionerConfig_Response) Reset()         { *m = ValidateProv
 func (m *ValidateProvisionerConfig_Response) String() string { return proto.CompactTextString(m) }
 func (*ValidateProvisionerConfig_Response) ProtoMessage()    {}
 func (*ValidateProvisionerConfig_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{18, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{18, 1}
 }
 func (m *ValidateProvisionerConfig_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ValidateProvisionerConfig_Response.Unmarshal(m, b)
@@ -2499,7 +2518,7 @@ func (m *ProvisionResource) Reset()         { *m = ProvisionResource{} }
 func (m *ProvisionResource) String() string { return proto.CompactTextString(m) }
 func (*ProvisionResource) ProtoMessage()    {}
 func (*ProvisionResource) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{19}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{19}
 }
 func (m *ProvisionResource) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ProvisionResource.Unmarshal(m, b)
@@ -2531,7 +2550,7 @@ func (m *ProvisionResource_Request) Reset()         { *m = ProvisionResource_Req
 func (m *ProvisionResource_Request) String() string { return proto.CompactTextString(m) }
 func (*ProvisionResource_Request) ProtoMessage()    {}
 func (*ProvisionResource_Request) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{19, 0}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{19, 0}
 }
 func (m *ProvisionResource_Request) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ProvisionResource_Request.Unmarshal(m, b)
@@ -2577,7 +2596,7 @@ func (m *ProvisionResource_Response) Reset()         { *m = ProvisionResource_Re
 func (m *ProvisionResource_Response) String() string { return proto.CompactTextString(m) }
 func (*ProvisionResource_Response) ProtoMessage()    {}
 func (*ProvisionResource_Response) Descriptor() ([]byte, []int) {
-	return fileDescriptor_tfplugin5_84ffc2ac193fed94, []int{19, 1}
+	return fileDescriptor_tfplugin5_0417c8e6dca655d3, []int{19, 1}
 }
 func (m *ProvisionResource_Response) XXX_Unmarshal(b []byte) error {
 	return xxx_messageInfo_ProvisionResource_Response.Unmarshal(m, b)
@@ -3308,125 +3327,125 @@ var _Provisioner_serviceDesc = grpc.ServiceDesc{
 	Metadata: "tfplugin5.proto",
 }
 
-func init() { proto.RegisterFile("tfplugin5.proto", fileDescriptor_tfplugin5_84ffc2ac193fed94) }
+func init() { proto.RegisterFile("tfplugin5.proto", fileDescriptor_tfplugin5_0417c8e6dca655d3) }
 
-var fileDescriptor_tfplugin5_84ffc2ac193fed94 = []byte{
+var fileDescriptor_tfplugin5_0417c8e6dca655d3 = []byte{
-	// 1862 bytes of a gzipped FileDescriptorProto
+	// 1867 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xd4, 0x59, 0xcd, 0x6f, 0x1b, 0xc7,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xd4, 0x59, 0xcd, 0x73, 0x1b, 0x49,
-	0x15, 0xf7, 0x72, 0x45, 0x89, 0x7c, 0xd4, 0x07, 0x35, 0x76, 0x5c, 0x76, 0x93, 0xb4, 0x2a, 0xfb,
+	0x15, 0xcf, 0x68, 0x24, 0x5b, 0x7a, 0xf2, 0x87, 0xdc, 0xc9, 0x06, 0x31, 0xbb, 0x0b, 0x46, 0x7c,
-	0x21, 0x05, 0x89, 0xe9, 0x40, 0x6e, 0x93, 0x54, 0x35, 0x82, 0xca, 0xb2, 0x6a, 0x0b, 0x75, 0x54,
+	0xd8, 0x5b, 0xbb, 0x51, 0xb6, 0x1c, 0xd8, 0x5d, 0x4c, 0x6a, 0x0b, 0xc7, 0x31, 0x89, 0x8b, 0xac,
-	0x75, 0xe8, 0xd8, 0x05, 0x0a, 0x84, 0x18, 0x73, 0x47, 0xf4, 0xd6, 0xdc, 0x8f, 0xcc, 0x0e, 0x65,
+	0x31, 0xad, 0x6c, 0x42, 0x15, 0x55, 0xab, 0xea, 0x68, 0xda, 0xca, 0x10, 0x69, 0x66, 0xb6, 0xa7,
-	0x11, 0x3d, 0x16, 0xcd, 0xb9, 0x97, 0x7e, 0x00, 0x0d, 0x7a, 0xe9, 0x3f, 0xd1, 0xf6, 0xd6, 0x53,
+	0x65, 0x5b, 0xc5, 0x91, 0x82, 0x33, 0x17, 0x3e, 0xaa, 0x58, 0xb8, 0xf0, 0x2f, 0x70, 0x00, 0x6e,
-	0xff, 0x81, 0xde, 0xd2, 0x9e, 0x8a, 0x1e, 0x8b, 0x1c, 0xdb, 0x4b, 0x81, 0x62, 0xbe, 0x76, 0x87,
+	0x9c, 0xf8, 0x07, 0xb8, 0x2d, 0x9c, 0x28, 0x8e, 0x14, 0x47, 0xb8, 0x50, 0x45, 0xf5, 0xd7, 0x4c,
-	0xe4, 0x52, 0x5a, 0xcb, 0x31, 0x8a, 0xdc, 0x76, 0xe6, 0xfd, 0xe6, 0xbd, 0xdf, 0xbc, 0x79, 0xf3,
+	0x4b, 0x1a, 0xd9, 0x13, 0x7b, 0x53, 0xd4, 0xde, 0xa6, 0xfb, 0xfd, 0xfa, 0xbd, 0x5f, 0xbf, 0xf7,
-	0xde, 0x3c, 0x12, 0xd6, 0xf8, 0x71, 0x32, 0x1c, 0x0d, 0x82, 0xe8, 0x5b, 0x9d, 0x84, 0xc5, 0x3c,
+	0xfa, 0xbd, 0x6e, 0x09, 0x56, 0xf9, 0x51, 0x3c, 0x18, 0xf5, 0x83, 0xf0, 0x6b, 0xed, 0x98, 0x45,
-	0x46, 0xf5, 0x6c, 0xa2, 0x7d, 0x13, 0x96, 0x6f, 0x8f, 0x23, 0x12, 0x06, 0xfd, 0x07, 0x64, 0x38,
+	0x3c, 0x42, 0xb5, 0x74, 0xa2, 0x75, 0x1b, 0x96, 0xee, 0x8e, 0x43, 0x32, 0x0c, 0x7a, 0x8f, 0xc8,
-	0xa2, 0xa8, 0x05, 0x4b, 0x61, 0x3a, 0x48, 0x48, 0xff, 0x49, 0xcb, 0xd9, 0x70, 0xb6, 0x96, 0xb1,
+	0x60, 0x44, 0x51, 0x13, 0x16, 0x87, 0x49, 0x3f, 0x26, 0xbd, 0x67, 0x4d, 0x67, 0xdd, 0xd9, 0x5c,
-	0x19, 0x22, 0x04, 0x0b, 0x3f, 0x49, 0xe3, 0xa8, 0x55, 0x91, 0xd3, 0xf2, 0xbb, 0xfd, 0x0f, 0x07,
+	0xc2, 0x66, 0x88, 0x10, 0x94, 0x7f, 0x90, 0x44, 0x61, 0xb3, 0x24, 0xa7, 0xe5, 0x77, 0xeb, 0xef,
-	0xe0, 0x76, 0x40, 0x06, 0x51, 0x9c, 0xf2, 0xa0, 0x8f, 0x76, 0xa0, 0x96, 0xd2, 0x13, 0xca, 0x02,
+	0x0e, 0xc0, 0xdd, 0x80, 0xf4, 0xc3, 0x28, 0xe1, 0x41, 0x0f, 0x6d, 0x43, 0x35, 0xa1, 0xc7, 0x94,
-	0x3e, 0x96, 0xab, 0x57, 0xb7, 0xbf, 0xd4, 0xc9, 0x6d, 0xe7, 0xc0, 0x4e, 0x57, 0xa3, 0x70, 0x86,
+	0x05, 0x7c, 0x2c, 0x57, 0xaf, 0x6c, 0x7d, 0xae, 0x9d, 0xd9, 0xce, 0x80, 0xed, 0x8e, 0x46, 0xe1,
-	0x17, 0x86, 0xd3, 0x51, 0x18, 0x12, 0x36, 0x96, 0x16, 0xea, 0xd8, 0x0c, 0xd1, 0x55, 0x58, 0xf4,
+	0x14, 0x2f, 0x0c, 0x27, 0xa3, 0xe1, 0x90, 0xb0, 0xb1, 0xb4, 0x50, 0xc3, 0x66, 0x88, 0xae, 0xc3,
-	0x29, 0x27, 0xc1, 0xb0, 0xe5, 0x4a, 0x81, 0x1e, 0xa1, 0xb7, 0xa0, 0x4e, 0x38, 0x67, 0xc1, 0xa3,
+	0x82, 0x4f, 0x39, 0x09, 0x06, 0x4d, 0x57, 0x0a, 0xf4, 0x08, 0xbd, 0x05, 0x35, 0xc2, 0x39, 0x0b,
-	0x11, 0xa7, 0xad, 0x85, 0x0d, 0x67, 0xab, 0xb1, 0xdd, 0xb2, 0xcc, 0xed, 0x1a, 0xd9, 0x11, 0xe1,
+	0x9e, 0x8c, 0x38, 0x6d, 0x96, 0xd7, 0x9d, 0xcd, 0xfa, 0x56, 0xd3, 0x32, 0xb7, 0x63, 0x64, 0x87,
-	0x8f, 0x71, 0x0e, 0x6d, 0x5f, 0x87, 0x9a, 0xb1, 0x8f, 0x1a, 0xb0, 0x74, 0x70, 0xf8, 0x60, 0xf7,
+	0x84, 0x3f, 0xc5, 0x19, 0xb4, 0x75, 0x13, 0xaa, 0xc6, 0x3e, 0xaa, 0xc3, 0xe2, 0xfe, 0xc1, 0xa3,
-	0xde, 0xc1, 0xed, 0xe6, 0x25, 0x54, 0x87, 0xea, 0x3e, 0xc6, 0x3f, 0xc0, 0x4d, 0x47, 0xcc, 0x3f,
+	0x9d, 0x07, 0xfb, 0x77, 0x1b, 0x57, 0x50, 0x0d, 0x2a, 0x7b, 0x18, 0x7f, 0x07, 0x37, 0x1c, 0x31,
-	0xdc, 0xc5, 0x87, 0x07, 0x87, 0x77, 0x9a, 0x95, 0xf6, 0xdf, 0x1c, 0x58, 0x99, 0xd0, 0x86, 0x6e,
+	0xff, 0x78, 0x07, 0x1f, 0xec, 0x1f, 0xdc, 0x6b, 0x94, 0x5a, 0x7f, 0x75, 0x60, 0x79, 0x42, 0x1b,
-	0x40, 0x35, 0xe5, 0x34, 0x49, 0x5b, 0xce, 0x86, 0xbb, 0xd5, 0xd8, 0x7e, 0x75, 0x9e, 0xd9, 0x4e,
+	0xba, 0x05, 0x95, 0x84, 0xd3, 0x38, 0x69, 0x3a, 0xeb, 0xee, 0x66, 0x7d, 0xeb, 0xd5, 0x79, 0x66,
-	0x97, 0xd3, 0x04, 0x2b, 0xac, 0xf7, 0x4b, 0x07, 0x16, 0xc4, 0x18, 0x6d, 0xc2, 0x6a, 0xc6, 0xa6,
+	0xdb, 0x1d, 0x4e, 0x63, 0xac, 0xb0, 0xde, 0xcf, 0x1c, 0x28, 0x8b, 0x31, 0xda, 0x80, 0x95, 0x94,
-	0x17, 0x91, 0x90, 0x4a, 0x67, 0xd5, 0xef, 0x5e, 0xc2, 0x2b, 0xd9, 0xfc, 0x21, 0x09, 0x29, 0xea,
+	0x4d, 0x37, 0x24, 0x43, 0x2a, 0x9d, 0x55, 0xbb, 0x7f, 0x05, 0x2f, 0xa7, 0xf3, 0x07, 0x64, 0x48,
-	0x00, 0xa2, 0x43, 0x1a, 0xd2, 0x88, 0xf7, 0x9e, 0xd0, 0x71, 0x2f, 0xe5, 0x2c, 0x88, 0x06, 0xca,
+	0x51, 0x1b, 0x10, 0x1d, 0xd0, 0x21, 0x0d, 0x79, 0xf7, 0x19, 0x1d, 0x77, 0x13, 0xce, 0x82, 0xb0,
-	0x3d, 0x77, 0x2f, 0xe1, 0xa6, 0x96, 0x7d, 0x9f, 0x8e, 0xbb, 0x52, 0x82, 0xb6, 0x60, 0xcd, 0xc6,
+	0xaf, 0xdc, 0x73, 0xff, 0x0a, 0x6e, 0x68, 0xd9, 0xb7, 0xe9, 0xb8, 0x23, 0x25, 0x68, 0x13, 0x56,
-	0x07, 0x11, 0x97, 0x2e, 0x73, 0x85, 0xe6, 0x1c, 0x7c, 0x10, 0xf1, 0x5b, 0x20, 0x4e, 0x6a, 0x48,
+	0x6d, 0x7c, 0x10, 0x72, 0xe9, 0x32, 0x57, 0x68, 0xce, 0xc0, 0xfb, 0x21, 0xbf, 0x03, 0x22, 0x52,
-	0xfb, 0x3c, 0x66, 0xed, 0x1b, 0x82, 0x56, 0x9c, 0x78, 0x75, 0x58, 0xc2, 0xf4, 0xc3, 0x11, 0x4d,
+	0x03, 0xda, 0xe3, 0x11, 0x6b, 0xdd, 0x12, 0xb4, 0xa2, 0xd8, 0xab, 0xc1, 0x22, 0xa6, 0x1f, 0x8e,
-	0xb9, 0xb7, 0x01, 0x35, 0x4c, 0xd3, 0x24, 0x8e, 0x52, 0x8a, 0xae, 0x40, 0x75, 0x9f, 0xb1, 0x98,
+	0x68, 0xc2, 0xbd, 0x75, 0xa8, 0x62, 0x9a, 0xc4, 0x51, 0x98, 0x50, 0x74, 0x0d, 0x2a, 0x7b, 0x8c,
-	0x29, 0x92, 0xb8, 0x4a, 0xc5, 0xa0, 0xfd, 0x2b, 0x07, 0x6a, 0x98, 0x3c, 0xed, 0x72, 0xc2, 0x69,
+	0x45, 0x4c, 0x91, 0xc4, 0x15, 0x2a, 0x06, 0xad, 0x9f, 0x3b, 0x50, 0xc5, 0xe4, 0xa4, 0xc3, 0x09,
-	0x16, 0x1a, 0x4e, 0x1e, 0x1a, 0x68, 0x07, 0x96, 0x8e, 0x87, 0x84, 0x87, 0x24, 0x69, 0x55, 0xa4,
+	0xa7, 0x69, 0x6a, 0x38, 0x59, 0x6a, 0xa0, 0x6d, 0x58, 0x3c, 0x1a, 0x10, 0x3e, 0x24, 0x71, 0xb3,
-	0x93, 0x36, 0x2c, 0x27, 0x99, 0x95, 0x9d, 0xef, 0x29, 0xc8, 0x7e, 0xc4, 0xd9, 0x18, 0x9b, 0x05,
+	0x24, 0x9d, 0xb4, 0x6e, 0x39, 0xc9, 0xac, 0x6c, 0x7f, 0x4b, 0x41, 0xf6, 0x42, 0xce, 0xc6, 0xd8,
-	0xde, 0x0e, 0x2c, 0xdb, 0x02, 0xd4, 0x04, 0xf7, 0x09, 0x1d, 0x6b, 0x02, 0xe2, 0x53, 0x90, 0x3a,
+	0x2c, 0xf0, 0xb6, 0x61, 0xc9, 0x16, 0xa0, 0x06, 0xb8, 0xcf, 0xe8, 0x58, 0x13, 0x10, 0x9f, 0x82,
-	0x11, 0xf1, 0xaa, 0x63, 0x45, 0x0d, 0x76, 0x2a, 0xef, 0x38, 0xed, 0x4f, 0xaa, 0xb0, 0xd8, 0xed,
+	0xd4, 0xb1, 0xc8, 0x57, 0x9d, 0x2b, 0x6a, 0xb0, 0x5d, 0x7a, 0xc7, 0x69, 0x7d, 0x5c, 0x81, 0x85,
-	0x3f, 0xa6, 0x21, 0x11, 0x21, 0x75, 0x42, 0x59, 0x1a, 0x68, 0x66, 0x2e, 0x36, 0x43, 0x74, 0x0d,
+	0x4e, 0xef, 0x29, 0x1d, 0x12, 0x91, 0x52, 0xc7, 0x94, 0x25, 0x81, 0x66, 0xe6, 0x62, 0x33, 0x44,
-	0xaa, 0x8f, 0x86, 0x71, 0xff, 0x89, 0x5c, 0xde, 0xd8, 0xfe, 0x82, 0x45, 0x4d, 0xad, 0xed, 0xdc,
+	0x37, 0xa0, 0xf2, 0x64, 0x10, 0xf5, 0x9e, 0xc9, 0xe5, 0xf5, 0xad, 0xcf, 0x58, 0xd4, 0xd4, 0xda,
-	0x12, 0x62, 0xac, 0x50, 0xde, 0xef, 0x1c, 0xa8, 0xca, 0x89, 0x33, 0x54, 0x7e, 0x07, 0x20, 0x3b,
+	0xf6, 0x1d, 0x21, 0xc6, 0x0a, 0xe5, 0xfd, 0xc6, 0x81, 0x8a, 0x9c, 0x38, 0x43, 0xe5, 0x37, 0x00,
-	0xbc, 0x54, 0x6f, 0xf9, 0xe5, 0x59, 0xbd, 0x59, 0x78, 0x60, 0x0b, 0x8e, 0xde, 0x85, 0x86, 0xb4,
+	0xd2, 0xe0, 0x25, 0x7a, 0xcb, 0x2f, 0xcf, 0xea, 0x4d, 0xd3, 0x03, 0x5b, 0x70, 0xf4, 0x2e, 0xd4,
-	0xd4, 0xe3, 0xe3, 0x84, 0xa6, 0x2d, 0x77, 0x26, 0xaa, 0xf4, 0xea, 0x43, 0x9a, 0x72, 0xea, 0x2b,
+	0xa5, 0xa5, 0x2e, 0x1f, 0xc7, 0x34, 0x69, 0xba, 0x33, 0x59, 0xa5, 0x57, 0x1f, 0xd0, 0x84, 0x53,
-	0x6e, 0x20, 0x57, 0xdc, 0x17, 0x0b, 0xbc, 0xbf, 0x38, 0x50, 0xcf, 0x34, 0x8b, 0xe3, 0xc8, 0xa3,
+	0x5f, 0x71, 0x03, 0xb9, 0xe2, 0xa1, 0x58, 0xe0, 0xfd, 0xd9, 0x81, 0x5a, 0xaa, 0x59, 0x84, 0x23,
-	0x0a, 0xcb, 0x6f, 0x31, 0x27, 0x74, 0x9b, 0xdb, 0x2b, 0xbe, 0xd1, 0x06, 0x34, 0x7c, 0x9a, 0xf6,
+	0xcb, 0x2a, 0x2c, 0xbf, 0xc5, 0x9c, 0xd0, 0x6d, 0x4e, 0xaf, 0xf8, 0x46, 0xeb, 0x50, 0xf7, 0x69,
-	0x59, 0x90, 0x70, 0xb1, 0x21, 0x75, 0xbb, 0xec, 0x29, 0xe4, 0x41, 0x8d, 0xd1, 0x0f, 0x47, 0x01,
+	0xd2, 0x63, 0x41, 0xcc, 0xc5, 0x86, 0xd4, 0xe9, 0xb2, 0xa7, 0x90, 0x07, 0x55, 0x46, 0x3f, 0x1c,
-	0xa3, 0xbe, 0xbc, 0x61, 0x35, 0x9c, 0x8d, 0x85, 0x2c, 0x96, 0x28, 0x32, 0x6c, 0x55, 0x95, 0xcc,
+	0x05, 0x8c, 0xfa, 0xf2, 0x84, 0x55, 0x71, 0x3a, 0x16, 0xb2, 0x48, 0xa2, 0xc8, 0xa0, 0x59, 0x51,
-	0x8c, 0x85, 0xac, 0x1f, 0x87, 0xc9, 0x88, 0x53, 0xbf, 0xb5, 0xa8, 0x64, 0x66, 0x8c, 0x5e, 0x81,
+	0x32, 0x33, 0x16, 0xb2, 0x5e, 0x34, 0x8c, 0x47, 0x9c, 0xfa, 0xcd, 0x05, 0x25, 0x33, 0x63, 0xf4,
-	0x7a, 0x4a, 0xa3, 0x34, 0xe0, 0xc1, 0x09, 0x6d, 0x2d, 0x49, 0x61, 0x3e, 0xe1, 0x7d, 0x5c, 0x81,
+	0x0a, 0xd4, 0x12, 0x1a, 0x26, 0x01, 0x0f, 0x8e, 0x69, 0x73, 0x51, 0x0a, 0xb3, 0x09, 0xef, 0xa3,
-	0x86, 0xb5, 0x4b, 0xf4, 0x32, 0xd4, 0x05, 0x57, 0xeb, 0x9a, 0xe0, 0x9a, 0x98, 0x90, 0xf7, 0xe3,
+	0x12, 0xd4, 0xad, 0x5d, 0xa2, 0x97, 0xa1, 0x26, 0xb8, 0x5a, 0xc7, 0x04, 0x57, 0xc5, 0x84, 0x3c,
-	0xd9, 0x8e, 0x11, 0xed, 0xc1, 0x52, 0x44, 0x53, 0x2e, 0xee, 0x90, 0x2b, 0xb3, 0xd3, 0x6b, 0x67,
+	0x1f, 0xcf, 0x17, 0x46, 0xb4, 0x0b, 0x8b, 0x21, 0x4d, 0xb8, 0x38, 0x43, 0xae, 0xac, 0x4e, 0xaf,
-	0x7a, 0x58, 0x7e, 0x07, 0xd1, 0xe0, 0xbd, 0xd8, 0xa7, 0xd8, 0xac, 0x14, 0x84, 0xc2, 0x20, 0xea,
+	0x9d, 0xe9, 0x61, 0xf9, 0x1d, 0x84, 0xfd, 0xf7, 0x22, 0x9f, 0x62, 0xb3, 0x52, 0x10, 0x1a, 0x06,
-	0x05, 0x9c, 0x86, 0xa9, 0xf4, 0x89, 0x8b, 0x6b, 0x61, 0x10, 0x1d, 0x88, 0xb1, 0x14, 0x92, 0x53,
+	0x61, 0x37, 0xe0, 0x74, 0x98, 0x48, 0x9f, 0xb8, 0xb8, 0x3a, 0x0c, 0xc2, 0x7d, 0x31, 0x96, 0x42,
-	0x2d, 0xac, 0x6a, 0x21, 0x39, 0x95, 0xc2, 0xf6, 0x2d, 0xb5, 0x33, 0xad, 0x71, 0x32, 0xf5, 0x00,
+	0x72, 0xaa, 0x85, 0x15, 0x2d, 0x24, 0xa7, 0x52, 0xd8, 0xba, 0xa3, 0x76, 0xa6, 0x35, 0x4e, 0x96,
-	0x2c, 0x76, 0x0f, 0x0e, 0xef, 0xdc, 0xdb, 0x6f, 0x3a, 0xa8, 0x06, 0x0b, 0xf7, 0x0e, 0xba, 0xf7,
+	0x1e, 0x80, 0x85, 0xce, 0xfe, 0xc1, 0xbd, 0x07, 0x7b, 0x0d, 0x07, 0x55, 0xa1, 0xfc, 0x60, 0xbf,
-	0x9b, 0x15, 0xb4, 0x04, 0x6e, 0x77, 0xff, 0x7e, 0xd3, 0x15, 0x1f, 0xef, 0xed, 0x1e, 0x35, 0x17,
+	0xf3, 0xb0, 0x51, 0x42, 0x8b, 0xe0, 0x76, 0xf6, 0x1e, 0x36, 0x5c, 0xf1, 0xf1, 0xde, 0xce, 0x61,
-	0xda, 0xbf, 0x59, 0x80, 0xf5, 0x3b, 0x94, 0x1f, 0xb1, 0xf8, 0x24, 0xf0, 0x29, 0x53, 0xa4, 0xed,
+	0xa3, 0xdc, 0xfa, 0x65, 0x19, 0xd6, 0xee, 0x51, 0x7e, 0xc8, 0xa2, 0xe3, 0xc0, 0xa7, 0x4c, 0x91,
-	0x9b, 0xfb, 0x6f, 0xd7, 0xba, 0xba, 0xd7, 0xa0, 0x96, 0x68, 0xa4, 0xf4, 0x5d, 0x63, 0x7b, 0x7d,
+	0xb6, 0x4f, 0xee, 0xbf, 0x5d, 0xeb, 0xe8, 0xde, 0x80, 0x6a, 0xac, 0x91, 0xd2, 0x77, 0xf5, 0xad,
-	0x66, 0xc7, 0x38, 0x83, 0x20, 0x0a, 0x4d, 0x46, 0xd3, 0x78, 0xc4, 0xfa, 0xb4, 0x97, 0x4a, 0xa1,
+	0xb5, 0x99, 0x1d, 0xe3, 0x14, 0x82, 0x28, 0x34, 0x18, 0x4d, 0xa2, 0x11, 0xeb, 0xd1, 0x6e, 0x22,
-	0x09, 0xe4, 0x1d, 0x6b, 0xd9, 0x8c, 0xf9, 0x8e, 0xb1, 0x27, 0x3e, 0xe4, 0x6a, 0x35, 0x9f, 0xaa,
+	0x85, 0x26, 0x91, 0xb7, 0xad, 0x65, 0x33, 0xe6, 0xdb, 0xc6, 0x9e, 0xf8, 0x90, 0xab, 0xd5, 0x7c,
-	0x5b, 0xbd, 0xc6, 0x26, 0x67, 0xd1, 0x10, 0x2e, 0xfb, 0x84, 0x93, 0xde, 0x94, 0x25, 0x15, 0xf4,
+	0xa2, 0x4e, 0xf5, 0x2a, 0x9b, 0x9c, 0x45, 0x03, 0xb8, 0xea, 0x13, 0x4e, 0xba, 0x53, 0x96, 0x54,
-	0x37, 0xcb, 0x59, 0xba, 0x4d, 0x38, 0xe9, 0xce, 0xda, 0x5a, 0xf7, 0xa7, 0xe7, 0xd1, 0xdb, 0xd0,
+	0xd2, 0xdf, 0x2e, 0x66, 0xe9, 0x2e, 0xe1, 0xa4, 0x33, 0x6b, 0x6b, 0xcd, 0x9f, 0x9e, 0x47, 0x6f,
-	0xf0, 0xb3, 0xc2, 0x23, 0x4e, 0x4c, 0x58, 0x79, 0xa9, 0xb0, 0x2c, 0x61, 0x1b, 0xe9, 0xbd, 0x0f,
+	0x43, 0xdd, 0x4f, 0x1b, 0x8f, 0x88, 0x98, 0xb0, 0xf2, 0x52, 0x6e, 0x5b, 0xc2, 0x36, 0xd2, 0x7b,
-	0x57, 0x8a, 0xf6, 0x53, 0x90, 0x8c, 0x36, 0xed, 0x64, 0x54, 0xe8, 0xe3, 0x3c, 0x3f, 0x79, 0x0f,
+	0x1f, 0xae, 0xe5, 0xed, 0x27, 0xa7, 0x18, 0x6d, 0xd8, 0xc5, 0x28, 0xd7, 0xc7, 0x59, 0x7d, 0xf2,
-	0xe1, 0x6a, 0x31, 0xf9, 0xe7, 0x54, 0xdc, 0xfe, 0xc4, 0x81, 0x97, 0x8e, 0x18, 0x4d, 0x08, 0xa3,
+	0x1e, 0xc3, 0xf5, 0x7c, 0xf2, 0x97, 0x54, 0xdc, 0xfa, 0xd8, 0x81, 0x97, 0x0e, 0x19, 0x8d, 0x09,
-	0xc6, 0x6b, 0x7b, 0x71, 0x74, 0x1c, 0x0c, 0xbc, 0x9d, 0x2c, 0x3c, 0xd0, 0x75, 0x58, 0xec, 0xcb,
+	0xa3, 0xc6, 0x6b, 0xbb, 0x51, 0x78, 0x14, 0xf4, 0xbd, 0xed, 0x34, 0x3d, 0xd0, 0x4d, 0x58, 0xe8,
-	0x49, 0x1d, 0x0f, 0xf6, 0x95, 0xb1, 0xdf, 0x01, 0x58, 0xc3, 0xbc, 0x9f, 0x3b, 0x56, 0x3c, 0x7d,
+	0xc9, 0x49, 0x9d, 0x0f, 0xf6, 0x91, 0xb1, 0xef, 0x01, 0x58, 0xc3, 0xbc, 0x1f, 0x3b, 0x56, 0x3e,
-	0x17, 0xd6, 0x12, 0x65, 0xc1, 0xef, 0x95, 0x53, 0xb3, 0x6a, 0xf0, 0x8a, 0xca, 0xf4, 0x69, 0x54,
+	0x7d, 0x13, 0x56, 0x63, 0x65, 0xc1, 0xef, 0x16, 0x53, 0xb3, 0x62, 0xf0, 0x8a, 0xca, 0x74, 0x34,
-	0xca, 0x9e, 0x46, 0xfb, 0x17, 0x15, 0xb8, 0xf2, 0x7e, 0x32, 0x60, 0xc4, 0xa7, 0xd9, 0xa9, 0x88,
+	0x4a, 0x45, 0xa3, 0xd1, 0xfa, 0x69, 0x09, 0xae, 0xbd, 0x1f, 0xf7, 0x19, 0xf1, 0x69, 0x1a, 0x15,
-	0x0a, 0xe2, 0xb1, 0x7c, 0x73, 0x67, 0xe6, 0x0a, 0x2b, 0x73, 0x57, 0x26, 0x33, 0xf7, 0x9b, 0x50,
+	0xd1, 0x41, 0x3c, 0x96, 0x6d, 0xee, 0xcc, 0x5a, 0x61, 0x55, 0xee, 0xd2, 0x64, 0xe5, 0x7e, 0x13,
-	0x67, 0xe4, 0x69, 0x2f, 0x15, 0xea, 0x64, 0x62, 0x68, 0x6c, 0x5f, 0x2e, 0xa8, 0x55, 0xb8, 0xc6,
+	0x6a, 0x8c, 0x9c, 0x74, 0x13, 0xa1, 0x4e, 0x16, 0x86, 0xfa, 0xd6, 0xd5, 0x9c, 0x5e, 0x85, 0xab,
-	0xf4, 0x97, 0xf7, 0x33, 0xdb, 0x29, 0xef, 0xc2, 0xea, 0x48, 0x11, 0xf3, 0xb5, 0x8e, 0x73, 0x7c,
+	0x4c, 0x7f, 0x79, 0x3f, 0xb2, 0x9d, 0xf2, 0x2e, 0xac, 0x8c, 0x14, 0x31, 0x5f, 0xeb, 0x38, 0xc7,
-	0xb2, 0x62, 0xe0, 0xaa, 0x78, 0x5e, 0xd8, 0x25, 0x7f, 0x72, 0xc0, 0x7b, 0x40, 0x86, 0x81, 0x2f,
+	0x27, 0xcb, 0x06, 0xae, 0x9a, 0xe7, 0x85, 0x5d, 0xf2, 0x47, 0x07, 0xbc, 0x47, 0x64, 0x10, 0xf8,
-	0xc8, 0x69, 0x9f, 0x88, 0x72, 0xa0, 0x4f, 0xfd, 0x61, 0x49, 0xc7, 0xe4, 0x21, 0x51, 0x29, 0x17,
+	0x82, 0x9c, 0xf6, 0x89, 0x68, 0x07, 0x3a, 0xea, 0x8f, 0x0b, 0x3a, 0x26, 0x4b, 0x89, 0x52, 0xb1,
-	0x12, 0x7b, 0xd6, 0xe6, 0xa7, 0xc8, 0x3b, 0xa5, 0xc9, 0xff, 0xc1, 0x81, 0x96, 0x21, 0x9f, 0xdf,
+	0x94, 0xd8, 0xb5, 0x36, 0x3f, 0x45, 0xde, 0x29, 0x4c, 0xfe, 0xf7, 0x0e, 0x34, 0x0d, 0xf9, 0xec,
-	0x87, 0xcf, 0x05, 0xf5, 0x3f, 0x3a, 0x50, 0x57, 0x44, 0x47, 0x8c, 0x7a, 0x83, 0x9c, 0xeb, 0xeb,
+	0x3c, 0x7c, 0x2a, 0xa8, 0xff, 0xc1, 0x81, 0x9a, 0x22, 0x3a, 0x62, 0xd4, 0xeb, 0x67, 0x5c, 0x5f,
-	0xb0, 0xce, 0x29, 0x63, 0xe4, 0x38, 0x66, 0x61, 0xcf, 0x7e, 0x26, 0xd4, 0x71, 0x33, 0x13, 0x3c,
+	0x87, 0x35, 0x4e, 0x19, 0x23, 0x47, 0x11, 0x1b, 0x76, 0xed, 0x6b, 0x42, 0x0d, 0x37, 0x52, 0xc1,
-	0xd0, 0x51, 0xf7, 0xff, 0xe1, 0xfe, 0xa9, 0x03, 0xcb, 0x98, 0x12, 0xdf, 0xc4, 0x8b, 0xe7, 0x97,
+	0x23, 0x9d, 0x75, 0xff, 0x1f, 0xee, 0xff, 0x72, 0x60, 0x09, 0x53, 0xe2, 0x9b, 0x7c, 0xf1, 0xfc,
-	0x74, 0xf5, 0x4d, 0x58, 0xe9, 0x8f, 0x18, 0x13, 0x4f, 0x4b, 0x15, 0xe4, 0xe7, 0xb0, 0x5e, 0xd6,
+	0x82, 0xae, 0xbe, 0x0d, 0xcb, 0xbd, 0x11, 0x63, 0xe2, 0x6a, 0xa9, 0x92, 0xfc, 0x1c, 0xd6, 0x4b,
-	0x68, 0x75, 0x61, 0xc6, 0x16, 0xf7, 0x6f, 0x42, 0x3d, 0xa2, 0x4f, 0xcb, 0x5d, 0x95, 0x5a, 0x44,
+	0x1a, 0xad, 0x0e, 0xcc, 0xd8, 0xe2, 0xfe, 0x55, 0xa8, 0x85, 0xf4, 0xa4, 0xd8, 0x51, 0xa9, 0x86,
-	0x9f, 0x3e, 0xe7, 0x2d, 0xf9, 0x68, 0x01, 0xd0, 0xd1, 0x90, 0x44, 0x66, 0xc7, 0x7b, 0x8f, 0x49,
+	0xf4, 0xe4, 0x92, 0xa7, 0xe4, 0x77, 0x65, 0x40, 0x87, 0x03, 0x12, 0x9a, 0x1d, 0xef, 0x3e, 0x25,
-	0x34, 0xa0, 0xde, 0x7f, 0x9d, 0x92, 0x1b, 0x7f, 0x07, 0x1a, 0x09, 0x0b, 0x62, 0x56, 0x6e, 0xdb,
+	0x61, 0x9f, 0x7a, 0xff, 0x75, 0x0a, 0x6e, 0xfc, 0x1d, 0xa8, 0xc7, 0x2c, 0x88, 0x58, 0xb1, 0x6d,
-	0x20, 0xb1, 0x8a, 0xf2, 0x3e, 0xa0, 0x84, 0xc5, 0x49, 0x9c, 0x52, 0xbf, 0x97, 0xef, 0xd8, 0x3d,
+	0x83, 0xc4, 0x2a, 0xca, 0x7b, 0x80, 0x62, 0x16, 0xc5, 0x51, 0x42, 0xfd, 0x6e, 0xb6, 0x63, 0xf7,
-	0x5b, 0x41, 0xd3, 0x2c, 0x39, 0x34, 0x3b, 0xcf, 0x03, 0x65, 0xa1, 0x54, 0xa0, 0xa0, 0xaf, 0xc2,
+	0x6c, 0x05, 0x0d, 0xb3, 0xe4, 0xc0, 0xec, 0x3c, 0x4b, 0x94, 0x72, 0xa1, 0x44, 0x41, 0x5f, 0x84,
-	0x8a, 0x62, 0x9c, 0xb0, 0xe0, 0x44, 0x98, 0xac, 0xca, 0x37, 0xdf, 0xb2, 0x9c, 0x3c, 0x52, 0x73,
+	0x65, 0xc5, 0x38, 0x66, 0xc1, 0xb1, 0x30, 0x59, 0x91, 0x77, 0xbe, 0x25, 0x39, 0x79, 0xa8, 0xe6,
-	0xde, 0xa7, 0x76, 0x0a, 0xbb, 0x09, 0x2b, 0xc9, 0x90, 0x44, 0x51, 0xd9, 0x0c, 0xb6, 0xac, 0xd1,
+	0xbc, 0x5f, 0x97, 0xac, 0x90, 0xdc, 0x86, 0xe5, 0x78, 0x40, 0xc2, 0xb0, 0x68, 0x05, 0x5b, 0xd2,
-	0x8a, 0xe0, 0x9e, 0x78, 0x36, 0xc8, 0x47, 0x61, 0xda, 0x63, 0x34, 0x19, 0x92, 0x3e, 0xd5, 0xe7,
+	0x68, 0x45, 0x70, 0x57, 0x5c, 0x1b, 0xe4, 0xa5, 0x30, 0xe9, 0x32, 0x1a, 0x0f, 0x48, 0x8f, 0xea,
-	0x33, 0xbf, 0x1d, 0x5b, 0x33, 0x2b, 0xb0, 0x5a, 0x80, 0x36, 0x61, 0xcd, 0x50, 0x30, 0xb4, 0x5d,
+	0xf8, 0xcc, 0x7f, 0x8e, 0xad, 0x9a, 0x15, 0x58, 0x2d, 0x40, 0x1b, 0xb0, 0x6a, 0x28, 0x18, 0xda,
-	0x49, 0x7b, 0x55, 0x4f, 0x6b, 0xe2, 0x17, 0xae, 0xe7, 0xed, 0xbf, 0xba, 0x70, 0x79, 0x37, 0x49,
+	0xae, 0xa4, 0xbd, 0xa2, 0xa7, 0x35, 0xf1, 0x0b, 0xf7, 0x73, 0xf4, 0x06, 0xa0, 0x01, 0xed, 0x93,
-	0x86, 0xe3, 0xa9, 0x48, 0xf8, 0xcf, 0x8b, 0x8f, 0x84, 0x19, 0xff, 0xba, 0xcf, 0xe2, 0xdf, 0x67,
+	0xde, 0x58, 0x5e, 0xb2, 0xbb, 0xc9, 0x38, 0xe1, 0x74, 0xa8, 0x6f, 0xae, 0x0d, 0x25, 0x11, 0xd5,
-	0x0e, 0x80, 0x02, 0x5f, 0x56, 0x8b, 0x7c, 0xe9, 0xfd, 0xd9, 0x79, 0xee, 0x7b, 0xd9, 0x82, 0x25,
+	0xb3, 0x23, 0xe7, 0x5b, 0x7f, 0x71, 0xe1, 0xea, 0x4e, 0x1c, 0x0f, 0xc6, 0x53, 0x79, 0xf3, 0x9f,
-	0x63, 0x43, 0xb5, 0x16, 0x66, 0x38, 0x7d, 0x50, 0x6e, 0xd9, 0x83, 0x42, 0x6f, 0x00, 0x1a, 0xd2,
+	0x17, 0x9f, 0x37, 0x33, 0xd1, 0x70, 0x9f, 0x27, 0x1a, 0xcf, 0x9d, 0x2e, 0x39, 0x9e, 0xaf, 0xe4,
-	0x01, 0xe9, 0x8f, 0x65, 0x37, 0xd4, 0x4b, 0xc7, 0x29, 0xa7, 0xa1, 0x6e, 0x3f, 0x9a, 0x4a, 0x22,
+	0x79, 0xde, 0xfb, 0x93, 0x73, 0xe9, 0x53, 0xdc, 0x84, 0x45, 0x63, 0x43, 0x3d, 0x44, 0xcc, 0x70,
-	0xca, 0x5c, 0x57, 0xce, 0xb7, 0xff, 0x55, 0x81, 0xcb, 0x07, 0x61, 0x12, 0x33, 0x3e, 0xf9, 0x2e,
+	0x3a, 0xac, 0xee, 0x25, 0xc3, 0x5a, 0x9e, 0x13, 0xd6, 0x7f, 0x96, 0xe0, 0xea, 0xfe, 0x30, 0x8e,
-	0x78, 0xab, 0xe4, 0xa9, 0xae, 0x42, 0x25, 0xf0, 0x75, 0x1b, 0x59, 0x09, 0x7c, 0xef, 0x14, 0x9a,
+	0x18, 0x9f, 0xbc, 0x45, 0xbc, 0x55, 0x30, 0xaa, 0x2b, 0x50, 0x0a, 0x7c, 0xfd, 0xe8, 0x2c, 0x05,
-	0x4a, 0x1d, 0xcd, 0x92, 0xe4, 0xb9, 0x4d, 0x48, 0xa9, 0x80, 0x50, 0x28, 0xdb, 0x61, 0xee, 0x84,
+	0xbe, 0x77, 0x0a, 0x0d, 0xa5, 0x8e, 0xa6, 0x25, 0xf5, 0xdc, 0x27, 0x4b, 0xa1, 0x84, 0x50, 0x28,
-	0xc3, 0xbc, 0xdf, 0xdb, 0xa7, 0xf1, 0x01, 0xa0, 0x40, 0xd3, 0xe8, 0x99, 0x07, 0xb4, 0x49, 0xf4,
+	0xdb, 0x61, 0xee, 0x84, 0xc3, 0xbc, 0xdf, 0xda, 0xd1, 0xf8, 0x00, 0x50, 0xa0, 0x69, 0x74, 0xcd,
-	0xd7, 0x2d, 0x13, 0x05, 0x5b, 0xef, 0x4c, 0xf3, 0xc7, 0xeb, 0xc1, 0xd4, 0x4c, 0x7a, 0xf1, 0x7c,
+	0x75, 0xdb, 0xb4, 0x85, 0x9b, 0x96, 0x89, 0x9c, 0xad, 0xb7, 0xa7, 0xf9, 0xe3, 0xb5, 0x60, 0x6a,
-	0xfa, 0x77, 0x07, 0x56, 0x45, 0x05, 0xc9, 0x8b, 0xf6, 0x8b, 0x2b, 0xd7, 0x6c, 0xa2, 0x97, 0xa9,
+	0x26, 0xb9, 0x78, 0xf5, 0xfd, 0x9b, 0x03, 0x2b, 0xa2, 0xdf, 0x64, 0x2d, 0xfe, 0xc5, 0x35, 0x77,
-	0x96, 0x0a, 0x4d, 0xed, 0xe6, 0x0b, 0xef, 0xef, 0xb7, 0x0e, 0x5c, 0x31, 0x8d, 0x87, 0x28, 0xd4,
+	0x36, 0xf1, 0xf2, 0xa9, 0x14, 0x4a, 0x4d, 0xed, 0xe6, 0x0b, 0xef, 0xef, 0x57, 0x0e, 0x5c, 0x33,
-	0x45, 0x4d, 0xd6, 0xa9, 0xc5, 0xeb, 0x86, 0xc8, 0x0a, 0x19, 0x76, 0x7e, 0x9b, 0x65, 0xa3, 0x2e,
+	0xcf, 0x14, 0xd1, 0xd6, 0xf3, 0x9e, 0x64, 0xa7, 0x16, 0xaf, 0x5b, 0xa2, 0x2a, 0xa4, 0xd8, 0xf9,
-	0xce, 0xee, 0x63, 0x07, 0xbe, 0x68, 0x9e, 0x4d, 0x16, 0xc5, 0xcf, 0xe0, 0xa1, 0xff, 0x99, 0x3c,
+	0x8f, 0x32, 0x1b, 0x75, 0x71, 0x76, 0x1f, 0x39, 0xf0, 0x59, 0x73, 0xc9, 0xb2, 0x28, 0x7e, 0x02,
-	0x2f, 0xfe, 0xe9, 0xc0, 0x7a, 0x46, 0x2b, 0x7b, 0x63, 0xa4, 0x17, 0xa7, 0x85, 0xde, 0x06, 0xe8,
+	0xcf, 0x82, 0x4f, 0xe4, 0x32, 0xf2, 0x0f, 0x07, 0xd6, 0x52, 0x5a, 0xe9, 0x8d, 0x24, 0xb9, 0x38,
-	0xc7, 0x51, 0x44, 0xfb, 0xdc, 0xbc, 0xdc, 0xcf, 0xca, 0xb9, 0x39, 0xd4, 0xfb, 0xb1, 0xb5, 0x9f,
+	0x2d, 0xf4, 0x36, 0x40, 0x2f, 0x0a, 0x43, 0xda, 0xe3, 0xe6, 0x9e, 0x7f, 0x56, 0xcd, 0xcd, 0xa0,
-	0xab, 0xb0, 0x18, 0x8f, 0x78, 0x32, 0xe2, 0x3a, 0x24, 0xf5, 0xe8, 0xc2, 0xc7, 0xb0, 0xfd, 0xeb,
+	0xde, 0xf7, 0xad, 0xfd, 0x5c, 0x87, 0x85, 0x68, 0xc4, 0xe3, 0x11, 0xd7, 0x29, 0xa9, 0x47, 0x17,
-	0x3a, 0xd4, 0x4c, 0x93, 0x85, 0x7e, 0x04, 0xf5, 0x3b, 0x94, 0xeb, 0xdf, 0x9c, 0xbe, 0x76, 0x4e,
+	0x0e, 0xc3, 0xd6, 0x2f, 0x6a, 0x50, 0x35, 0x4f, 0x32, 0xf4, 0x3d, 0xa8, 0xdd, 0xa3, 0x5c, 0xff,
-	0xff, 0xaa, 0x02, 0xe8, 0xeb, 0xa5, 0xba, 0x5c, 0x34, 0x9c, 0xd3, 0xd1, 0xa1, 0x2d, 0x6b, 0x7d,
+	0x42, 0xf5, 0xa5, 0x73, 0x5e, 0xbb, 0x2a, 0x81, 0xbe, 0x5c, 0xe8, 0x4d, 0x8c, 0x06, 0x73, 0xde,
-	0x21, 0x22, 0xb3, 0xf4, 0x5a, 0x09, 0xa4, 0xb6, 0xf6, 0xd3, 0xb3, 0xda, 0x09, 0x74, 0xcd, 0x52,
+	0x7f, 0x68, 0xd3, 0x5a, 0x9f, 0x8b, 0x48, 0x2d, 0xbd, 0x56, 0x00, 0xa9, 0xad, 0xfd, 0xf0, 0xac,
-	0x34, 0x1f, 0x96, 0xd9, 0xed, 0x94, 0x85, 0x6b, 0xe3, 0xa3, 0xf9, 0xed, 0x00, 0x7a, 0xbd, 0x40,
+	0xc7, 0x07, 0xba, 0x61, 0x29, 0x9a, 0x0f, 0x4b, 0xed, 0xb6, 0x8b, 0xc2, 0xb5, 0xf1, 0xd1, 0xfc,
-	0xd7, 0x34, 0x28, 0x33, 0xfc, 0x46, 0x39, 0xb0, 0x36, 0x1b, 0x14, 0x77, 0x95, 0x68, 0xd3, 0xd2,
+	0xc7, 0x03, 0x7a, 0x3d, 0x47, 0xd7, 0x34, 0x28, 0x35, 0xfc, 0x46, 0x31, 0xb0, 0x36, 0x1b, 0xe4,
-	0x52, 0x04, 0xc8, 0xcc, 0x6d, 0x9d, 0x0f, 0xd4, 0xa6, 0xee, 0x5a, 0x5d, 0x03, 0x7a, 0xc5, 0x5a,
+	0xbf, 0x41, 0xd1, 0x86, 0xa5, 0x25, 0x0f, 0x90, 0x9a, 0xdb, 0x3c, 0x1f, 0xa8, 0x4d, 0xdd, 0xb7,
-	0x96, 0xcd, 0x66, 0x4a, 0x5f, 0x9d, 0x23, 0xd5, 0x9a, 0x7e, 0x38, 0xf9, 0x86, 0x47, 0x5f, 0xb6,
+	0xde, 0x18, 0xe8, 0x15, 0x6b, 0x59, 0x3a, 0x9b, 0x2a, 0x7d, 0x75, 0x8e, 0x54, 0x6b, 0xfa, 0xee,
-	0xbb, 0x55, 0x4b, 0x90, 0xe9, 0xdb, 0x98, 0x0f, 0xd0, 0x2a, 0xfb, 0x45, 0x8f, 0x64, 0x64, 0x87,
+	0xe4, 0x8d, 0x1f, 0x7d, 0xde, 0x7e, 0xdb, 0x5a, 0x82, 0x54, 0xdf, 0xfa, 0x7c, 0x80, 0x56, 0xd9,
-	0xe9, 0xac, 0x38, 0x53, 0xff, 0x8d, 0xf3, 0x60, 0xda, 0xc8, 0x71, 0xe1, 0x03, 0x0c, 0xd9, 0xcb,
+	0xcb, 0xbb, 0x52, 0x23, 0x3b, 0x4d, 0x67, 0xc5, 0xa9, 0xfa, 0xaf, 0x9c, 0x07, 0xd3, 0x46, 0x8e,
-	0x0b, 0xe4, 0x99, 0x99, 0xcd, 0x73, 0x71, 0xb9, 0x9d, 0x82, 0xb2, 0x38, 0x61, 0xa7, 0xa8, 0x6c,
+	0x72, 0x2f, 0x60, 0xc8, 0x5e, 0x9e, 0x23, 0x4f, 0xcd, 0x6c, 0x9c, 0x8b, 0xcb, 0xec, 0xe4, 0xb4,
-	0x16, 0xd9, 0x29, 0xc6, 0x69, 0x3b, 0x0f, 0xa7, 0x2b, 0x21, 0xfa, 0xca, 0x94, 0xa3, 0x73, 0x51,
+	0xc5, 0x09, 0x3b, 0x79, 0x6d, 0x33, 0xcf, 0x4e, 0x3e, 0x4e, 0xdb, 0x79, 0x3c, 0xdd, 0x09, 0xd1,
-	0xa6, 0xbd, 0x7d, 0x16, 0x44, 0x2b, 0xfe, 0xb6, 0xfa, 0x45, 0x1e, 0x4d, 0xfc, 0xa0, 0xc9, 0xe3,
+	0x17, 0xa6, 0x1c, 0x9d, 0x89, 0x52, 0xed, 0xad, 0xb3, 0x20, 0x5a, 0xf1, 0xd7, 0xd5, 0xef, 0xf7,
-	0x24, 0x53, 0xd2, 0x9a, 0x15, 0xa8, 0xa5, 0xdb, 0x1f, 0xb9, 0xd0, 0xb0, 0x0a, 0x03, 0xfa, 0xc0,
+	0x68, 0xe2, 0xe7, 0x4f, 0x1e, 0xc5, 0xa9, 0x92, 0xe6, 0xac, 0x40, 0x2d, 0xdd, 0xfa, 0x89, 0x0b,
-	0x4e, 0x4e, 0x9b, 0x05, 0x69, 0xc7, 0xae, 0x71, 0x85, 0x51, 0x3d, 0x07, 0xa8, 0xa9, 0x9e, 0x9e,
+	0x75, 0xab, 0x31, 0xa0, 0x0f, 0xec, 0xe2, 0xb4, 0x91, 0x53, 0x76, 0xec, 0x1e, 0x97, 0x9b, 0xd5,
-	0x51, 0x8f, 0x50, 0xd1, 0x5d, 0x9c, 0x41, 0x65, 0x46, 0xaf, 0x95, 0x44, 0x6b, 0xcb, 0x8f, 0x0a,
+	0x73, 0x80, 0x9a, 0xea, 0xe9, 0x19, 0xfd, 0x08, 0xe5, 0x9d, 0xc5, 0x19, 0x54, 0x6a, 0xf4, 0x46,
-	0x4a, 0xcd, 0x44, 0xfa, 0x9d, 0x91, 0x16, 0xa6, 0xdf, 0x22, 0x94, 0xb2, 0xf0, 0xa6, 0xf3, 0x1c,
+	0x41, 0xb4, 0xb6, 0xfc, 0x24, 0xa7, 0xd5, 0x4c, 0x94, 0xdf, 0x19, 0x69, 0x6e, 0xf9, 0xcd, 0x43,
-	0x07, 0xf1, 0x68, 0x51, 0xfe, 0xd5, 0x76, 0xe3, 0x7f, 0x01, 0x00, 0x00, 0xff, 0xff, 0xb5, 0xda,
+	0x29, 0x0b, 0x6f, 0x3a, 0x97, 0x08, 0xc4, 0x93, 0x05, 0xf9, 0xc7, 0xdc, 0xad, 0xff, 0x05, 0x00,
-	0x07, 0x8d, 0x7d, 0x1b, 0x00, 0x00,
+	0x00, 0xff, 0xff, 0xbc, 0x68, 0xf6, 0x08, 0xab, 0x1b, 0x00, 0x00,
 }

internal/tfplugin5/tfplugin5.proto

@@ -239,6 +239,20 @@ message PlanResourceChange {
         repeated AttributePath requires_replace = 2;
         bytes planned_private = 3; 
         repeated Diagnostic diagnostics = 4;
+
+
+        // This may be set only by the helper/schema "SDK" in the main Terraform
+        // repository, to request that Terraform Core >=0.12 permit additional
+        // inconsistencies that can result from the legacy SDK type system
+        // and its imprecise mapping to the >=0.12 type system.
+        // The change in behavior implied by this flag makes sense only for the
+        // specific details of the legacy SDK type system, and are not a general
+        // mechanism to avoid proper type handling in providers.
+        //
+        //     ====              DO NOT USE THIS              ====
+        //     ==== THIS MUST BE LEFT UNSET IN ALL OTHER SDKS ====
+        //     ====              DO NOT USE THIS              ====
+        bool legacy_type_system = 5;
     }
 }
 

plans/objchange/compatible.go

@@ -41,13 +41,21 @@ func assertObjectCompatible(schema *configschema.Block, planned, actual cty.Valu
 		return errs
 	}
 
-	for name := range schema.Attributes {
+	for name, attrS := range schema.Attributes {
 		plannedV := planned.GetAttr(name)
 		actualV := actual.GetAttr(name)
 
 		path := append(path, cty.GetAttrStep{Name: name})
 		moreErrs := assertValueCompatible(plannedV, actualV, path)
-		errs = append(errs, moreErrs...)
+		if attrS.Sensitive {
+			if len(moreErrs) > 0 {
+				// Use a vague placeholder message instead, to avoid disclosing
+				// sensitive information.
+				errs = append(errs, path.NewErrorf("inconsistent values for sensitive attribute"))
+			}
+		} else {
+			errs = append(errs, moreErrs...)
+		}
 	}
 	for name, blockS := range schema.BlockTypes {
 		plannedV := planned.GetAttr(name)

plans/objchange/compatible_test.go

@@ -95,6 +95,32 @@ func TestAssertObjectCompatible(t *testing.T) {
 				`.name: was cty.StringVal("wotsit"), but now cty.StringVal("thingy")`,
 			},
 		},
+		{
+			&configschema.Block{
+				Attributes: map[string]*configschema.Attribute{
+					"id": {
+						Type:     cty.String,
+						Computed: true,
+					},
+					"name": {
+						Type:      cty.String,
+						Required:  true,
+						Sensitive: true,
+					},
+				},
+			},
+			cty.ObjectVal(map[string]cty.Value{
+				"id":   cty.UnknownVal(cty.String),
+				"name": cty.StringVal("wotsit"),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"id":   cty.UnknownVal(cty.String),
+				"name": cty.StringVal("thingy"),
+			}),
+			[]string{
+				`.name: inconsistent values for sensitive attribute`,
+			},
+		},
 		{
 			&configschema.Block{
 				Attributes: map[string]*configschema.Attribute{

plans/objchange/plan_valid.go

@@ -0,0 +1,267 @@
+package objchange
+
+import (
+	"fmt"
+
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/hashicorp/terraform/configs/configschema"
+)
+
+// AssertPlanValid checks checks whether a planned new state returned by a
+// provider's PlanResourceChange method is suitable to achieve a change
+// from priorState to config. It returns a slice with nonzero length if
+// any problems are detected. Because problems here indicate bugs in the
+// provider that generated the plannedState, they are written with provider
+// developers as an audience, rather than end-users.
+//
+// All of the given values must have the same type and must conform to the
+// implied type of the given schema, or this function may panic or produce
+// garbage results.
+//
+// During planning, a provider may only make changes to attributes that are
+// null (unset) in the configuration and are marked as "computed" in the
+// resource type schema, in order to insert any default values the provider
+// may know about. If the default value cannot be determined until apply time,
+// the provider can return an unknown value. Providers are forbidden from
+// planning a change that disagrees with any non-null argument in the
+// configuration.
+//
+// As a special exception, providers _are_ allowed to provide attribute values
+// conflicting with configuration if and only if the planned value exactly
+// matches the corresponding attribute value in the prior state. The provider
+// can use this to signal that the new value is functionally equivalent to
+// the old and thus no change is required.
+func AssertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value) []error {
+	return assertPlanValid(schema, priorState, config, plannedState, nil)
+}
+
+func assertPlanValid(schema *configschema.Block, priorState, config, plannedState cty.Value, path cty.Path) []error {
+	var errs []error
+	if plannedState.IsNull() && !config.IsNull() {
+		errs = append(errs, path.NewErrorf("planned for absense but config wants existence"))
+		return errs
+	}
+	if config.IsNull() && !plannedState.IsNull() {
+		errs = append(errs, path.NewErrorf("planned for existence but config wants absense"))
+		return errs
+	}
+	if plannedState.IsNull() {
+		// No further checks possible if the planned value is null
+		return errs
+	}
+
+	impTy := schema.ImpliedType()
+
+	for name, attrS := range schema.Attributes {
+		plannedV := plannedState.GetAttr(name)
+		configV := config.GetAttr(name)
+		priorV := cty.NullVal(attrS.Type)
+		if !priorState.IsNull() {
+			priorV = priorState.GetAttr(name)
+		}
+
+		path := append(path, cty.GetAttrStep{Name: name})
+		moreErrs := assertPlannedValueValid(attrS, priorV, configV, plannedV, path)
+		errs = append(errs, moreErrs...)
+	}
+	for name, blockS := range schema.BlockTypes {
+		path := append(path, cty.GetAttrStep{Name: name})
+		plannedV := plannedState.GetAttr(name)
+		configV := config.GetAttr(name)
+		priorV := cty.NullVal(impTy.AttributeType(name))
+		if !priorState.IsNull() {
+			priorV = priorState.GetAttr(name)
+		}
+		if plannedV.RawEquals(configV) {
+			// Easy path: nothing has changed at all
+			continue
+		}
+		if !plannedV.IsKnown() {
+			errs = append(errs, path.NewErrorf("attribute representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+			continue
+		}
+
+		switch blockS.Nesting {
+		case configschema.NestingSingle:
+			moreErrs := assertPlanValid(&blockS.Block, priorV, configV, plannedV, path)
+			errs = append(errs, moreErrs...)
+		case configschema.NestingList:
+			// A NestingList might either be a list or a tuple, depending on
+			// whether there are dynamically-typed attributes inside. However,
+			// both support a similar-enough API that we can treat them the
+			// same for our purposes here.
+			if plannedV.IsNull() {
+				errs = append(errs, path.NewErrorf("attribute representing a list of nested blocks must be empty to indicate no blocks, not null"))
+				continue
+			}
+
+			plannedL := plannedV.LengthInt()
+			configL := configV.LengthInt()
+			if plannedL != configL {
+				errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+				continue
+			}
+			for it := plannedV.ElementIterator(); it.Next(); {
+				idx, plannedEV := it.Element()
+				path := append(path, cty.IndexStep{Key: idx})
+				if !plannedEV.IsKnown() {
+					errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+					continue
+				}
+				if !configV.HasIndex(idx).True() {
+					continue // should never happen since we checked the lengths above
+				}
+				configEV := configV.Index(idx)
+				priorEV := cty.NullVal(blockS.ImpliedType())
+				if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+					priorEV = priorV.Index(idx)
+				}
+
+				moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+				errs = append(errs, moreErrs...)
+			}
+		case configschema.NestingMap:
+			if plannedV.IsNull() {
+				errs = append(errs, path.NewErrorf("attribute representing a map of nested blocks must be empty to indicate no blocks, not null"))
+				continue
+			}
+
+			// A NestingMap might either be a map or an object, depending on
+			// whether there are dynamically-typed attributes inside, but
+			// that's decided statically and so all values will have the same
+			// kind.
+			if plannedV.Type().IsObjectType() {
+				plannedAtys := plannedV.Type().AttributeTypes()
+				configAtys := configV.Type().AttributeTypes()
+				for k := range plannedAtys {
+					if _, ok := configAtys[k]; !ok {
+						errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+						continue
+					}
+					path := append(path, cty.GetAttrStep{Name: k})
+
+					plannedEV := plannedV.GetAttr(k)
+					if !plannedEV.IsKnown() {
+						errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+						continue
+					}
+					configEV := configV.GetAttr(k)
+					priorEV := cty.NullVal(blockS.ImpliedType())
+					if !priorV.IsNull() && priorV.Type().HasAttribute(k) {
+						priorEV = priorV.GetAttr(k)
+					}
+					moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+					errs = append(errs, moreErrs...)
+				}
+				for k := range configAtys {
+					if _, ok := plannedAtys[k]; !ok {
+						errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", k))
+						continue
+					}
+				}
+			} else {
+				plannedL := plannedV.LengthInt()
+				configL := configV.LengthInt()
+				if plannedL != configL {
+					errs = append(errs, path.NewErrorf("block count in plan (%d) disagrees with count in config (%d)", plannedL, configL))
+					continue
+				}
+				for it := plannedV.ElementIterator(); it.Next(); {
+					idx, plannedEV := it.Element()
+					path := append(path, cty.IndexStep{Key: idx})
+					if !plannedEV.IsKnown() {
+						errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+						continue
+					}
+					k := idx.AsString()
+					if !configV.HasIndex(idx).True() {
+						errs = append(errs, path.NewErrorf("block key %q from plan is not present in config", k))
+						continue
+					}
+					configEV := configV.Index(idx)
+					priorEV := cty.NullVal(blockS.ImpliedType())
+					if !priorV.IsNull() && priorV.HasIndex(idx).True() {
+						priorEV = priorV.GetAttr(k)
+					}
+					moreErrs := assertPlanValid(&blockS.Block, priorEV, configEV, plannedEV, path)
+					errs = append(errs, moreErrs...)
+				}
+				for it := configV.ElementIterator(); it.Next(); {
+					idx, _ := it.Element()
+					if !plannedV.HasIndex(idx).True() {
+						errs = append(errs, path.NewErrorf("block key %q from config is not present in plan", idx.AsString()))
+						continue
+					}
+				}
+			}
+		case configschema.NestingSet:
+			if plannedV.IsNull() {
+				errs = append(errs, path.NewErrorf("attribute representing a set of nested blocks must be empty to indicate no blocks, not null"))
+				continue
+			}
+
+			// Because set elements have no identifier with which to correlate
+			// them, we can't robustly validate the plan for a nested block
+			// backed by a set, and so unfortunately we need to just trust the
+			// provider to do the right thing. :(
+			//
+			// (In principle we could correlate elements by matching the
+			// subset of attributes explicitly set in config, except for the
+			// special diff suppression rule which allows for there to be a
+			// planned value that is constructed by mixing part of a prior
+			// value with part of a config value, creating an entirely new
+			// element that is not present in either prior nor config.)
+			for it := plannedV.ElementIterator(); it.Next(); {
+				idx, plannedEV := it.Element()
+				path := append(path, cty.IndexStep{Key: idx})
+				if !plannedEV.IsKnown() {
+					errs = append(errs, path.NewErrorf("element representing nested block must not be unknown itself; set nested attribute values to unknown instead"))
+					continue
+				}
+			}
+
+		default:
+			panic(fmt.Sprintf("unsupported nesting mode %s", blockS.Nesting))
+		}
+	}
+
+	return errs
+}
+
+func assertPlannedValueValid(attrS *configschema.Attribute, priorV, configV, plannedV cty.Value, path cty.Path) []error {
+	var errs []error
+	if plannedV.RawEquals(configV) {
+		// This is the easy path: provider didn't change anything at all.
+		return errs
+	}
+	if plannedV.RawEquals(priorV) && !priorV.IsNull() {
+		// Also pretty easy: there is a prior value and the provider has
+		// returned it unchanged. This indicates that configV and plannedV
+		// are functionally equivalent and so the provider wishes to disregard
+		// the configuration value in favor of the prior.
+		return errs
+	}
+	if attrS.Computed && configV.IsNull() {
+		// The provider is allowed to change the value of any computed
+		// attribute that isn't explicitly set in the config.
+		return errs
+	}
+
+	// If none of the above conditions match, the provider has made an invalid
+	// change to this attribute.
+	if priorV.IsNull() {
+		if attrS.Sensitive {
+			errs = append(errs, path.NewErrorf("sensitive planned value does not match config value"))
+		} else {
+			errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v", plannedV, configV))
+		}
+		return errs
+	}
+	if attrS.Sensitive {
+		errs = append(errs, path.NewErrorf("sensitive planned value does not match config value nor prior value"))
+	} else {
+		errs = append(errs, path.NewErrorf("planned value %#v does not match config value %#v nor prior value %#v", plannedV, configV, priorV))
+	}
+	return errs
+}

plans/objchange/plan_valid_test.go

@@ -0,0 +1,576 @@
+package objchange
+
+import (
+	"testing"
+
+	"github.com/apparentlymart/go-dump/dump"
+	"github.com/zclconf/go-cty/cty"
+
+	"github.com/hashicorp/terraform/configs/configschema"
+	"github.com/hashicorp/terraform/tfdiags"
+)
+
+func TestAssertPlanValid(t *testing.T) {
+	tests := map[string]struct {
+		Schema   *configschema.Block
+		Prior    cty.Value
+		Config   cty.Value
+		Planned  cty.Value
+		WantErrs []string
+	}{
+		"all empty": {
+			&configschema.Block{},
+			cty.EmptyObjectVal,
+			cty.EmptyObjectVal,
+			cty.EmptyObjectVal,
+			nil,
+		},
+		"no computed, all match": {
+			&configschema.Block{
+				Attributes: map[string]*configschema.Attribute{
+					"a": {
+						Type:     cty.String,
+						Optional: true,
+					},
+				},
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingList,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			nil,
+		},
+		"no computed, plan matches, no prior": {
+			&configschema.Block{
+				Attributes: map[string]*configschema.Attribute{
+					"a": {
+						Type:     cty.String,
+						Optional: true,
+					},
+				},
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingList,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.NullVal(cty.Object(map[string]cty.Type{
+				"a": cty.String,
+				"b": cty.List(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				})),
+			})),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			nil,
+		},
+		"no computed, invalid change in plan": {
+			&configschema.Block{
+				Attributes: map[string]*configschema.Attribute{
+					"a": {
+						Type:     cty.String,
+						Optional: true,
+					},
+				},
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingList,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.NullVal(cty.Object(map[string]cty.Type{
+				"a": cty.String,
+				"b": cty.List(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				})),
+			})),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("new c value"),
+					}),
+				}),
+			}),
+			[]string{
+				`.b[0].c: planned value cty.StringVal("new c value") does not match config value cty.StringVal("c value")`,
+			},
+		},
+		"no computed, invalid change in plan sensitive": {
+			&configschema.Block{
+				Attributes: map[string]*configschema.Attribute{
+					"a": {
+						Type:     cty.String,
+						Optional: true,
+					},
+				},
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingList,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:      cty.String,
+									Optional:  true,
+									Sensitive: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.NullVal(cty.Object(map[string]cty.Type{
+				"a": cty.String,
+				"b": cty.List(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				})),
+			})),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("new c value"),
+					}),
+				}),
+			}),
+			[]string{
+				`.b[0].c: sensitive planned value does not match config value`,
+			},
+		},
+		"no computed, diff suppression in plan": {
+			&configschema.Block{
+				Attributes: map[string]*configschema.Attribute{
+					"a": {
+						Type:     cty.String,
+						Optional: true,
+					},
+				},
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingList,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("new c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.StringVal("a value"),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"), // plan uses value from prior object
+					}),
+				}),
+			}),
+			nil,
+		},
+		"no computed, all null": {
+			&configschema.Block{
+				Attributes: map[string]*configschema.Attribute{
+					"a": {
+						Type:     cty.String,
+						Optional: true,
+					},
+				},
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingList,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.NullVal(cty.String),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.NullVal(cty.String),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.NullVal(cty.String),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.NullVal(cty.String),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"a": cty.NullVal(cty.String),
+				"b": cty.ListVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.NullVal(cty.String),
+					}),
+				}),
+			}),
+			nil,
+		},
+
+		// Nested block collections are never null
+		"nested list, null in plan": {
+			&configschema.Block{
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingList,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.NullVal(cty.Object(map[string]cty.Type{
+				"b": cty.List(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				})),
+			})),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.ListValEmpty(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				})),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.NullVal(cty.List(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				}))),
+			}),
+			[]string{
+				`.b: attribute representing a list of nested blocks must be empty to indicate no blocks, not null`,
+			},
+		},
+		"nested set, null in plan": {
+			&configschema.Block{
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingSet,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.NullVal(cty.Object(map[string]cty.Type{
+				"b": cty.Set(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				})),
+			})),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetValEmpty(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				})),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.NullVal(cty.Set(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				}))),
+			}),
+			[]string{
+				`.b: attribute representing a set of nested blocks must be empty to indicate no blocks, not null`,
+			},
+		},
+		"nested map, null in plan": {
+			&configschema.Block{
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingMap,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.NullVal(cty.Object(map[string]cty.Type{
+				"b": cty.Map(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				})),
+			})),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.MapValEmpty(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				})),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.NullVal(cty.Map(cty.Object(map[string]cty.Type{
+					"c": cty.String,
+				}))),
+			}),
+			[]string{
+				`.b: attribute representing a map of nested blocks must be empty to indicate no blocks, not null`,
+			},
+		},
+
+		// We don't actually do any validation for nested set blocks, and so
+		// the remaining cases here are just intending to ensure we don't
+		// inadvertently start generating errors incorrectly in future.
+		"nested set, no computed, no changes": {
+			&configschema.Block{
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingSet,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			nil,
+		},
+		"nested set, no computed, invalid change in plan": {
+			&configschema.Block{
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingSet,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("new c value"), // matches neither prior nor config
+					}),
+				}),
+			}),
+			nil,
+		},
+		"nested set, no computed, diff suppressed": {
+			&configschema.Block{
+				BlockTypes: map[string]*configschema.NestedBlock{
+					"b": {
+						Nesting: configschema.NestingSet,
+						Block: configschema.Block{
+							Attributes: map[string]*configschema.Attribute{
+								"c": {
+									Type:     cty.String,
+									Optional: true,
+								},
+							},
+						},
+					},
+				},
+			},
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("new c value"),
+					}),
+				}),
+			}),
+			cty.ObjectVal(map[string]cty.Value{
+				"b": cty.SetVal([]cty.Value{
+					cty.ObjectVal(map[string]cty.Value{
+						"c": cty.StringVal("c value"), // plan uses value from prior object
+					}),
+				}),
+			}),
+			nil,
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			errs := AssertPlanValid(test.Schema, test.Prior, test.Config, test.Planned)
+
+			wantErrs := make(map[string]struct{})
+			gotErrs := make(map[string]struct{})
+			for _, err := range errs {
+				gotErrs[tfdiags.FormatError(err)] = struct{}{}
+			}
+			for _, msg := range test.WantErrs {
+				wantErrs[msg] = struct{}{}
+			}
+
+			t.Logf(
+				"\nprior:  %sconfig:  %splanned: %s",
+				dump.Value(test.Planned),
+				dump.Value(test.Config),
+				dump.Value(test.Planned),
+			)
+			for msg := range wantErrs {
+				if _, ok := gotErrs[msg]; !ok {
+					t.Errorf("missing expected error: %s", msg)
+				}
+			}
+			for msg := range gotErrs {
+				if _, ok := wantErrs[msg]; !ok {
+					t.Errorf("unexpected extra error: %s", msg)
+				}
+			}
+		})
+	}
+}

plugin/grpc_provider.go

@@ -402,6 +402,8 @@ func (p *GRPCProvider) PlanResourceChange(r providers.PlanResourceChangeRequest)
 
 	resp.PlannedPrivate = protoResp.PlannedPrivate
 
+	resp.LegacyTypeSystem = protoResp.LegacyTypeSystem
+
 	return resp
 }
 

providers/provider.go

@@ -226,6 +226,13 @@ type PlanResourceChangeResponse struct {
 
 	// Diagnostics contains any warnings or errors from the method call.
 	Diagnostics tfdiags.Diagnostics
+
+	// LegacyTypeSystem is set only if the provider is using the legacy SDK
+	// whose type system cannot be precisely mapped into the Terraform type
+	// system. We use this to bypass certain consistency checks that would
+	// otherwise fail due to this imprecise mapping. No other provider or SDK
+	// implementation is permitted to set this.
+	LegacyTypeSystem bool
 }
 
 type ApplyResourceChangeRequest struct {

terraform/context_apply_test.go

@@ -1878,14 +1878,21 @@ func TestContext2Apply_cancel(t *testing.T) {
 			},
 		}, nil
 	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+	p.DiffFn = func(info *InstanceInfo, s *InstanceState, rc *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
+		d := &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
+			Attributes: map[string]*ResourceAttrDiff{},
-				"value": &ResourceAttrDiff{
+		}
-					New: "2",
+		if new, ok := rc.Get("value"); ok {
-				},
+			d.Attributes["value"] = &ResourceAttrDiff{
-			},
+				New: new.(string),
-		}, nil
+			}
+		}
+		if new, ok := rc.Get("foo"); ok {
+			d.Attributes["foo"] = &ResourceAttrDiff{
+				New: new.(string),
+			}
+		}
+		return d, nil
 	}
 
 	if _, diags := ctx.Plan(); diags.HasErrors() {
@@ -1937,6 +1944,9 @@ func TestContext2Apply_cancelBlock(t *testing.T) {
 				"id": &ResourceAttrDiff{
 					New: "foo",
 				},
+				"num": &ResourceAttrDiff{
+					New: "2",
+				},
 			},
 		}, nil
 	}
@@ -1954,6 +1964,9 @@ func TestContext2Apply_cancelBlock(t *testing.T) {
 
 		return &InstanceState{
 			ID: "foo",
+			Attributes: map[string]string{
+				"num": "2",
+			},
 		}, nil
 	}
 
@@ -2002,6 +2015,7 @@ func TestContext2Apply_cancelBlock(t *testing.T) {
 aws_instance.foo:
   ID = foo
   provider = provider.aws
+  num = 2
 	`)
 }
 
@@ -2130,10 +2144,6 @@ func TestContext2Apply_compute(t *testing.T) {
 		),
 	})
 
-	if _, diags := ctx.Plan(); diags.HasErrors() {
-		t.Fatalf("plan errors: %s", diags.Err())
-	}
-
 	ctx.variables = InputValues{
 		"value": &InputValue{
 			Value:      cty.NumberIntVal(1),
@@ -2141,6 +2151,10 @@ func TestContext2Apply_compute(t *testing.T) {
 		},
 	}
 
+	if _, diags := ctx.Plan(); diags.HasErrors() {
+		t.Fatalf("plan errors: %s", diags.Err())
+	}
+
 	state, diags := ctx.Apply()
 	if diags.HasErrors() {
 		t.Fatalf("unexpected errors: %s", diags.Err())
@@ -3741,25 +3755,35 @@ func TestContext2Apply_multiVarComprehensive(t *testing.T) {
 
 	p.ApplyFn = testApplyFn
 
-	p.DiffFn = func(info *InstanceInfo, s *InstanceState, c *ResourceConfig) (*InstanceDiff, error) {
+	p.PlanResourceChangeFn = func(req providers.PlanResourceChangeRequest) providers.PlanResourceChangeResponse {
+		proposed := req.ProposedNewState
 		configsLock.Lock()
 		defer configsLock.Unlock()
-		key := c.Config["key"].(string)
+		key := proposed.GetAttr("key").AsString()
-		configs[key] = c
+		// This test was originally written using the legacy p.DiffFn interface,
+		// and so the assertions below expect an old-style ResourceConfig, which
+		// we'll construct via our shim for now to avoid rewriting all of the
+		// assertions.
+		configs[key] = NewResourceConfigShimmed(req.Config, p.GetSchemaReturn.ResourceTypes["test_thing"])
 
-		// Return a minimal diff to make sure this resource gets included in
+		retVals := make(map[string]cty.Value)
-		// the apply graph and thus the final state, but otherwise we're just
+		for it := proposed.ElementIterator(); it.Next(); {
-		// gathering data for assertions.
+			idxVal, val := it.Element()
-		return &InstanceDiff{
+			idx := idxVal.AsString()
-			Attributes: map[string]*ResourceAttrDiff{
+
-				"id": &ResourceAttrDiff{
+			switch idx {
-					NewComputed: true,
+			case "id":
-				},
+				retVals[idx] = cty.UnknownVal(cty.String)
-				"name": &ResourceAttrDiff{
+			case "name":
-					New: key,
+				retVals[idx] = cty.StringVal(key)
-				},
+			default:
-			},
+				retVals[idx] = val
-		}, nil
+			}
+		}
+
+		return providers.PlanResourceChangeResponse{
+			PlannedState: cty.ObjectVal(retVals),
+		}
 	}
 
 	p.GetSchemaReturn = &ProviderSchema{
@@ -6149,21 +6173,33 @@ func TestContext2Apply_outputDiffVars(t *testing.T) {
 
 		result := s.MergeDiff(d)
 		result.ID = "foo"
-		result.Attributes["foo"] = "bar"
 		return result, nil
 	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+	p.DiffFn = func(info *InstanceInfo, s *InstanceState, rc *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
+		d := &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
+			Attributes: map[string]*ResourceAttrDiff{},
-				"foo": &ResourceAttrDiff{
+		}
-					NewComputed: true,
+		if new, ok := rc.Get("value"); ok {
-					Type:        DiffAttrOutput,
+			d.Attributes["value"] = &ResourceAttrDiff{
-				},
+				New: new.(string),
-				"bar": &ResourceAttrDiff{
+			}
-					New: "baz",
+		}
-				},
+		if new, ok := rc.Get("foo"); ok {
-			},
+			d.Attributes["foo"] = &ResourceAttrDiff{
-		}, nil
+				New: new.(string),
+			}
+		} else if rc.IsComputed("foo") {
+			d.Attributes["foo"] = &ResourceAttrDiff{
+				NewComputed: true,
+				Type:        DiffAttrOutput, // This doesn't actually really do anything anymore, but this test originally set it.
+			}
+		}
+		if new, ok := rc.Get("num"); ok {
+			d.Attributes["num"] = &ResourceAttrDiff{
+				New: fmt.Sprintf("%#v", new),
+			}
+		}
+		return d, nil
 	}
 
 	if _, diags := ctx.Plan(); diags.HasErrors() {
@@ -6899,14 +6935,21 @@ func TestContext2Apply_destroyOrphan(t *testing.T) {
 		result.ID = "foo"
 		return result, nil
 	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+	p.DiffFn = func(info *InstanceInfo, s *InstanceState, rc *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
+		d := &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
+			Attributes: map[string]*ResourceAttrDiff{},
-				"value": &ResourceAttrDiff{
+		}
-					New: "bar",
+		if new, ok := rc.Get("value"); ok {
-				},
+			d.Attributes["value"] = &ResourceAttrDiff{
-			},
+				New: new.(string),
-		}, nil
+			}
+		}
+		if new, ok := rc.Get("foo"); ok {
+			d.Attributes["foo"] = &ResourceAttrDiff{
+				New: new.(string),
+			}
+		}
+		return d, nil
 	}
 
 	if _, diags := ctx.Plan(); diags.HasErrors() {
@@ -7021,14 +7064,21 @@ func TestContext2Apply_error(t *testing.T) {
 			},
 		}, nil
 	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+	p.DiffFn = func(info *InstanceInfo, s *InstanceState, rc *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
+		d := &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
+			Attributes: map[string]*ResourceAttrDiff{},
-				"value": &ResourceAttrDiff{
+		}
-					New: "2",
+		if new, ok := rc.Get("value"); ok {
-				},
+			d.Attributes["value"] = &ResourceAttrDiff{
-			},
+				New: new.(string),
-		}, nil
+			}
+		}
+		if new, ok := rc.Get("foo"); ok {
+			d.Attributes["foo"] = &ResourceAttrDiff{
+				New: new.(string),
+			}
+		}
+		return d, nil
 	}
 
 	if _, diags := ctx.Plan(); diags.HasErrors() {
@@ -7090,14 +7140,21 @@ func TestContext2Apply_errorPartial(t *testing.T) {
 			},
 		}, nil
 	}
-	p.DiffFn = func(*InstanceInfo, *InstanceState, *ResourceConfig) (*InstanceDiff, error) {
+	p.DiffFn = func(info *InstanceInfo, s *InstanceState, rc *ResourceConfig) (*InstanceDiff, error) {
-		return &InstanceDiff{
+		d := &InstanceDiff{
-			Attributes: map[string]*ResourceAttrDiff{
+			Attributes: map[string]*ResourceAttrDiff{},
-				"value": &ResourceAttrDiff{
+		}
-					New: "2",
+		if new, ok := rc.Get("value"); ok {
-				},
+			d.Attributes["value"] = &ResourceAttrDiff{
-			},
+				New: new.(string),
-		}, nil
+			}
+		}
+		if new, ok := rc.Get("foo"); ok {
+			d.Attributes["foo"] = &ResourceAttrDiff{
+				New: new.(string),
+			}
+		}
+		return d, nil
 	}
 
 	if _, diags := ctx.Plan(); diags.HasErrors() {
@@ -8907,6 +8964,7 @@ func TestContext2Apply_issue5254(t *testing.T) {
 template_file.child:
   ID = foo
   provider = provider.template
+  __template_requires_new = true
   template = Hi
   type = template_file
 

terraform/context_plan_test.go

@@ -445,7 +445,7 @@ func TestContext2Plan_moduleCycle(t *testing.T) {
 				Attributes: map[string]*configschema.Attribute{
 					"id":         {Type: cty.String, Computed: true},
 					"some_input": {Type: cty.String, Optional: true},
-					"type":       {Type: cty.String, Optional: true},
+					"type":       {Type: cty.String, Computed: true},
 				},
 			},
 		},
@@ -644,9 +644,10 @@ func TestContext2Plan_moduleInputComputed(t *testing.T) {
 		switch i := ric.Addr.String(); i {
 		case "aws_instance.bar":
 			checkVals(t, objectVal(t, schema, map[string]cty.Value{
-				"id":   cty.UnknownVal(cty.String),
+				"id":      cty.UnknownVal(cty.String),
-				"foo":  cty.UnknownVal(cty.String),
+				"foo":     cty.UnknownVal(cty.String),
-				"type": cty.StringVal("aws_instance"),
+				"type":    cty.StringVal("aws_instance"),
+				"compute": cty.StringVal("foo"),
 			}), ric.After)
 		case "module.child.aws_instance.foo":
 			checkVals(t, objectVal(t, schema, map[string]cty.Value{
@@ -1401,9 +1402,10 @@ func TestContext2Plan_moduleVarComputed(t *testing.T) {
 			}), ric.After)
 		case "module.child.aws_instance.foo":
 			checkVals(t, objectVal(t, schema, map[string]cty.Value{
-				"id":   cty.UnknownVal(cty.String),
+				"id":      cty.UnknownVal(cty.String),
-				"foo":  cty.UnknownVal(cty.String),
+				"foo":     cty.UnknownVal(cty.String),
-				"type": cty.StringVal("aws_instance"),
+				"type":    cty.StringVal("aws_instance"),
+				"compute": cty.StringVal("foo"),
 			}), ric.After)
 		default:
 			t.Fatal("unknown instance:", i)
@@ -1745,10 +1747,11 @@ func TestContext2Plan_computed(t *testing.T) {
 			}), ric.After)
 		case "aws_instance.foo":
 			checkVals(t, objectVal(t, schema, map[string]cty.Value{
-				"id":   cty.UnknownVal(cty.String),
+				"id":      cty.UnknownVal(cty.String),
-				"foo":  cty.UnknownVal(cty.String),
+				"foo":     cty.UnknownVal(cty.String),
-				"num":  cty.NumberIntVal(2),
+				"num":     cty.NumberIntVal(2),
-				"type": cty.StringVal("aws_instance"),
+				"type":    cty.StringVal("aws_instance"),
+				"compute": cty.StringVal("foo"),
 			}), ric.After)
 		default:
 			t.Fatal("unknown instance:", i)
@@ -2096,6 +2099,10 @@ func TestContext2Plan_computedList(t *testing.T) {
 				New:         "",
 				NewComputed: true,
 			}
+			diff.Attributes["compute"] = &ResourceAttrDiff{
+				Old: "",
+				New: compute,
+			}
 		}
 
 		fooOld := s.Attributes["foo"]
@@ -2168,8 +2175,9 @@ func TestContext2Plan_computedList(t *testing.T) {
 			}), ric.After)
 		case "aws_instance.foo":
 			checkVals(t, objectVal(t, schema, map[string]cty.Value{
-				"list": cty.UnknownVal(cty.List(cty.String)),
+				"list":    cty.UnknownVal(cty.List(cty.String)),
-				"num":  cty.NumberIntVal(2),
+				"num":     cty.NumberIntVal(2),
+				"compute": cty.StringVal("list.#"),
 			}), ric.After)
 		default:
 			t.Fatal("unknown instance:", i)
@@ -2208,6 +2216,10 @@ func TestContext2Plan_computedMultiIndex(t *testing.T) {
 				New:         "",
 				NewComputed: true,
 			}
+			diff.Attributes["compute"] = &ResourceAttrDiff{
+				Old: "",
+				New: compute,
+			}
 		}
 
 		fooOld := s.Attributes["foo"]
@@ -2270,13 +2282,15 @@ func TestContext2Plan_computedMultiIndex(t *testing.T) {
 		switch i := ric.Addr.String(); i {
 		case "aws_instance.foo[0]":
 			checkVals(t, objectVal(t, schema, map[string]cty.Value{
-				"ip":  cty.UnknownVal(cty.List(cty.String)),
+				"ip":      cty.UnknownVal(cty.List(cty.String)),
-				"foo": cty.NullVal(cty.List(cty.String)),
+				"foo":     cty.NullVal(cty.List(cty.String)),
+				"compute": cty.StringVal("ip.#"),
 			}), ric.After)
 		case "aws_instance.foo[1]":
 			checkVals(t, objectVal(t, schema, map[string]cty.Value{
-				"ip":  cty.UnknownVal(cty.List(cty.String)),
+				"ip":      cty.UnknownVal(cty.List(cty.String)),
-				"foo": cty.NullVal(cty.List(cty.String)),
+				"foo":     cty.NullVal(cty.List(cty.String)),
+				"compute": cty.StringVal("ip.#"),
 			}), ric.After)
 		case "aws_instance.bar[0]":
 			checkVals(t, objectVal(t, schema, map[string]cty.Value{

terraform/context_test.go

@@ -4,7 +4,9 @@ import (
 	"bufio"
 	"bytes"
 	"fmt"
+	"github.com/davecgh/go-spew/spew"
 	"io/ioutil"
+	"log"
 	"os"
 	"path/filepath"
 	"sort"
@@ -195,6 +197,10 @@ func testDiffFn(
 	diff := new(InstanceDiff)
 	diff.Attributes = make(map[string]*ResourceAttrDiff)
 
+	defer func() {
+		log.Printf("[TRACE] testDiffFn: generated diff is:\n%s", spew.Sdump(diff))
+	}()
+
 	if s != nil {
 		diff.DestroyTainted = s.Tainted
 	}
@@ -202,6 +208,28 @@ func testDiffFn(
 	for k, v := range c.Raw {
 		// Ignore __-prefixed keys since they're used for magic
 		if k[0] == '_' && k[1] == '_' {
+			// ...though we do still need to include them in the diff, to
+			// simulate normal provider behaviors.
+			old := s.Attributes[k]
+			var new string
+			switch tv := v.(type) {
+			case string:
+				new = tv
+			default:
+				new = fmt.Sprintf("%#v", v)
+			}
+			if new == hil.UnknownValue {
+				diff.Attributes[k] = &ResourceAttrDiff{
+					Old:         old,
+					New:         "",
+					NewComputed: true,
+				}
+			} else {
+				diff.Attributes[k] = &ResourceAttrDiff{
+					Old: old,
+					New: new,
+				}
+			}
 			continue
 		}
 
@@ -211,10 +239,25 @@ func testDiffFn(
 
 		// This key is used for other purposes
 		if k == "compute_value" {
+			if old, ok := s.Attributes["compute_value"]; !ok || old != v.(string) {
+				diff.Attributes["compute_value"] = &ResourceAttrDiff{
+					Old: old,
+					New: v.(string),
+				}
+			}
 			continue
 		}
 
 		if k == "compute" {
+			// The "compute" value itself must be included in the diff if it
+			// has changed since prior.
+			if old, ok := s.Attributes["compute"]; !ok || old != v.(string) {
+				diff.Attributes["compute"] = &ResourceAttrDiff{
+					Old: old,
+					New: v.(string),
+				}
+			}
+
 			if v == hil.UnknownValue || v == "unknown" {
 				// compute wasn't set in the config, so don't use these
 				// computed values from the schema.
@@ -520,6 +563,7 @@ func testProviderSchema(name string) *ProviderSchema {
 					"foo": {
 						Type:     cty.String,
 						Optional: true,
+						Computed: true,
 					},
 					"bar": {
 						Type:     cty.String,
@@ -538,6 +582,7 @@ func testProviderSchema(name string) *ProviderSchema {
 					"value": {
 						Type:     cty.String,
 						Optional: true,
+						Computed: true,
 					},
 					"output": {
 						Type:     cty.String,
@@ -600,10 +645,12 @@ func testProviderSchema(name string) *ProviderSchema {
 					"id": {
 						Type:     cty.String,
 						Optional: true,
+						Computed: true,
 					},
 					"ids": {
 						Type:     cty.List(cty.String),
 						Optional: true,
+						Computed: true,
 					},
 				},
 			},

terraform/eval_apply.go

@@ -3,6 +3,7 @@ package terraform
 import (
 	"fmt"
 	"log"
+	"strings"
 
 	"github.com/hashicorp/go-multierror"
 	"github.com/hashicorp/hcl2/hcl"
@@ -172,34 +173,42 @@ func (n *EvalApply) Eval(ctx EvalContext) (interface{}, error) {
 		newVal = cty.UnknownAsNull(newVal)
 	}
 
-	if resp.LegacyTypeSystem {
+	if change.Action != plans.Delete {
-		// The shimming of the old type system in the legacy SDK is not precise
-		// enough to pass this consistency check, so we'll give it a pass here,
-		// but we will generate a warning about it so that we are more likely
-		// to notice in the logs if an inconsistency beyond the type system
-		// leads to a downstream provider failure.
-		log.Printf("[WARN] Provider %s is using the legacy provider SDK, so we cannot check the result value for consistency with the plan; downstream errors about inconsistent plans may actually be caused by incorrect values from %s", n.ProviderAddr.ProviderConfig.Type, absAddr)
-		// The sort of inconsistency we won't catch here is if a known value
-		// in the plan is changed during apply. That can cause downstream
-		// problems because a dependent resource would make its own plan based
-		// on the planned value, and thus get a different result during the
-		// apply phase. This will usually lead to a "Provider produced invalid plan"
-		// error that incorrectly blames the downstream resource for the change.
-	} else if change.Action != plans.Delete {
 		// Only values that were marked as unknown in the planned value are allowed
 		// to change during the apply operation. (We do this after the unknown-ness
 		// check above so that we also catch anything that became unknown after
 		// being known during plan.)
 		if errs := objchange.AssertObjectCompatible(schema, change.After, newVal); len(errs) > 0 {
-			for _, err := range errs {
+			if resp.LegacyTypeSystem {
-				diags = diags.Append(tfdiags.Sourceless(
+				// The shimming of the old type system in the legacy SDK is not precise
-					tfdiags.Error,
+				// enough to pass this consistency check, so we'll give it a pass here,
-					"Provider produced inconsistent result after apply",
+				// but we will generate a warning about it so that we are more likely
-					fmt.Sprintf(
+				// to notice in the logs if an inconsistency beyond the type system
-						"When applying changes to %s, provider %q produced an unexpected new value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+				// leads to a downstream provider failure.
-						absAddr, n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatError(err),
+				var buf strings.Builder
-					),
+				fmt.Fprintf(&buf, "[WARN] Provider %q produced an unexpected new value for %s, but we are tolerating it because it is using the legacy plugin SDK.\n    The following problems may be the cause of any confusing errors from downstream operations:", n.ProviderAddr.ProviderConfig.Type, absAddr)
-				))
+				for _, err := range errs {
+					fmt.Fprintf(&buf, "\n      - %s", tfdiags.FormatError(err))
+				}
+				log.Print(buf.String())
+
+				// The sort of inconsistency we won't catch here is if a known value
+				// in the plan is changed during apply. That can cause downstream
+				// problems because a dependent resource would make its own plan based
+				// on the planned value, and thus get a different result during the
+				// apply phase. This will usually lead to a "Provider produced invalid plan"
+				// error that incorrectly blames the downstream resource for the change.
+			} else {
+				for _, err := range errs {
+					diags = diags.Append(tfdiags.Sourceless(
+						tfdiags.Error,
+						"Provider produced inconsistent result after apply",
+						fmt.Sprintf(
+							"When applying changes to %s, provider %q produced an unexpected new value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+							absAddr, n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatError(err),
+						),
+					))
+				}
 			}
 		}
 	}

terraform/eval_diff.go

@@ -216,6 +216,34 @@ func (n *EvalDiff) Eval(ctx EvalContext) (interface{}, error) {
 		return nil, diags.Err()
 	}
 
+	if errs := objchange.AssertPlanValid(schema, priorVal, configVal, plannedNewVal); len(errs) > 0 {
+		if resp.LegacyTypeSystem {
+			// The shimming of the old type system in the legacy SDK is not precise
+			// enough to pass this consistency check, so we'll give it a pass here,
+			// but we will generate a warning about it so that we are more likely
+			// to notice in the logs if an inconsistency beyond the type system
+			// leads to a downstream provider failure.
+			var buf strings.Builder
+			fmt.Fprintf(&buf, "[WARN] Provider %q produced an invalid plan for %s, but we are tolerating it because it is using the legacy plugin SDK.\n    The following problems may be the cause of any confusing errors from downstream operations:", n.ProviderAddr.ProviderConfig.Type, absAddr)
+			for _, err := range errs {
+				fmt.Fprintf(&buf, "\n      - %s", tfdiags.FormatError(err))
+			}
+			log.Print(buf.String())
+		} else {
+			for _, err := range errs {
+				diags = diags.Append(tfdiags.Sourceless(
+					tfdiags.Error,
+					"Provider produced invalid plan",
+					fmt.Sprintf(
+						"Provider %q planned an invalid value for %s.\n\nThis is a bug in the provider, which should be reported in the provider's own issue tracker.",
+						n.ProviderAddr.ProviderConfig.Type, tfdiags.FormatErrorPrefixed(err, absAddr.String()),
+					),
+				))
+			}
+			return nil, diags.Err()
+		}
+	}
+
 	{
 		var moreDiags tfdiags.Diagnostics
 		plannedNewVal, moreDiags = n.processIgnoreChanges(priorVal, plannedNewVal)

terraform/terraform_test.go

@@ -446,6 +446,8 @@ aws_instance.bar:
 aws_instance.foo:
   ID = foo
   provider = provider.aws
+  compute = value
+  compute_value = 1
   num = 2
   type = aws_instance
   value = computed_value
@@ -659,6 +661,8 @@ aws_instance.bar:
 aws_instance.foo:
   ID = foo
   provider = provider.aws
+  compute = value
+  compute_value = 1
   num = 2
   type = aws_instance
   value = computed_value
@@ -1031,6 +1035,7 @@ const testTerraformApplyUnknownAttrStr = `
 aws_instance.foo: (tainted)
   ID = foo
   provider = provider.aws
+  compute = unknown
   num = 2
   type = aws_instance
 `

terraform/test-fixtures/apply-idattr/main.tf

@@ -1,2 +1,3 @@
 resource "aws_instance" "foo" {
+  num = 42
 }

terraform/test-fixtures/plan-diffvar/main.tf

@@ -1,7 +1,7 @@
 resource "aws_instance" "foo" {
-    num = "2"
+  num = "3"
 }
 
 resource "aws_instance" "bar" {
-    num = "${aws_instance.foo.num}"
+  num = aws_instance.foo.num
 }