@intentius/chant-lexicon-terraform 0.124.31 → 0.124.33

package/dist/serializer.js

@@ -0,0 +1,23 @@
+/**
+ * terraform serializer.
+ *
+ * A stub, deliberately. The entities this lexicon carries come from `.tf`
+ * files that already exist on disk (`buildRoots()` parses the roots named in
+ * `terraform.roots`), so there is nothing for chant to write back: emitting
+ * HCL here would put a second, generated copy of the estate beside the
+ * authored one. The lexicon's value is what the entities let the rest of
+ * chant do with the root (post-synth checks, `chant audit`, the Op surface),
+ * not a rendered artifact.
+ *
+ * `name` and `rulePrefix` are the two members the `Serializer` contract
+ * requires, and both are load-bearing: `name` is the key `build()` files this
+ * lexicon's output under, and `rulePrefix` is what every `TF*` id is checked
+ * against.
+ */
+export const terraformSerializer = {
+    name: "terraform",
+    rulePrefix: "TF",
+    serialize(_entities) {
+        return "";
+    },
+};

package/dist/state-ownership.js

@@ -0,0 +1,29 @@
+/**
+ * Terraform's ownership channel (#2087): the state file.
+ *
+ * Its own module, and a tiny one, for the same reason cedar's
+ * `src/avp/ownership.ts` is: `plugin.ts` declares `ownershipChannel` eagerly
+ * while `describeResources` is behind a dynamic import, so the keys cannot
+ * live in the reader without dragging the reader (and `node:child_process`
+ * with it) into every plugin load.
+ *
+ * The design record is the module doc of `./describe-resources.ts` and the
+ * reader-facing version is `docs/pages/observation.mdx`. The short form:
+ * chant elsewhere answers "is this mine?" from a marker it stamped onto the
+ * live resource; terraform answers it from the state file, which already
+ * records exactly which addresses a configuration manages. Nothing is ever
+ * stamped, so nothing is ever written back over an estate's own tags.
+ */
+/**
+ * Where the verdict is read from, rather than what is written.
+ *
+ * {@link ChannelKeys} names tag or label keys everywhere else, because
+ * everywhere else the marker is a key/value pair on the resource. These three
+ * name the state file, the configured root that owns that state, and the
+ * workspace the root selects.
+ */
+export const TERRAFORM_STATE_OWNERSHIP_KEYS = {
+    managedBy: "terraform.state",
+    stack: "terraform.root",
+    env: "terraform.workspace",
+};

package/dist/terragrunt/affected.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"affected.d.ts","sourceRoot":"","sources":["../../src/terragrunt/affected.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAAqE,KAAK,qBAAqB,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7I,OAAO,EAAmE,KAAK,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAGnH,8BAA8B;AAC9B,MAAM,MAAM,sBAAsB;AAChC,2CAA2C;AACzC,YAAY;AACd,uHAAuH;GACrH,SAAS;AACX,uFAAuF;GACrF,aAAa;AACf,mEAAmE;GACjE,aAAa;AACf,0EAA0E;GACxE,gBAAgB,CAAC;AAErB,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,8HAA8H;IAC9H,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4GAA4G;IAC5G,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,8IAA8I;IAC9I,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,mEAAmE;IACnE,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,mHAAmH;IACnH,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAQD,8GAA8G;AAC9G,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,GAAG,MAAM,EAAE,CAYrH;AAED,6FAA6F;AAC7F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAE7F;AAED,mJAAmJ;AACnJ,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAOnE;AAED,oGAAoG;AACpG,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAoB5G;AAkCD,4FAA4F;AAC5F,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB9D;AAQD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CA6ErF;AAED,sDAAsD;AACtD,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAczF;AAED,MAAM,WAAW,6BAA8B,SAAQ,oBAAoB,EAAE,qBAAqB;IAChG,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qGAAqG;AACrG,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuBhH"}
+{"version":3,"file":"affected.d.ts","sourceRoot":"","sources":["../../src/terragrunt/affected.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAAqE,KAAK,qBAAqB,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7I,OAAO,EAAmE,KAAK,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAGnH,8BAA8B;AAC9B,MAAM,MAAM,sBAAsB;AAChC,2CAA2C;AACzC,YAAY;AACd,uHAAuH;GACrH,SAAS;AACX,uFAAuF;GACrF,aAAa;AACf,mEAAmE;GACjE,aAAa;AACf,0EAA0E;GACxE,gBAAgB,CAAC;AAErB,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,8HAA8H;IAC9H,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4GAA4G;IAC5G,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,8IAA8I;IAC9I,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,mEAAmE;IACnE,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,mHAAmH;IACnH,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAQD,8GAA8G;AAC9G,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,GAAG,MAAM,EAAE,CAYrH;AAED,6FAA6F;AAC7F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAE7F;AAED,mJAAmJ;AACnJ,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAOnE;AAED,oGAAoG;AACpG,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAoB5G;AAmCD,4FAA4F;AAC5F,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB9D;AAQD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CA6ErF;AAED,sDAAsD;AACtD,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAczF;AAED,MAAM,WAAW,6BAA8B,SAAQ,oBAAoB,EAAE,qBAAqB;IAChG,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qGAAqG;AACrG,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuBhH"}

package/dist/terragrunt/affected.js

@@ -0,0 +1,290 @@
+/**
+ * Affected Terragrunt units for a git range (#3415): what Terragrunt's own
+ * git filter selects, plus three cases it misses, each unit with its reasons.
+ *
+ * Terragrunt's `[base...head]` filter is the starting point, so the selection
+ * matches what `run --all` with that filter would run. Terragrunt 1.1.6 and
+ * 1.2.0-rc1 both miss these (observed on `../__fixtures__/terragrunt/affected`):
+ *
+ * - `module-file`: a file under a unit's local module directory that is not a
+ *   configuration file, such as one the module reads with `file()`. A unit's
+ *   module directory is where the `.tf` and `.tofu` files in its `reading`
+ *   list live, so an interpolated `terraform.source` resolves the way
+ *   Terragrunt resolved it. A file Terragrunt lists in `reading` is its own
+ *   to track and is not counted here.
+ * - `module-call`: a file under a local module that the unit's module calls,
+ *   followed through modules that call modules with the same reader
+ *   `../changed-roots.ts` uses for plain roots.
+ * - `stack-template`: a file under a stack's local unit template selects the
+ *   units generated from it. A stack template (a `stack` block) selects every
+ *   unit generated under it.
+ *
+ * Dependents of the selected units are the caller's to add (`terragruntDependents`).
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, posix, relative, resolve, sep } from "node:path";
+import { rootWatchPaths } from "../changed-roots.js";
+import { excludeFilter, parseTerragruntFind, TERRAGRUNT_DISCOVERY_EXCLUDES } from "./units.js";
+import { defaultTerragruntExec, discoverTerragruntUnits, TerragruntError } from "./run.js";
+import { terragruntEnv } from "./wave.js";
+const KIND_ORDER = ["terragrunt", "removed", "module-file", "module-call", "stack-template"];
+const CONFIG_EXT = /\.(tf|tofu)(\.json)?$/;
+const toPosix = (p) => p.split(sep).join("/");
+const clean = (p) => posix.normalize(toPosix(p)).replace(/^\.\//, "").replace(/\/+$/, "");
+const under = (dir, file) => dir === "." || file === dir || file.startsWith(`${dir}/`);
+/** Arguments to `terragrunt find` for the units Terragrunt's git filter selects between `base` and `head`. */
+export function terragruntAffectedFindArgs(options) {
+    const excludes = [...TERRAGRUNT_DISCOVERY_EXCLUDES, ...(options.exclude ?? [])];
+    return [
+        "find",
+        "--json",
+        "--no-color",
+        // A filters file is unioned with --filter, so it would add every unit it names to the range.
+        "--no-filters-file",
+        "--filter",
+        `[${options.base}...${options.head ?? "HEAD"}]`,
+        ...excludes.flatMap((g) => ["--filter", excludeFilter(g)]),
+    ];
+}
+/** Arguments to `git` for the files the range changed, relative to the project directory. */
+export function terragruntAffectedDiffArgs(options) {
+    return ["diff", "--name-only", "--no-renames", "--relative", `${options.base}...${options.head ?? "HEAD"}`];
+}
+/** The unit's local module directories: where the `.tf` and `.tofu` files Terragrunt reports it reading live, outside the unit's own directory. */
+export function terragruntModuleDirs(unit) {
+    const dirs = new Set();
+    for (const f of unit.reading ?? []) {
+        if (!CONFIG_EXT.test(f) || under(unit.path, f) || f.includes(".terragrunt-cache/"))
+            continue;
+        dirs.add(posix.dirname(f));
+    }
+    return [...dirs].sort();
+}
+/**
+ * The `unit` and `stack` blocks of a stack file at `stackFile` (relative to
+ * `dir`). Sources that are relative paths or start with `${get_terragrunt_dir()}`
+ * are local; anything else (git, registry, other functions) is left without a
+ * template, since its version lives in the stack file and a change to it is
+ * Terragrunt's to see.
+ */
+export function readTerragruntStackFile(dir, stackFile, text) {
+    const stackDir = posix.dirname(clean(stackFile));
+    const blocks = [];
+    const head = /\b(unit|stack)\s+"([^"]+)"\s*\{/g;
+    for (let m = head.exec(text); m; m = head.exec(text)) {
+        const body = blockBody(text, head.lastIndex);
+        const source = topLevelString(body, "source");
+        const path = topLevelString(body, "path");
+        if (path === undefined)
+            continue;
+        const noDot = /^\s*no_dot_terragrunt_stack\s*=\s*true\b/m.test(body);
+        const base = noDot ? stackDir : posix.join(stackDir, ".terragrunt-stack");
+        const generated = clean(posix.join(base, path));
+        let template;
+        if (source !== undefined) {
+            const local = source.replace(/^\$\{get_terragrunt_dir\(\)\}\//, "./");
+            if (/^\.{1,2}\//.test(local))
+                template = clean(toPosix(relative(dir, resolve(dir, stackDir, local.replace("//", "/")))));
+        }
+        blocks.push({ type: m[1], name: m[2], generated, ...(template !== undefined ? { template } : {}) });
+    }
+    return blocks;
+}
+/** The text between the brace before `start` and its matching close, skipping strings and comments. */
+function blockBody(text, start) {
+    let depth = 1;
+    for (let i = start; i < text.length; i++) {
+        const c = text[i];
+        if (c === '"') {
+            for (i++; i < text.length && text[i] !== '"'; i++)
+                if (text[i] === "\\")
+                    i++;
+        }
+        else if (c === "#" || (c === "/" && text[i + 1] === "/")) {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+        }
+        else if (c === "{")
+            depth++;
+        else if (c === "}" && --depth === 0)
+            return text.slice(start, i);
+    }
+    return text.slice(start);
+}
+/** A string attribute of a block body at nesting depth zero (`path = "web"`, not one inside `values = { ... }`). */
+function topLevelString(body, name) {
+    const attr = new RegExp(`^\\s*${name}\\s*=\\s*"([^"]*)"`);
+    let depth = 0;
+    for (const line of body.split("\n")) {
+        if (depth === 0) {
+            const m = attr.exec(line);
+            if (m)
+                return m[1];
+        }
+        const code = line.replace(/"(?:[^"\\]|\\.)*"/g, '""');
+        depth += (code.match(/[{[]/g) ?? []).length - (code.match(/[}\]]/g) ?? []).length;
+    }
+    return undefined;
+}
+// `.chant` holds work worktrees in `.chant/work`, each a copy of the checkout (chant#2893).
+const SKIP_DIRS = new Set([".git", ".terragrunt-cache", "node_modules", ".terraform", ".chant"]);
+/** Every `terragrunt.stack.hcl` under `dir`, generated ones included, relative to `dir`. */
+export function findTerragruntStackFiles(dir) {
+    const out = [];
+    const walk = (rel) => {
+        let entries;
+        try {
+            entries = readdirSync(join(dir, rel), { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const p = rel ? `${rel}/${e.name}` : e.name;
+            if (e.isDirectory() && !SKIP_DIRS.has(e.name))
+                walk(p);
+            else if (e.isFile() && e.name === "terragrunt.stack.hcl")
+                out.push(p);
+        }
+    };
+    walk("");
+    return out.sort();
+}
+/** The stack file a generated unit came from: the one beside the `.terragrunt-stack` it sits in. */
+function generatingStackFile(unitPath) {
+    const i = unitPath.lastIndexOf("/.terragrunt-stack/");
+    return i < 0 ? undefined : `${unitPath.slice(0, i)}/terragrunt.stack.hcl`;
+}
+/**
+ * The affected units: what Terragrunt selected, each with the changed files
+ * that explain it, plus the three supplements. A unit Terragrunt selected
+ * that discovery does not list is `removed` when its `terragrunt.hcl` is gone,
+ * and otherwise left out with a note (discovery excluded it).
+ */
+export function terragruntAffected(input) {
+    const changed = [...new Set(input.changedFiles.map(clean))].sort();
+    const byPath = new Map(input.units.map((u) => [u.path, u]));
+    const reasons = new Map();
+    const notes = [];
+    const add = (path, reason) => {
+        const list = reasons.get(path) ?? [];
+        list.push(reason);
+        reasons.set(path, list);
+    };
+    for (const raw of new Set(input.terragruntSelected.map(clean))) {
+        const unit = byPath.get(raw);
+        if (!unit) {
+            if (existsSync(join(input.dir, raw, "terragrunt.hcl"))) {
+                notes.push(`${raw}: Terragrunt's git range selected it, but discovery left it out, so it is not affected here`);
+            }
+            else {
+                add(raw, { kind: "removed", files: changed.filter((f) => under(raw, f)) });
+            }
+            continue;
+        }
+        const tracked = new Set([...(unit.reading ?? []), ...Object.values(unit.include ?? {}), generatingStackFile(unit.path)].filter((f) => !!f));
+        add(raw, { kind: "terragrunt", files: changed.filter((f) => under(unit.path, f) || tracked.has(f)) });
+    }
+    for (const unit of input.units) {
+        const reading = new Set(unit.reading ?? []);
+        const moduleDirs = terragruntModuleDirs(unit);
+        const called = new Map();
+        for (const m of moduleDirs) {
+            for (const d of rootWatchPaths(input.dir, { dir: m }))
+                if (!moduleDirs.includes(d) && !called.has(d))
+                    called.set(d, m);
+        }
+        const viaFile = new Map();
+        const viaCall = new Map();
+        for (const f of changed) {
+            if (reading.has(f))
+                continue;
+            const call = [...called.keys()].filter((d) => under(d, f)).sort((a, b) => b.length - a.length)[0];
+            if (call !== undefined) {
+                viaCall.set(call, [...(viaCall.get(call) ?? []), f]);
+                continue;
+            }
+            const own = moduleDirs.filter((d) => under(d, f)).sort((a, b) => b.length - a.length)[0];
+            if (own !== undefined)
+                viaFile.set(own, [...(viaFile.get(own) ?? []), f]);
+        }
+        for (const [via, files] of viaFile)
+            add(unit.path, { kind: "module-file", files, via });
+        for (const [via, files] of viaCall)
+            add(unit.path, { kind: "module-call", files, via });
+    }
+    for (const stackFile of findTerragruntStackFiles(input.dir)) {
+        let text;
+        try {
+            text = readFileSync(join(input.dir, stackFile), "utf8");
+        }
+        catch {
+            continue;
+        }
+        for (const block of readTerragruntStackFile(input.dir, stackFile, text)) {
+            if (block.template === undefined)
+                continue;
+            const files = changed.filter((f) => under(block.template, f));
+            if (files.length === 0)
+                continue;
+            const targets = block.type === "unit" ? (byPath.has(block.generated) ? [block.generated] : []) : input.units.filter((u) => under(block.generated, u.path)).map((u) => u.path);
+            if (targets.length === 0) {
+                notes.push(`${block.generated}: generated by ${block.type} "${block.name}" in ${stackFile} from the changed template ${block.template}, ` +
+                    "but discovery did not list it; run `terragrunt stack generate` before discovery");
+            }
+            for (const t of targets)
+                add(t, { kind: "stack-template", files, via: block.template });
+        }
+    }
+    const units = [...reasons.entries()]
+        .map(([path, list]) => ({
+        path,
+        reasons: list.sort((a, b) => KIND_ORDER.indexOf(a.kind) - KIND_ORDER.indexOf(b.kind) || (a.via ?? "").localeCompare(b.via ?? "")),
+    }))
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    return { units, notes: [...new Set(notes)].sort() };
+}
+/** One line per reason, for a report or a job log. */
+export function describeTerragruntAffectedReason(reason) {
+    const files = reason.files.join(", ");
+    switch (reason.kind) {
+        case "terragrunt":
+            return files ? `Terragrunt's git range selected it (${files})` : "Terragrunt's git range selected it";
+        case "removed":
+            return "removed in the range; Terragrunt plans its destroy";
+        case "module-file":
+            return `${files} changed under its module ${reason.via}, which Terragrunt does not track`;
+        case "module-call":
+            return `${files} changed under ${reason.via}, a module its module calls`;
+        case "stack-template":
+            return `${files} changed under ${reason.via}, the stack template it is generated from`;
+    }
+}
+/** Run git and Terragrunt's git filter in `dir` and return the affected units with their reasons. */
+export async function findTerragruntAffected(options) {
+    const exec = options.exec ?? defaultTerragruntExec;
+    const tg = options.terragrunt ?? "terragrunt";
+    const git = options.git ?? "git";
+    const diffArgs = terragruntAffectedDiffArgs(options);
+    const diff = await exec(git, diffArgs, { cwd: options.dir, env: {} });
+    if (diff.code !== 0)
+        throw new TerragruntError(`\`${git} ${diffArgs.join(" ")}\` failed (exit ${diff.code}): ${diff.stderr.trim()}`);
+    const findArgs = terragruntAffectedFindArgs(options);
+    const found = await exec(tg, findArgs, { cwd: options.dir, env: terragruntEnv(options.binary) });
+    if (found.code !== 0)
+        throw new TerragruntError(`\`${tg} ${findArgs.join(" ")}\` failed (exit ${found.code}): ${found.stderr.trim()}`);
+    let selected;
+    try {
+        selected = parseTerragruntFind(found.stdout).map((u) => u.path);
+    }
+    catch (err) {
+        throw new TerragruntError(`could not read \`terragrunt find\` output: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const units = options.units ?? (await discoverTerragruntUnits(options)).units;
+    return terragruntAffected({
+        dir: options.dir,
+        units,
+        terragruntSelected: selected,
+        changedFiles: diff.stdout.split("\n").map((l) => l.trim()).filter((l) => l !== ""),
+    });
+}

package/dist/terragrunt/index.js

@@ -0,0 +1,10 @@
+/**
+ * Terragrunt units as roots (#3414). `./units`, `./wave` and `./mocks` are pure and
+ * bundle without TypeScript; `./run` spawns `terragrunt`. `./affected` picks
+ * the units a git range touches (#3415).
+ */
+export * from "./units.js";
+export * from "./wave.js";
+export * from "./mocks.js";
+export * from "./run.js";
+export * from "./affected.js";

package/dist/terragrunt/mocks.js

@@ -0,0 +1,270 @@
+/**
+ * Mock outputs in Terragrunt waves (#3416): which plans of a wave would read
+ * a dependency's `mock_outputs`, and the provisional mark a preview carries.
+ *
+ * A plan built on `mock_outputs` looks like a real one: Terragrunt says so in
+ * one log line only, and the plan JSON holds the mock values as if they were
+ * the upstream's (observed on 1.1.6). Gruntwork closed mocks in saved plans
+ * as won't-fix (gruntwork-io/terragrunt#2178). So a wave is checked before it
+ * is planned, and a wave that would read a mock is refused: it is not gated,
+ * and the refusal names the upstream that must apply first.
+ *
+ * The rules follow Terragrunt's own (`pkg/config/dependency.go` at v1.1.6,
+ * `getTerragruntOutputIfAppliedElseConfiguredDefault` and
+ * `shouldReturnMockOutputs`). For one `dependency` block, read at `plan`:
+ *
+ * - `enabled = false` or `skip_outputs = true`: Terragrunt never reads the
+ *   upstream, so with `mock_outputs` set the unit always reads the mock.
+ * - The upstream has no outputs (`output -json` prints `{}`, as it does for
+ *   a unit never applied): Terragrunt returns `mock_outputs` when they are
+ *   set and allowed for `plan`, and fails otherwise. Either way the wave
+ *   cannot plan on real values yet.
+ * - The upstream has outputs and the block sets a merge strategy
+ *   (`mock_outputs_merge_strategy_with_state`, or the older
+ *   `mock_outputs_merge_with_state = true`): every mock key the real outputs
+ *   lack is filled from the mock. That is a partial mock, and it counts.
+ *
+ * The blocks come from `terragrunt render --json`, so includes, locals and
+ * expressions in `config_path` are Terragrunt's to evaluate, not chant's.
+ *
+ * A provisional plan is the other side: a dependent planned at PR time
+ * (`dependents: plan`), before its upstream applied. It may read mocks. Its
+ * change-set members carry `provisional: true`, which keeps it out of the
+ * change-set digest, out of any wave's set digest and out of every group of
+ * real plans, and its saved plans are never applied.
+ *
+ * Pure: nothing here spawns or reads files. `./run.ts` runs the commands.
+ */
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+/** `a/b/../c` to `a/c`, with `/` separators and no `./` or trailing `/`. An absolute path keeps its leading `/`. */
+function normalize(path) {
+    const p = path.replace(/\\/g, "/");
+    const out = [];
+    for (const seg of p.split("/")) {
+        if (seg === "" || seg === ".")
+            continue;
+        if (seg === ".." && out.length > 0 && out[out.length - 1] !== "..")
+            out.pop();
+        else
+            out.push(seg);
+    }
+    const s = out.join("/");
+    return p.startsWith("/") ? `/${s}` : s || ".";
+}
+const isAbsolute = (p) => p.startsWith("/") || /^[A-Za-z]:[\\/]/.test(p);
+/**
+ * The upstream a `config_path` names, relative to where Terragrunt runs. A
+ * relative path is taken from the unit's directory. An absolute one is made
+ * relative to the first of `dirs` it sits under (a directory and its real
+ * path, when a symlink leads to it), and kept absolute when it sits under
+ * none. A path to the upstream's `terragrunt.hcl` names its directory.
+ */
+export function upstreamOfConfigPath(unit, configPath, dirs) {
+    const p = configPath.replace(/\\/g, "/").replace(/(^|\/)terragrunt\.hcl$/, "");
+    if (!isAbsolute(p))
+        return normalize(`${unit}/${p}`);
+    const abs = normalize(p);
+    for (const dir of typeof dirs === "string" ? [dirs] : dirs) {
+        const root = normalize(dir);
+        if (abs === root)
+            return ".";
+        if (abs.startsWith(`${root}/`))
+            return abs.slice(root.length + 1);
+    }
+    return abs;
+}
+/**
+ * The `dependency` blocks of one unit, from `terragrunt render --json` run
+ * in it. `unit` is the unit's path relative to where Terragrunt runs (`dirs`).
+ * Throws when the output is not the rendered config.
+ */
+export function parseRenderedDependencies(unit, output, dirs) {
+    const doc = typeof output === "string" ? JSON.parse(output) : output;
+    if (!isObject(doc))
+        throw new Error("terragrunt render --json did not print an object");
+    const blocks = isObject(doc.dependency) ? doc.dependency : {};
+    const out = [];
+    for (const [label, raw] of Object.entries(blocks)) {
+        if (!isObject(raw) || typeof raw.config_path !== "string")
+            continue;
+        const allowed = Array.isArray(raw.mock_outputs_allowed_terraform_commands)
+            ? raw.mock_outputs_allowed_terraform_commands.filter((c) => typeof c === "string")
+            : undefined;
+        const strategy = typeof raw.mock_outputs_merge_strategy_with_state === "string"
+            ? raw.mock_outputs_merge_strategy_with_state
+            : raw.mock_outputs_merge_with_state === true
+                ? "shallow"
+                : undefined;
+        out.push({
+            name: typeof raw.name === "string" && raw.name ? raw.name : label,
+            upstream: upstreamOfConfigPath(unit, raw.config_path, dirs),
+            ...(isObject(raw.mock_outputs) ? { mockOutputs: raw.mock_outputs } : {}),
+            ...(allowed ? { mockAllowed: allowed } : {}),
+            ...(strategy && strategy !== "no_merge" ? { mergeStrategy: strategy } : {}),
+            // render prints skip_outputs under `skip`.
+            ...(raw.skip === true || raw.skip_outputs === true ? { skipOutputs: true } : {}),
+            ...(raw.enabled === false ? { disabled: true } : {}),
+        });
+    }
+    return out.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+/**
+ * The outputs `output -json` prints, by name, with their values. Undefined
+ * when the text holds no JSON object.
+ */
+export function parseTerragruntOutputs(output) {
+    const text = output.trim();
+    const start = text.indexOf("{");
+    if (start < 0)
+        return undefined;
+    let doc;
+    try {
+        doc = JSON.parse(text.slice(start));
+    }
+    catch {
+        return undefined;
+    }
+    if (!isObject(doc))
+        return undefined;
+    return Object.fromEntries(Object.entries(doc).map(([k, v]) => [k, isObject(v) && "value" in v ? v.value : v]));
+}
+/** Arguments to `terragrunt` that print one unit's outputs as JSON. */
+export function terragruntOutputArgs(unit) {
+    return ["run", "--working-dir", unit, "--non-interactive", "--no-color", "--", "output", "-json"];
+}
+/** Arguments to `terragrunt` that print one unit's evaluated configuration as JSON. */
+export function terragruntRenderArgs(unit) {
+    return ["render", "--json", "--non-interactive", "--no-color", "--working-dir", unit];
+}
+/** Mock paths the real outputs lack. `shallow` compares top-level keys; the deep strategies follow nested maps. */
+function missingKeys(mock, real, deep, prefix = "") {
+    const out = [];
+    for (const [k, v] of Object.entries(mock)) {
+        const path = prefix ? `${prefix}.${k}` : k;
+        if (!(k in real))
+            out.push(path);
+        else if (deep && isObject(v) && isObject(real[k]))
+            out.push(...missingKeys(v, real[k], deep, path));
+    }
+    return out.sort();
+}
+const allowsPlan = (d) => !d.mockAllowed || d.mockAllowed.length === 0 || d.mockAllowed.includes("plan");
+/**
+ * Every dependency of the wave's units that would read `mock_outputs` at
+ * plan, sorted by unit and dependency. Empty when the wave plans on real
+ * outputs only.
+ *
+ * An upstream with no outputs is listed whether or not the block sets
+ * mocks: without them Terragrunt fails the plan, and with them it plans on
+ * fake values. Both mean the upstream must apply first.
+ */
+export function terragruntMockReads(input) {
+    const out = [];
+    for (const [unit, deps] of input.dependencies) {
+        for (const d of deps) {
+            const at = { unit, dependency: d.name, upstream: d.upstream };
+            if (d.disabled || d.skipOutputs) {
+                if (d.mockOutputs)
+                    out.push({ ...at, reason: d.disabled ? "disabled" : "skip-outputs" });
+                continue;
+            }
+            const real = input.outputs.get(d.upstream) ?? {};
+            if (Object.keys(real).length === 0) {
+                out.push({ ...at, reason: "no-outputs" });
+                continue;
+            }
+            if (d.mockOutputs && d.mergeStrategy && allowsPlan(d)) {
+                const keys = missingKeys(d.mockOutputs, real, d.mergeStrategy !== "shallow");
+                if (keys.length > 0)
+                    out.push({ ...at, reason: "partial", keys });
+            }
+        }
+    }
+    return out.sort((a, b) => (a.unit < b.unit ? -1 : a.unit > b.unit ? 1 : a.dependency < b.dependency ? -1 : a.dependency > b.dependency ? 1 : 0));
+}
+/** The upstreams a wave's `dependency` blocks read outputs from, sorted. */
+export function terragruntOutputUpstreams(dependencies) {
+    const out = new Set();
+    for (const deps of dependencies.values())
+        for (const d of deps)
+            if (!d.disabled && !d.skipOutputs)
+                out.add(d.upstream);
+    return [...out].sort();
+}
+function readText(r) {
+    const at = `${r.unit} (dependency "${r.dependency}" on ${r.upstream})`;
+    switch (r.reason) {
+        case "no-outputs":
+            return `${at}: ${r.upstream} has no outputs yet; apply ${r.upstream} first`;
+        case "partial":
+            return `${at}: ${r.upstream}'s outputs lack ${r.keys.join(", ")}, which the merge strategy fills from mock_outputs; apply ${r.upstream} with those outputs first, or drop the merge strategy`;
+        case "skip-outputs":
+            return `${at}: skip_outputs = true with mock_outputs set always reads the mock; read the real outputs or drop mock_outputs`;
+        case "disabled":
+            return `${at}: enabled = false with mock_outputs set always reads the mock; enable the dependency or drop mock_outputs`;
+    }
+}
+/** The refusal for a wave whose plans would read mocks: each unit, the upstream, and what must happen first. */
+export function describeMockRefusal(reads) {
+    const upstreams = [...new Set(reads.filter((r) => r.reason === "no-outputs" || r.reason === "partial").map((r) => r.upstream))].sort();
+    const head = `this wave was not planned and is not gated: its plans would read mock_outputs, so nobody could approve them as real. ` +
+        (upstreams.length > 0 ? `Apply ${upstreams.join(", ")} first, then plan the wave again.` : `Fix the dependency blocks below, then plan the wave again.`);
+    return [head, ...reads.map((r) => `  ${readText(r)}`)].join("\n");
+}
+/**
+ * The line Terragrunt logs when it hands a unit `mock_outputs` because the
+ * upstream has no outputs (`dependency.go` at v1.1.6): "Config <upstream> is
+ * a dependency of <unit> that has no outputs, but mock outputs provided and
+ * returning those in dependency output."
+ */
+const MOCK_WARNING = /Config (\S+?) is a dependency of (\S+?) that has no outputs, but mock outputs provided/g;
+/**
+ * The units a plan log says read mocks, with the upstream each read,
+ * relative to where Terragrunt ran (`dirs`, as for
+ * {@link upstreamOfConfigPath}). This is the check after the fact: the check
+ * before planning ({@link terragruntMockReads}) is what refuses a wave, and
+ * this catches an upstream whose state went away in between.
+ */
+export function terragruntMockWarnings(log, dirs) {
+    const seen = new Set();
+    const out = [];
+    for (const m of log.matchAll(MOCK_WARNING)) {
+        const unit = upstreamOfConfigPath(".", m[2], dirs);
+        const upstream = upstreamOfConfigPath(".", m[1], dirs);
+        const key = `${unit}\u0000${upstream}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ unit, upstream });
+    }
+    return out.sort((a, b) => (a.unit < b.unit ? -1 : a.unit > b.unit ? 1 : a.upstream < b.upstream ? -1 : 1));
+}
+/**
+ * The parts with each member whose unit the plan log says read mocks turned
+ * into a failed member, so a mock plan never reaches a gate.
+ */
+export function failMockedParts(parts, mocked) {
+    const by = new Map();
+    for (const m of mocked)
+        by.set(m.unit, [...(by.get(m.unit) ?? []), m.upstream]);
+    return parts.map((p) => {
+        const ups = by.get(p.member.member);
+        if (!ups)
+            return p;
+        return {
+            member: {
+                ...p.member,
+                status: "failed",
+                error: `planned on mock_outputs: ${ups.join(", ")} had no outputs when Terragrunt planned it; apply ${ups.join(", ")} first`,
+                planDigest: null,
+            },
+            entries: [],
+        };
+    });
+}
+/** The parts of a provisional plan: each member marked, so no digest or group of real plans takes it. */
+export function markProvisional(parts) {
+    return parts.map((p) => ({ ...p, member: { ...p.member, provisional: true } }));
+}
+/** The file a provisional plan leaves in its work directory, so its saved plans are never applied. */
+export const PROVISIONAL_MARKER = "PROVISIONAL";