@intentius/chant-lexicon-terraform 0.102.0 → 0.104.0

package/dist/__fixtures__/terragrunt/affected-cases.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Changes to the `affected/` fixture and what each selects (#3415). Shared by
+ * `terragrunt/affected.test.ts`, which feeds the recorded `terragrunt` column
+ * to the selection, and `terragrunt/affected.acceptance.test.ts`, which makes
+ * each change as a commit and checks the column against a real Terragrunt.
+ *
+ * `terragrunt` is what Terragrunt's own `[base...HEAD]` filter selected
+ * (observed on 1.1.6 and 1.2.0-rc1). The supplement cases select nothing
+ * there: that column is the red half of each supplement.
+ */
+import type { TerragruntAffectedUnit } from "../../terragrunt/affected.js";
+export interface AffectedCase {
+    name: string;
+    /** Make the change in a copy of the fixture. */
+    change: (dir: string) => void;
+    /** What `git diff --name-only` lists for the change. */
+    changed: string[];
+    /** What Terragrunt's own git filter selects, catalog excluded. */
+    terragrunt: string[];
+    expected: TerragruntAffectedUnit[];
+}
+export declare const AFFECTED_CASES: AffectedCase[];
+//# sourceMappingURL=affected-cases.d.ts.map

package/dist/__fixtures__/terragrunt/affected-cases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"affected-cases.d.ts","sourceRoot":"","sources":["../../../src/__fixtures__/terragrunt/affected-cases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAExE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,wDAAwD;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,kEAAkE;IAClE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,sBAAsB,EAAE,CAAC;CACpC;AAID,eAAO,MAAM,cAAc,EAAE,YAAY,EAiGxC,CAAC"}

package/dist/__fixtures__/terragrunt/record.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Re-record `recorded/` from a real Terragrunt run over `five-units/`:
+ *
+ *     PATH=<dir with terragrunt 1.1+ and tofu>:$PATH npx tsx lexicons/terraform/src/__fixtures__/terragrunt/record.ts
+ *
+ * It copies the fixture to a temporary directory, discovers the units, plans
+ * and applies wave 1, then plans wave 2, and writes what Terragrunt printed
+ * and wrote with the temporary directory's path taken out.
+ *
+ * `recorded/failed-plan-report.json` is not written here. It was recorded by
+ * hand with Terragrunt 1.1.6 and OpenTofu 1.12.5, planning `live/dev/db`,
+ * `live/dev/app` and `live/prod/app` in one run after giving `live/dev/db` a
+ * `before_hook` that runs `false` on plan: db fails, app exits early because
+ * db failed, and prod/app plans.
+ */
+export {};
+//# sourceMappingURL=record.d.ts.map

package/dist/__fixtures__/terragrunt/record.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record.d.ts","sourceRoot":"","sources":["../../../src/__fixtures__/terragrunt/record.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}

package/dist/change-set.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Change-set adapters for the terraform family (#3181): a `terraform show
+ * -json` plan from terraform, tofu or choudoufu, and a choudoufu set plan
+ * document (`live-plan-set -json`, choudoufu#1752), each into
+ * `@intentius/chant/change-set` parts.
+ *
+ * A member's plan digest is {@link terraformPlanDigest}, the value a
+ * `TerraformApplyOp` gate on that root binds (#2300), so a change set over
+ * one root and a gate over the same root agree on what changed.
+ *
+ * This module imports `./plan-digest` and chant's `change-set` and
+ * `lifecycle/plan-digest` subpaths, never the lexicon's entry point, so it
+ * bundles without TypeScript or the lint rules (#3421).
+ */
+import type { ChangeSetAction, ChangeSetPart, ChangeSetPlanner } from "@intentius/chant/change-set";
+/**
+ * The planner a root's binary names: `choudoufu` and `tofu` by name, and
+ * `terraform` for anything else, a path to terraform included.
+ */
+export declare function plannerForBinary(binary: string | undefined): ChangeSetPlanner;
+/**
+ * The action a `resource_changes` entry's `actions` array means. Delete then
+ * create and create then delete are both a replace; the order is the
+ * disruption ({@link disruptionFor}).
+ */
+export declare function actionFor(actions: unknown): ChangeSetAction;
+/** A resource address's module path, name and index, read off the address when the entry does not carry them. */
+export declare function parseTerraformAddress(address: string): {
+    module?: string;
+    type: string;
+    name: string;
+    index?: string | number;
+};
+export interface TerraformChangeSetPartInput {
+    /** The member's name: the root's name in `terraform.roots`, which a workspace member of kind terraform or choudoufu shares. */
+    member: string;
+    /** `terraform show -json <planfile>`, parsed. */
+    plan: unknown;
+    /** The binary that planned it, or the planner by name. Default `terraform`. */
+    planner?: ChangeSetPlanner;
+    /** The estate or workspace the root plans into. */
+    scope?: string;
+    /** The planner's own digest of this plan, when it printed one. */
+    nativeDigest?: string;
+}
+/**
+ * One terraform-family root's part, from its `show -json` plan.
+ *
+ * Every `resource_changes` entry becomes an entry, no-op and read included.
+ * A plan stock marked `errored` is a failed member: its entries are kept,
+ * but nothing should apply it.
+ */
+export declare function terraformChangeSetPart(input: TerraformChangeSetPartInput): ChangeSetPart;
+export interface ChoudoufuSetPlanInput {
+    /** `choudoufu live-plan-set -json`, parsed. */
+    document: unknown;
+    /** The member a root belongs to. Default: the root's directory as the set names it. */
+    memberFor?: (root: string, estate: string | undefined) => string;
+}
+/**
+ * One part per root of a choudoufu set plan (choudoufu#1752). A planned
+ * root is {@link terraformChangeSetPart} over its embedded plan, with the
+ * estate as scope and choudoufu's own root digest as `nativeDigest`. A
+ * failed root is a failed member with its error and no plan digest.
+ */
+export declare function choudoufuSetPlanParts(input: ChoudoufuSetPlanInput): ChangeSetPart[];
+//# sourceMappingURL=change-set.d.ts.map

package/dist/change-set.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-set.d.ts","sourceRoot":"","sources":["../src/change-set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,eAAe,EAIf,aAAa,EACb,gBAAgB,EAEjB,MAAM,6BAA6B,CAAC;AAyBrC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAK7E;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,GAAG,eAAe,CAU3D;AAWD,iHAAiH;AACjH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAQ/H;AA2CD,MAAM,WAAW,2BAA2B;IAC1C,+HAA+H;IAC/H,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,IAAI,EAAE,OAAO,CAAC;IACd,+EAA+E;IAC/E,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,mDAAmD;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,2BAA2B,GAAG,aAAa,CAiDxF;AA6BD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,QAAQ,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,CAAC;CAClE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,aAAa,EAAE,CAwBnF"}

package/dist/changed-roots.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Which `terraform.roots` a change touched (#3183), from the changed files
+ * alone.
+ *
+ * A root is hand-written HCL, not chant source, so `chant lifecycle affected`
+ * never sees it move: its artifact diff covers what chant builds. A pull
+ * request's plan needs the roots a change reaches, and this answers that
+ * from paths: a root is touched when a changed file sits in its directory,
+ * in a local module it calls (followed through modules that call modules),
+ * or is one of its var files.
+ *
+ * The module calls are read with a regex over the root's `.tf` and `.tofu`
+ * files, the way `./op/activities/live-detect.ts` reads a live block, so
+ * this stays out of the HCL parser's dependency graph. Only a `source` that
+ * starts with `./` or `../` is followed; a registry or git source is a
+ * version pin in the root's own files, which a change to it already touches.
+ */
+import type { TerraformRootConfig } from "./config.js";
+/**
+ * Every path, relative to `projectRoot`, whose change touches `root`: its
+ * directory, each local module it reaches, and its var files.
+ */
+export declare function rootWatchPaths(projectRoot: string, root: Pick<TerraformRootConfig, "dir" | "varFiles">): string[];
+/**
+ * The names of the roots in `roots` that a change to `changedFiles` touches,
+ * sorted. `changedFiles` are relative to `projectRoot` with `/` separators,
+ * as `git diff --name-only --relative` prints them.
+ */
+export declare function changedRoots(projectRoot: string, roots: Record<string, Pick<TerraformRootConfig, "dir" | "varFiles">>, changedFiles: readonly string[]): string[];
+//# sourceMappingURL=changed-roots.d.ts.map

package/dist/changed-roots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"changed-roots.d.ts","sourceRoot":"","sources":["../src/changed-roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAuCpD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,UAAU,CAAC,GAAG,MAAM,EAAE,CAajH;AAQD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC,EACpE,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,EAAE,CAQV"}

package/dist/commands.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `chant terraform pin-rollout`: one run of a pin-bump rollout (#3189), from
+ * the command line. The `TerraformPinRolloutOp` composite runs the same code
+ * as an Op step.
+ *
+ *     chant terraform pin-rollout --module <source> --from <pin> --to <pin>
+ *       [--root <dir>]... [--depends-on <dir>=<dir>]... [--ts-source <dir>=<file>]...
+ *       [--canary <dir>]... [--waves-from <live-waves.json> [--waves-prefix <dir>]]
+ *       [--pull-request] [--base <branch>] [--remote <name>] [--applied-check <name>] [--json]
+ *
+ * Without `--pull-request` it reports the next wave and opens nothing. Exit
+ * 0 when the rollout is complete or a wave's PR was opened (or would be), 3
+ * when it is waiting on a merge or an apply (a gate is a fact, #2119), and 1
+ * when it stopped on a failed root or a closed PR.
+ */
+import type { CommandGroup } from "@intentius/chant/cli/command-group";
+import type { TerraformPinRolloutArgs } from "./op/activities/pin-rollout.js";
+/** Parse the verb's flags into the activity's args. Throws on an unknown flag or a missing value. */
+export declare function parsePinRolloutArgs(rawArgs: string[]): {
+    args: TerraformPinRolloutArgs;
+    json: boolean;
+};
+/** Exit status for a rollout's status. */
+export declare function pinRolloutExitCode(status: string): number;
+export declare const terraformCommands: CommandGroup;
+//# sourceMappingURL=commands.d.ts.map

package/dist/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAuB,MAAM,oCAAoC,CAAC;AAE5F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAW3E,qGAAqG;AACrG,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,CAiDvG;AAED,0CAA0C;AAC1C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIzD;AAqBD,eAAO,MAAM,iBAAiB,EAAE,YAI/B,CAAC"}

package/dist/components/capability-plugin.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `terraformCapabilityPlugin` — the terraform lexicon's capability plugin
+ * (#3049). It contributes `terraform-apply`, which lets a component deploy a
+ * root named in `terraform.roots`, so a change across many roots runs as a
+ * `chant components fan-out`: in an order derived from each component's
+ * `dependsOn`, and, with `--wave-gate`, a gate per wave bound to the wave's
+ * set digest.
+ *
+ * The step is `{ kind: "terraform-apply", root: "<name>" }`, with optional
+ * `vars` (passed as `-var`, so `stackOutput()` can hand one root's output to
+ * another) and `cwd`. It works the same for `terraform`, `tofu` and
+ * `choudoufu`, since all three go through the lexicon's activities.
+ *
+ * ## Plan, then apply exactly that plan
+ *
+ * `plan` runs `init` and `plan -out`, and answers with the root as the member
+ * and `terraformPlanDigest` as its digest: the value a `TerraformApplyOp`
+ * gate on this root alone binds (#2300). A gated-wave fan-out folds those into
+ * the wave's set digest and hands the plan file back to `run`, which applies
+ * that file and nothing else. terraform and tofu refuse a saved plan whose
+ * state moved since it was written; choudoufu re-plans against the live
+ * system and refuses with exit 3 when its fresh plan differs (choudoufu
+ * #878). Either refusal fails the step.
+ *
+ * Run without a wave plan (`chant run --components`, or a fan-out with no
+ * wave gate), `run` plans and applies in one go, which is what `terraform
+ * apply` with no plan file does too.
+ */
+import type { Capability } from "@intentius/chant/components/capability";
+import { type CapabilityPlugin } from "@intentius/chant/components/capability-plugin";
+/** The `terraform-apply` step's input. */
+export interface TerraformApplyStepInput {
+    /** Key into `terraform.roots`. Also the member's name in a wave's set digest. */
+    root: string;
+    /** Input variables, after the root's var files. See `TerraformPlanArgs.vars`. */
+    vars?: Record<string, unknown>;
+    /** Where the `chant.config.*` search starts. Default: the current directory. */
+    cwd?: string;
+}
+/** What `terraform-apply` returns. `outputs` is what a dependent's `stackOutput()` reads. */
+export interface TerraformApplyStepOutput {
+    root: string;
+    planDigest: string;
+    /** Whether the plan applied came from the wave's plan rather than one made here. */
+    fromWavePlan: boolean;
+    /** `terraform output -json`, as `{ name: value }`. */
+    outputs: Record<string, unknown>;
+}
+export declare const terraformApplyCapability: Capability<TerraformApplyStepInput, TerraformApplyStepOutput>;
+export declare const TERRAFORM_VERB_FAMILIES: {
+    readonly apply: readonly ["terraform-apply"];
+};
+export declare const terraformCapabilityPlugin: CapabilityPlugin;
+//# sourceMappingURL=capability-plugin.d.ts.map

package/dist/components/capability-plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-plugin.d.ts","sourceRoot":"","sources":["../../src/components/capability-plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAiC,MAAM,wCAAwC,CAAC;AAExG,OAAO,EAAqB,KAAK,gBAAgB,EAAE,MAAM,+CAA+C,CAAC;AAGzG,0CAA0C;AAC1C,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,gFAAgF;IAChF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,6FAA6F;AAC7F,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAgCD,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,uBAAuB,EAAE,wBAAwB,CA6BlG,CAAC;AAEF,eAAO,MAAM,uBAAuB;aAClC,KAAK,YAAG,iBAAiB;CACjB,CAAC;AAEX,eAAO,MAAM,yBAAyB,EAAE,gBAWvC,CAAC"}

package/dist/composites/terraform-pin-rollout-op.d.ts

@@ -0,0 +1,44 @@
+/**
+ * TerraformPinRolloutOp composite (#3189): roll a module version out as
+ * pin-bump pull requests, one wave at a time.
+ *
+ * One phase, one `terraformPinRollout` step. Each run reads the rollout's
+ * state from the forge and opens at most the next wave's PR, so the Op is
+ * meant to run again: on a `schedule`, or from the pipeline that applies a
+ * merged wave. Wave N+1 opens only on a run after wave N's PR merged and each
+ * of its roots reported its apply check as passed on the merge commit. Until
+ * then a run reports where the rollout stands and opens nothing. A failed
+ * root fails the run, naming it.
+ *
+ * The run's `Rollout` outcome is the rollout's status: `opened`, `waiting`,
+ * `complete`, or `would-open` in report mode.
+ *
+ * @example
+ * ```typescript
+ * import { TerraformPinRolloutOp } from "@intentius/chant-lexicon-terraform";
+ *
+ * export const { op } = TerraformPinRolloutOp({
+ *   name: "vpc-1-4",
+ *   module: "oci://registry.example.com/modules/vpc",
+ *   from: "1.3.0",
+ *   to: "1.4.0",
+ *   canaries: ["live/dev/vpc"],
+ *   mode: "pull-request",
+ *   schedule: "*\/30 * * * *",
+ * });
+ * ```
+ */
+import { OpResource } from "@intentius/chant/op";
+import type { TerraformPinRolloutArgs } from "../op/activities/pin-rollout.js";
+export interface TerraformPinRolloutOpConfig extends TerraformPinRolloutArgs {
+    /** Op name (kebab-case). */
+    name: string;
+    /** Cron expression, so the rollout re-reads the forge and moves on without anyone running it. */
+    schedule?: string;
+}
+export interface TerraformPinRolloutOpResources {
+    /** Op resource. One Rollout phase. */
+    op: InstanceType<typeof OpResource>;
+}
+export declare function TerraformPinRolloutOp(config: TerraformPinRolloutOpConfig): TerraformPinRolloutOpResources;
+//# sourceMappingURL=terraform-pin-rollout-op.d.ts.map

package/dist/composites/terraform-pin-rollout-op.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terraform-pin-rollout-op.d.ts","sourceRoot":"","sources":["../../src/composites/terraform-pin-rollout-op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAa,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAE5E,MAAM,WAAW,2BAA4B,SAAQ,uBAAuB;IAC1E,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,iGAAiG;IACjG,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC7C,sCAAsC;IACtC,EAAE,EAAE,YAAY,CAAC,OAAO,UAAU,CAAC,CAAC;CACrC;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,8BAA8B,CAYzG"}

package/dist/hcl/descend.d.ts

@@ -46,7 +46,7 @@
  * half a root parsed is more useful than none of it.
  */
 import type { Declarable } from "@intentius/chant/declarable";
-import type { Hcl2Json } from "@intentius/chant/terraform/parse";
+import type { Hcl2Json } from "@intentius/chant/terraform/hcl2json";
 import { type TerraformRootModeOptions } from "./parse.js";
 /** tflint's `--call-module-type`, with the same three states and the same default. */
 export type CallModuleType = "local" | "none" | "all";

package/dist/hcl/descend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"descend.d.ts","sourceRoot":"","sources":["../../src/hcl/descend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAGjE,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,SAAS,CAAC;AAEjB,sFAAsF;AACtF,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEtD,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,sBAAsB,CAYpF;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,gEAAgE;IAChE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAuDD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAC9B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,aAAa,CAAC,CAiGxB"}
+{"version":3,"file":"descend.d.ts","sourceRoot":"","sources":["../../src/hcl/descend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAGpE,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,SAAS,CAAC;AAEjB,sFAAsF;AACtF,MAAM,MAAM,cAAc,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEtD,qEAAqE;AACrE,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,SAAS,EAAE,OAAO,GAAG,MAAM,CAAC;IAC5B,kFAAkF;IAClF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,cAAc,GAAG,sBAAsB,CAYpF;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,GAAG,EAAE,MAAM,CAAC;IACZ,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAClC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,2EAA2E;IAC3E,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,gEAAgE;IAChE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAuDD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAC9B,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,aAAa,CAAC,CAiGxB"}

package/dist/hcl/edges.d.ts

@@ -14,7 +14,7 @@
  *
  * The `${...}` body is tokenized by hcl2json's own expression AST
  * (`getReferencesInExpression`), never by a regex over the string. That is the
- * same instrument `packages/core/src/terraform/parse.ts` uses for the carve-out
+ * same instrument `packages/core/src/terraform/hcl2json.ts` uses for the carve-out
  * advisor, and for the same reason: a quoted address used as a map key
  * (`var.m["aws_s3_bucket.assets.arn"]`) and an escaped `$${...}` literal are
  * not references, and no regex over the raw string can tell. `./references.ts`
@@ -85,7 +85,7 @@
  */
 import { type Declarable } from "@intentius/chant/declarable";
 import type { EntityReference } from "@intentius/chant/graph-ir";
-import { type Hcl2Json } from "@intentius/chant/terraform/parse";
+import { type Hcl2Json } from "@intentius/chant/terraform/hcl2json";
 import { type TerraformEntity } from "./parse.js";
 /**
  * Classify one AST traversal accessor. `var`/`local` are handled here because

package/dist/hcl/edges.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"edges.d.ts","sourceRoot":"","sources":["../../src/hcl/edges.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAA2C,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAkBxF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAItG;AAiED,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AA6CD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAChD,eAAe,EAAE,CA4BnB;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,IAAI,CAAC,CAuBf"}
+{"version":3,"file":"edges.d.ts","sourceRoot":"","sources":["../../src/hcl/edges.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAA2C,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAkBxF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAItG;AAiED,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AA6CD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAChD,eAAe,EAAE,CA4BnB;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,IAAI,CAAC,CAuBf"}

package/dist/hcl/parse.d.ts

@@ -17,7 +17,7 @@
  * core's exports map already carries (`"./*"` to `./src/*.ts`), so nothing
  * changed in `packages/core/package.json` for this.
  */
-import { type Hcl2Json } from "@intentius/chant/terraform/parse";
+import { type Hcl2Json } from "@intentius/chant/terraform/hcl2json";
 import { type Declarable } from "@intentius/chant/declarable";
 import type { EntityReference } from "@intentius/chant/graph-ir";
 import type { SuppressionDirective } from "@intentius/chant/lint/suppressions";
@@ -75,6 +75,13 @@ export interface TerraformEntity extends Declarable {
         readonly mode?: TerraformRootMode;
         /** The declared estate name. Present only when `mode` is `"live"`. */
         readonly estate?: string;
+        /**
+         * Whether `.terraform.lock.hcl` sits beside the root's `.tf` files (#3190,
+         * TF040). Stamped on every entity of a root parsed from a directory, and
+         * absent when the parse had no directory to look in (a fetched
+         * repository, inline source), which reads as "not determined".
+         */
+        readonly lockFile?: boolean;
         /** `terraform.roots.<name>.workspace`, recorded so TF025 can flag a non-default one on a live root. */
         readonly workspace?: string;
         /**
@@ -156,6 +163,21 @@ export declare const OUTPUT_TYPE = "Terraform::Output";
 export declare const LOCALS_TYPE = "Terraform::Locals";
 /** A `live { estate = "..." }` block, or an `estate.chdf.hcl` sidecar's content (#2103). */
 export declare const LIVE_TYPE = "Terraform::Live";
+/**
+ * Terragrunt config entities (#3417). A `terragrunt.hcl` or `root.hcl` is not
+ * a Terraform module, so its blocks are read into these types and never into
+ * `TERRAFORM_TYPE`: TF001's `required_version` check and the rest of the
+ * module rules keep to the `.tf` files.
+ */
+export declare const TERRAGRUNT_CONFIG_TYPE = "Terraform::TerragruntConfig";
+export declare const TERRAGRUNT_SOURCE_TYPE = "Terraform::TerragruntSource";
+export declare const TERRAGRUNT_DEPENDENCY_TYPE = "Terraform::TerragruntDependency";
+export declare const TERRAGRUNT_REMOTE_STATE_TYPE = "Terraform::TerragruntRemoteState";
+export declare const TERRAGRUNT_GENERATE_TYPE = "Terraform::TerragruntGenerate";
+/** The Terragrunt config files read, by their default names. A `--config` rename is not followed. */
+export declare const TERRAGRUNT_FILENAMES: readonly string[];
+/** Whether `name` (a bare filename) is a Terragrunt config file this lexicon reads. */
+export declare function isTerragruntFileName(name: string): boolean;
 /** The sidecar filename choudoufu reads an estate declaration from when no in-block `live { }` is used. */
 export declare const LIVE_SIDECAR_FILENAME = "estate.chdf.hcl";
 /**
@@ -186,6 +208,8 @@ export interface TerraformFile {
 export declare function splitBundleContent(content: string, fallbackName?: string): TerraformFile[];
 /** Every `.tf` directly under `dir`, in filename order. Non-recursive. */
 export declare function listTerraformFiles(dir: string): string[];
+/** The Terragrunt config files directly under `dir` (`root.hcl`, `terragrunt.hcl`), in filename order like the audit's bundle. */
+export declare function listTerragruntFiles(dir: string): string[];
 /**
  * Read the `estate.chdf.hcl` sidecar beside `dir`'s `.tf` files, if present.
  * Sibling to {@link listTerraformFiles}: the sidecar is plain HCL (a bare
@@ -214,7 +238,11 @@ export interface TerraformRootModeOptions {
      * declaration silently overrides.
      */
     configEstate?: string;
+    /** Stamp `props.lockFile` on every entity (#3190). Set by the two directory-backed parses only. */
+    lockFile?: boolean;
 }
+/** The lock file `terraform init` writes beside a root's `.tf` files. */
+export declare const LOCK_FILENAME = ".terraform.lock.hcl";
 /**
  * Parse a set of files into entities keyed `<root>/<address>`. Two blocks that
  * genuinely share an address (two `locals` blocks, or the same address in two

package/dist/hcl/parse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/hcl/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,gEAAgE;AAChE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,UAAU,CAAC;AAEtD,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,kFAAkF;QAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,qFAAqF;QACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,6DAA6D;QAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,kDAAkD;QAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;;;;;;;WAYG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC;;;;;;;WAOG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;QAClC,sEAAsE;QACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,uGAAuG;QACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;WAKG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;QACtC;;;;;;WAMG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC;KACzC,CAAC;IACF;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACjD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACzD;AAED,mCAAmC;AACnC,eAAO,MAAM,cAAc,yBAAyB,CAAC;AACrD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,4FAA4F;AAC5F,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAE3C,2GAA2G;AAC3G,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AASvD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC3J,MAAM,GAAE,MAAW,EACnB,IAAI,CAAC,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC7C,eAAe,CAyBjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,SAAY,GAAG,aAAa,EAAE,CAiB7F;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAI1E;AAsBD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CA8GlC;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAUlC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAElC;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAInD;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlD"}
+{"version":3,"file":"parse.d.ts","sourceRoot":"","sources":["../../src/hcl/parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGrD,gEAAgE;AAChE,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhD;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,UAAU,CAAC;AAEtD,0EAA0E;AAC1E,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjD,8EAA8E;AAC9E,MAAM,WAAW,eAAgB,SAAQ,UAAU;IACjD,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE;QACd,kFAAkF;QAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,qFAAqF;QACrF,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;QACzB,6DAA6D;QAC7D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,kDAAkD;QAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB;;;;;;;;;;;;WAYG;QACH,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACrC;;;;;;;WAOG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC;QAClC,sEAAsE;QACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB;;;;;WAKG;QACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAC5B,uGAAuG;QACvG,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B;;;;;WAKG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;QACtC;;;;;;WAMG;QACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB;;;;;;;;;;WAUG;QACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB;;;;WAIG;QACH,QAAQ,CAAC,SAAS,CAAC,EAAE,kBAAkB,CAAC;KACzC,CAAC;IACF;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IACjD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;CACzD;AAED,mCAAmC;AACnC,eAAO,MAAM,cAAc,yBAAyB,CAAC;AACrD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAC3C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,aAAa,wBAAwB,CAAC;AACnD,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,4FAA4F;AAC5F,eAAO,MAAM,SAAS,oBAAoB,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,sBAAsB,gCAAgC,CAAC;AACpE,eAAO,MAAM,0BAA0B,oCAAoC,CAAC;AAC5E,eAAO,MAAM,4BAA4B,qCAAqC,CAAC;AAC/E,eAAO,MAAM,wBAAwB,kCAAkC,CAAC;AAExE,qGAAqG;AACrG,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EAAmC,CAAC;AAEtF,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,2GAA2G;AAC3G,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AASvD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,EACf,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAC3J,MAAM,GAAE,MAAW,EACnB,IAAI,CAAC,EAAE,MAAM,EACb,YAAY,CAAC,EAAE,SAAS,oBAAoB,EAAE,GAC7C,eAAe,CAyBjB;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAKD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,SAAY,GAAG,aAAa,EAAE,CAiB7F;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxD;AAED,kIAAkI;AAClI,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEzD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAI1E;AAsBD;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,oGAAoG;IACpG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qFAAqF;IACrF,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,yEAAyE;AACzE,eAAO,MAAM,aAAa,wBAAwB,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,SAAS,aAAa,EAAE,EAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,CAAC,EAAE,aAAa,EACvB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CA8HlC;AA8BD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,EACtC,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAclC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,QAAQ,EACnB,WAAW,CAAC,EAAE,wBAAwB,GACrC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAElC;AAED,2EAA2E;AAC3E,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAInD;AAED;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG9C;AAED,kGAAkG;AAClG,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGlD"}

package/dist/hcl/roots.d.ts

@@ -26,7 +26,7 @@
  * that has not been read yet.
  */
 import { type Declarable } from "@intentius/chant/declarable";
-import type { Hcl2Json } from "@intentius/chant/terraform/parse";
+import type { Hcl2Json } from "@intentius/chant/terraform/hcl2json";
 import type { TerraformRootConfig } from "../config.js";
 import { type CallModuleType } from "./descend.js";
 export interface TerraformRootsResult {

package/dist/hcl/roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roots.d.ts","sourceRoot":"","sources":["../../src/hcl/roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAyC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAGvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAiE/B"}
+{"version":3,"file":"roots.d.ts","sourceRoot":"","sources":["../../src/hcl/roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAyC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAGvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAiE/B"}

package/dist/hcl/suppressions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/hcl/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAkB,MAAM,oCAAoC,CAAC;AA0E/F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAClD,kHAAkH;IAClH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CA8D3E;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,oBAAoB,EAAE,CAAA;CAAE,CAKvH"}
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/hcl/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAkB,MAAM,oCAAoC,CAAC;AAgF/F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAClD,kHAAkH;IAClH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CA8D3E;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,oBAAoB,EAAE,CAAA;CAAE,CAKvH"}

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 export { terraformPlugin } from "./plugin.js";
+export { terraformCapabilityPlugin, terraformApplyCapability, TERRAFORM_VERB_FAMILIES, type TerraformApplyStepInput, type TerraformApplyStepOutput, } from "./components/capability-plugin.js";
 export { terraformSerializer } from "./serializer.js";
 export { terraformConfigSchema, terraformRootSchema, type TerraformConfig, type TerraformRootConfig, type TerraformConfigNamespace, } from "./config.js";
 export { blocksToEntities, parseTerraformRootContent, parseTerraformRootDir, readLiveSidecarFile, splitBundleContent, terraformEntity, DATA_TYPE, LIVE_SIDECAR_FILENAME, LIVE_TYPE, LOCALS_TYPE, MODULE_TYPE, OUTPUT_TYPE, PROVIDER_TYPE, RESOURCE_TYPE, TERRAFORM_TYPE, VARIABLE_TYPE, type BlockBody, type TerraformEntity, type TerraformFile, type TerraformRootMode, type TerraformRootModeOptions, } from "./hcl/parse.js";
 export { renderTerraformRoots, type TerraformRootsResult } from "./hcl/roots.js";
-export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, } from "./op/builders.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformPinRollout, } from "./op/builders.js";
 export { parseAdoptionCommands, readAdoptionLedger, renderAdoptionLedger, type AdoptionCandidate, type AdoptionLedger, type AdoptionMatch, } from "./op/adoption.js";
 export { TerraformApplyOp } from "./composites/terraform-apply-op.js";
 export type { TerraformApplyOpConfig, TerraformApplyOpResources, TerraformGateMode, } from "./composites/terraform-apply-op.js";
@@ -11,6 +12,8 @@ export { TerraformWatchOp } from "./composites/terraform-watch-op.js";
 export type { TerraformWatchOpConfig, TerraformWatchOpResources, TerraformFindingMode, } from "./composites/terraform-watch-op.js";
 export { TerraformAdoptOp } from "./composites/terraform-adopt-op.js";
 export type { TerraformAdoptOpConfig, TerraformAdoptOpResources } from "./composites/terraform-adopt-op.js";
+export { TerraformPinRolloutOp } from "./composites/terraform-pin-rollout-op.js";
+export type { TerraformPinRolloutOpConfig, TerraformPinRolloutOpResources } from "./composites/terraform-pin-rollout-op.js";
 export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
 export { predictTerraformBehaviour, terraformBehaviourRequest, terraformPredictOptionsFrom, TERRAFORM_REFERENCE_CATALOG, type TerraformBehaviourDeps, type TerraformBehaviourEntity, type TerraformBehaviourRequest, type TerraformBehaviourRequestOptions, type TerraformLiveRead, type TerraformPredictOptions, } from "./behaviour/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAKzG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAQnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAM3C,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAIzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,YAAY,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAKzH,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAQnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}

package/dist/integrity.json

@@ -1,16 +1,17 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d7619e357f8ddb66f17dd8331e2f4024d6a5b9d5e2bbf9fb1434d90eae5000a3",
+    "manifest.json": "bd1768b086e8eb1954c8d060a1aa3907c5696587083eca7934f8767f9f6c3b1d",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
     "rules/blocks.ts": "d69f65c13b44ff425ccd465644f41c160e07b4c221bd60698d3ec84bf5d9cef8",
     "rules/flat-attributes.ts": "135b4b118cb76ea7ef7a6f2851bb5c80d0907485b86a364c017f66388d0d4cb2",
-    "rules/module-source.ts": "147025cf53eba006473ddcb771bf7452928fc476e6daee10bbb86bcc7ee3848a",
+    "rules/module-source.ts": "9e6e8f47725c3a01ee8b65b7acff6fe902bf5fc638820efdb5721f4c6ea9d95c",
     "rules/scope.ts": "a6d327d821f219c98a9d4ae6e6eed6325f3d3edf6286f3622b41be591d190dc8",
+    "rules/terragrunt.ts": "1973dbee0933db9593347aa662c71b86f02302c19a28f5ecba23a694ca96641b",
     "rules/tf001.ts": "1f07f0f9172a7ddb9c726ba4be1bea08e54e25701fbe59cc54c3cf4401aca999",
-    "rules/tf002.ts": "27720fcb578cceb1bfff86849d46b0309276f5a88d092eddcb7d7b961d1f5cd8",
+    "rules/tf002.ts": "6759fe5135c85ed9016adbddd90e77743cdf243b261a98deb38e907da83c6d25",
     "rules/tf003.ts": "7b705a08f03769f353910e524bb3f1b4cc844bcb620e240a9063288d0fd60802",
     "rules/tf004.ts": "59ef2108aa561cc6a40cd970fc54604be60872b51a035ed3bc3c53346a31d358",
     "rules/tf005.ts": "17fbaf5ac205c8a768415eacd2cbfb7749e9a251c8f2d0c05dce7462db7fa821",
@@ -45,7 +46,15 @@
     "rules/tf035.ts": "2514b58731114a29c1a447a173d138c7e442ecb2a180da49929e1899ac6fd188",
     "rules/tf036.ts": "94fd91568341b6868ecd090772b93e675d2084547ae919586a496b9cb8a8f47b",
     "rules/tf037.ts": "d6fc1e8ab4478f7983f28c6679f56a3fcfe5f6a5fb2402981bbca98114b486bf",
+    "rules/tf038.ts": "8fc9549ce978509d4bd7e1d9f0835582e1fc851ba473501f56dfd176718b7590",
+    "rules/tf039.ts": "a1586874db83368230955feb6ce001653a2187e910a20ed3d76ff05feb36ce4f",
+    "rules/tf040.ts": "25fabeca489750075ed543d55dc86dd9950f3849e4c17b7073c7875bbb59ef0d",
+    "rules/tf041.ts": "9d78f6e0b0b90473cf88aa359a84110656ef1c72e5717184044e8c0bf4621bbb",
+    "rules/tf042.ts": "a7cf97666b1cd640aa77db26ed73a27db6669f52c3b681d89aa91c04a9955f83",
+    "rules/tf043.ts": "c8724a7c0734870101d73e411ed97240c03a01a1133adbf0b445a5083f40faee",
+    "rules/tf044.ts": "4e9b17a6080074d2b2e02862a9f1c9c2baf0ef32d4f3b48df1e62d9d8c362008",
+    "rules/tf045.ts": "760b1f4f385fbe7a86897efe3078fdeac11bcc9bfb806285d63db50488174b7b",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "5cedcb8fdfd0bee9e59a770470ef1207999c624e87595866029b40b70ad8c96b"
+  "composite": "f25f33ea4418249a62b9cbb031d3334ff6eaa36ae60090593a9fa1a394047e09"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AA+D1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA8Y1D,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AA+D1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAge1D,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAsCvE,eAAO,MAAM,eAAe,EAAE,cAAc,EAqC3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA8CvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA6C3C,CAAC"}

package/dist/lint/post-synth/module-source.d.ts

@@ -18,12 +18,25 @@
  * recognize, scp-style `git@host:path` addresses, and any source ending in
  * `.git`. `local` is `./` or `../` (checkov's `UNKNOWN` case for module
  * pinning: a local path cannot be pinned to anything and is never flagged).
+ * `oci` is an OpenTofu `oci://host/repo` source (#3190). OpenTofu selects a
+ * version with `?tag=` or `?digest=` (https://opentofu.org/docs/language/modules/sources/),
+ * and a source naming neither resolves the `latest` tag. The container-image
+ * shapes `repo:tag` and `repo@sha256:...` are read too, so a source written
+ * the way `docker pull` spells it is not misread as unpinned. A `:` inside the
+ * host (a registry port) is never a tag: only a colon in the last path
+ * segment is. The tag and digest rules were checked against the docs page
+ * above; the suffix forms are not documented there and are not verified
+ * against OpenTofu's parser.
  */
-export type ModuleSourceKind = "local" | "registry" | "git" | "other";
+export type ModuleSourceKind = "local" | "registry" | "git" | "oci" | "other";
 export interface ModuleSourceClassification {
     kind: ModuleSourceKind;
     /** The `?ref=`/`&ref=` value (falling back to `rev`), when `kind` is `"git"`. */
     ref?: string;
+    /** The tag an `oci://` source names, from `?tag=` or a `:tag` suffix on the repository. */
+    tag?: string;
+    /** The digest an `oci://` source names, from `?digest=` or an `@sha256:...` suffix. */
+    digest?: string;
 }
 export declare function classifyModuleSource(source: string): ModuleSourceClassification;
 /**
@@ -35,4 +48,17 @@ export declare function classifyModuleSource(source: string): ModuleSourceClassi
 export declare function isPinnedRef(ref: string): boolean;
 /** Is `ref` one of the well-known mutable branch names tflint's `flexible` style rejects, plus `trunk`. */
 export declare function isDefaultBranch(ref: string): boolean;
+/**
+ * Is `tag` a name that conventionally moves (`latest`, a branch-like name)
+ * rather than an exact version. Used by TF038. A tag is a mutable pointer in
+ * most registries whatever it looks like, so the rule is a warning and this
+ * only decides what reads as obviously floating.
+ */
+export declare function isMutableOciTag(tag: string): boolean;
+/**
+ * Is a registry `version` constraint an exact version (`1.4.0`, `= 1.4.0`,
+ * `=1.4.0`) rather than a range (`~> 1.4`, `>= 1.4`, `>= 1.0, < 2.0`). Used
+ * by TF039. A bare version is an exact constraint in Terraform.
+ */
+export declare function isExactVersionConstraint(version: string): boolean;
 //# sourceMappingURL=module-source.d.ts.map

package/dist/lint/post-synth/module-source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-source.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/module-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,GAAG,OAAO,CAAC;AAEtE,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAmDD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,0BAA0B,CAsB/E;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD"}
+{"version":3,"file":"module-source.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/module-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO,CAAC;AAE9E,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,iFAAiF;IACjF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2FAA2F;IAC3F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uFAAuF;IACvF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAsED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,0BAA0B,CAwB/E;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEjE"}