@intentius/chant-lexicon-terraform 0.124.38 → 0.124.39

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "11535ffc33281743a4e1d0e6899c8b70b15c23e5c7e03b5f33d2e4b79bfe55e9",
+    "manifest.json": "034e3c2459bdc43fbf0aaec0a2ff992c3134d1cc340d6c314ea05449ea58a948",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "7c10245b2c3335253b48ee7d8b075d89f43116bde20313a5d1031b343fef1282",
@@ -56,5 +56,5 @@
     "rules/tf045.ts": "760b1f4f385fbe7a86897efe3078fdeac11bcc9bfb806285d63db50488174b7b",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "70fa23ca43d5d767899be5780e59efe176f954c2da8676f2e0a17ff841e5e272"
+  "composite": "8610a0946ccc539f566b883d405922a95fddd0a72ce81ba8c3c49ec155502cf0"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.124.38",
+  "version": "0.124.39",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/terragrunt/mocks.d.ts

@@ -26,6 +26,10 @@
  *
  * The blocks come from `terragrunt render --json`, so includes, locals and
  * expressions in `config_path` are Terragrunt's to evaluate, not chant's.
+ * A block with an `expansion` (`for_each` or `count`, Terragrunt 1.2) is the
+ * exception: render prints the block's body as written, `${count.index}` and
+ * all (`pkg/config/config_as_cty.go:723-733` at v1.2.0; #4225). Its instances are the unit's `find --dependencies` paths that
+ * match that path with each `${...}` read as one path segment.
  *
  * A provisional plan is the other side: a dependent planned at PR time
  * (`dependents: plan`), before its upstream applied. It may read mocks. Its
@@ -61,12 +65,22 @@ export interface RenderedDependency {
  * none. A path to the upstream's `terragrunt.hcl` names its directory.
  */
 export declare function upstreamOfConfigPath(unit: string, configPath: string, dirs: string | readonly string[]): string;
+/** Whether `terragrunt render --json` output holds an expanded `dependency` block, which needs the unit's `find --dependencies` paths. */
+export declare function hasExpandedDependency(output: string | unknown): boolean;
 /**
  * The `dependency` blocks of one unit, from `terragrunt render --json` run
  * in it. `unit` is the unit's path relative to where Terragrunt runs (`dirs`).
- * Throws when the output is not the rendered config.
+ *
+ * An expanded block (#4225) needs `found`, the unit's dependency paths from
+ * `terragrunt find --dependencies`, relative to `dirs`: it becomes one entry
+ * per found path that matches its `config_path` and that no plain block
+ * names, labelled `<label>[<upstream>]` and carrying the block's mocks,
+ * merge strategy and `skip_outputs`. `find` lists ordering-only
+ * `dependencies` edges too, which is why a path is matched, not assumed.
+ * Throws when the output is not the rendered config, when an expanded block
+ * comes without `found`, and when one matches no found path.
  */
-export declare function parseRenderedDependencies(unit: string, output: string | unknown, dirs: string | readonly string[]): RenderedDependency[];
+export declare function parseRenderedDependencies(unit: string, output: string | unknown, dirs: string | readonly string[], found?: readonly string[]): RenderedDependency[];
 /**
  * The outputs `output -json` prints, by name, with their values. Undefined
  * when the text holds no JSON object.

package/dist/terragrunt/mocks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mocks.d.ts","sourceRoot":"","sources":["../../src/terragrunt/mocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,0GAA0G;IAC1G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM,CAU/G;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,kBAAkB,EAAE,CA4BxI;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAY1F;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3D;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3D;AAED,qEAAqE;AACrE,MAAM,MAAM,oBAAoB;AAC9B,wEAAwE;AACtE,YAAY;AACd,6EAA6E;GAC3E,SAAS;AACX,8EAA8E;GAC5E,cAAc;AAChB,0EAA0E;GACxE,UAAU,CAAC;AAEf,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAeD,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAAC;IACjE;;;OAGG;IACH,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,EAAE,CAqBzF;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,GAAG,MAAM,EAAE,CAIpH;AAgBD,gHAAgH;AAChH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,GAAG,MAAM,CAMhF;AAUD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAY/H;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,aAAa,EAAE,CAgB3I;AAED,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAEhF;AAED,sGAAsG;AACtG,eAAO,MAAM,kBAAkB,gBAAgB,CAAC"}
+{"version":3,"file":"mocks.d.ts","sourceRoot":"","sources":["../../src/terragrunt/mocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAEjE,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,QAAQ,EAAE,MAAM,CAAC;IACjB,gCAAgC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,0GAA0G;IAC1G,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6BAA6B;IAC7B,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAmBD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,MAAM,CAU/G;AAeD,0IAA0I;AAC1I,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAIvE;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GAAG,OAAO,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,EAChC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GACxB,kBAAkB,EAAE,CAyCtB;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAY1F;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3D;AAED,uFAAuF;AACvF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3D;AAED,qEAAqE;AACrE,MAAM,MAAM,oBAAoB;AAC9B,wEAAwE;AACtE,YAAY;AACd,6EAA6E;GAC3E,SAAS;AACX,8EAA8E;GAC5E,cAAc;AAChB,0EAA0E;GACxE,UAAU,CAAC;AAEf,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IACjC,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sCAAsC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,iFAAiF;IACjF,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAeD,MAAM,WAAW,wBAAwB;IACvC,qDAAqD;IACrD,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,CAAC;IACjE;;;OAGG;IACH,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,wBAAwB,GAAG,kBAAkB,EAAE,CAqBzF;AAED,4EAA4E;AAC5E,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,kBAAkB,EAAE,CAAC,GAAG,MAAM,EAAE,CAIpH;AAgBD,gHAAgH;AAChH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,GAAG,MAAM,CAMhF;AAkBD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAc/H;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,EAAE,MAAM,EAAE,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,aAAa,EAAE,CAgB3I;AAED,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,aAAa,EAAE,GAAG,aAAa,EAAE,CAEhF;AAED,sGAAsG;AACtG,eAAO,MAAM,kBAAkB,gBAAgB,CAAC"}

package/dist/terragrunt/mocks.js

@@ -26,6 +26,10 @@
  *
  * The blocks come from `terragrunt render --json`, so includes, locals and
  * expressions in `config_path` are Terragrunt's to evaluate, not chant's.
+ * A block with an `expansion` (`for_each` or `count`, Terragrunt 1.2) is the
+ * exception: render prints the block's body as written, `${count.index}` and
+ * all (`pkg/config/config_as_cty.go:723-733` at v1.2.0; #4225). Its instances are the unit's `find --dependencies` paths that
+ * match that path with each `${...}` read as one path segment.
  *
  * A provisional plan is the other side: a dependent planned at PR time
  * (`dependents: plan`), before its upstream applied. It may read mocks. Its
@@ -73,17 +77,58 @@ export function upstreamOfConfigPath(unit, configPath, dirs) {
     }
     return abs;
 }
+/** Whether a rendered `dependency` block is expanded (`for_each` or `count`), so its `config_path` is not a path yet. */
+const isExpanded = (raw) => raw.expansion !== undefined ||
+    raw.for_each !== undefined ||
+    raw.count !== undefined ||
+    (typeof raw.config_path === "string" && raw.config_path.includes("${"));
+function renderedDoc(output) {
+    const doc = typeof output === "string" ? JSON.parse(output) : output;
+    if (!isObject(doc))
+        throw new Error("terragrunt render --json did not print an object");
+    return doc;
+}
+/** Whether `terragrunt render --json` output holds an expanded `dependency` block, which needs the unit's `find --dependencies` paths. */
+export function hasExpandedDependency(output) {
+    const doc = renderedDoc(output);
+    const blocks = isObject(doc.dependency) ? doc.dependency : {};
+    return Object.values(blocks).some((raw) => isObject(raw) && isExpanded(raw));
+}
+const SEGMENT = "\u0000";
+/**
+ * The paths an expanded block's `config_path` can name, as a pattern over
+ * upstream paths: each `${...}` is one path segment, or part of one.
+ */
+function expandedPattern(unit, configPath, dirs) {
+    const marked = upstreamOfConfigPath(unit, configPath.replace(/\$\{[^}]*\}/g, SEGMENT), dirs);
+    const source = marked
+        .split(SEGMENT)
+        .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+        .join("[^/]+");
+    return new RegExp(`^${source}$`);
+}
 /**
  * The `dependency` blocks of one unit, from `terragrunt render --json` run
  * in it. `unit` is the unit's path relative to where Terragrunt runs (`dirs`).
- * Throws when the output is not the rendered config.
+ *
+ * An expanded block (#4225) needs `found`, the unit's dependency paths from
+ * `terragrunt find --dependencies`, relative to `dirs`: it becomes one entry
+ * per found path that matches its `config_path` and that no plain block
+ * names, labelled `<label>[<upstream>]` and carrying the block's mocks,
+ * merge strategy and `skip_outputs`. `find` lists ordering-only
+ * `dependencies` edges too, which is why a path is matched, not assumed.
+ * Throws when the output is not the rendered config, when an expanded block
+ * comes without `found`, and when one matches no found path.
  */
-export function parseRenderedDependencies(unit, output, dirs) {
-    const doc = typeof output === "string" ? JSON.parse(output) : output;
-    if (!isObject(doc))
-        throw new Error("terragrunt render --json did not print an object");
+export function parseRenderedDependencies(unit, output, dirs, found) {
+    const doc = renderedDoc(output);
     const blocks = isObject(doc.dependency) ? doc.dependency : {};
     const out = [];
+    const plain = new Set();
+    for (const raw of Object.values(blocks)) {
+        if (isObject(raw) && typeof raw.config_path === "string" && !isExpanded(raw))
+            plain.add(upstreamOfConfigPath(unit, raw.config_path, dirs));
+    }
     for (const [label, raw] of Object.entries(blocks)) {
         if (!isObject(raw) || typeof raw.config_path !== "string")
             continue;
@@ -95,16 +140,28 @@ export function parseRenderedDependencies(unit, output, dirs) {
             : raw.mock_outputs_merge_with_state === true
                 ? "shallow"
                 : undefined;
-        out.push({
-            name: typeof raw.name === "string" && raw.name ? raw.name : label,
-            upstream: upstreamOfConfigPath(unit, raw.config_path, dirs),
+        const name = typeof raw.name === "string" && raw.name ? raw.name : label;
+        const settings = {
             ...(isObject(raw.mock_outputs) ? { mockOutputs: raw.mock_outputs } : {}),
             ...(allowed ? { mockAllowed: allowed } : {}),
             ...(strategy && strategy !== "no_merge" ? { mergeStrategy: strategy } : {}),
             // render prints skip_outputs under `skip`.
             ...(raw.skip === true || raw.skip_outputs === true ? { skipOutputs: true } : {}),
             ...(raw.enabled === false ? { disabled: true } : {}),
-        });
+        };
+        if (!isExpanded(raw)) {
+            out.push({ name, upstream: upstreamOfConfigPath(unit, raw.config_path, dirs), ...settings });
+            continue;
+        }
+        if (!found)
+            throw new Error(`dependency "${name}" is expanded (${raw.config_path}); its instances come from terragrunt find --dependencies`);
+        const pattern = expandedPattern(unit, raw.config_path, dirs);
+        const instances = [...new Set(found.map(normalize))].filter((p) => !plain.has(p) && pattern.test(p)).sort();
+        if (instances.length === 0) {
+            throw new Error(`dependency "${name}" is expanded (${raw.config_path}), and none of the unit's dependencies from terragrunt find matches it`);
+        }
+        for (const upstream of instances)
+            out.push({ name: `${name}[${upstream}]`, upstream, ...settings });
     }
     return out.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
 }
@@ -218,6 +275,13 @@ export function describeMockRefusal(reads) {
  * returning those in dependency output."
  */
 const MOCK_WARNING = /Config (\S+?) is a dependency of (\S+?) that has no outputs, but mock outputs provided/g;
+/**
+ * The line Terragrunt 1.2 logs instead when it reads outputs straight from
+ * state and an upstream was never applied (`pkg/config/dependency.go:1166-1172`
+ * at v1.2.0): "Failed to read outputs from <upstream> referenced in <unit>
+ * as <name>, fallback to mock outputs. Error: ...".
+ */
+const MOCK_FALLBACK = /Failed to read outputs from (\S+?) referenced in (\S+?) as \S+?, fallback to mock outputs/g;
 /**
  * The units a plan log says read mocks, with the upstream each read,
  * relative to where Terragrunt ran (`dirs`, as for
@@ -228,15 +292,19 @@ const MOCK_WARNING = /Config (\S+?) is a dependency of (\S+?) that has no output
 export function terragruntMockWarnings(log, dirs) {
     const seen = new Set();
     const out = [];
-    for (const m of log.matchAll(MOCK_WARNING)) {
-        const unit = upstreamOfConfigPath(".", m[2], dirs);
-        const upstream = upstreamOfConfigPath(".", m[1], dirs);
+    const add = (rawUnit, rawUpstream) => {
+        const unit = upstreamOfConfigPath(".", rawUnit, dirs);
+        const upstream = upstreamOfConfigPath(".", rawUpstream, dirs);
         const key = `${unit}\u0000${upstream}`;
         if (seen.has(key))
-            continue;
+            return;
         seen.add(key);
         out.push({ unit, upstream });
-    }
+    };
+    for (const m of log.matchAll(MOCK_WARNING))
+        add(m[2], m[1]);
+    for (const m of log.matchAll(MOCK_FALLBACK))
+        add(m[2], m[1]);
     return out.sort((a, b) => (a.unit < b.unit ? -1 : a.unit > b.unit ? 1 : a.upstream < b.upstream ? -1 : 1));
 }
 /**

package/dist/terragrunt/run.d.ts

@@ -77,6 +77,8 @@ export declare class TerragruntMockRefusal extends TerragruntError {
     readonly reads: TerragruntMockRead[];
     constructor(reads: TerragruntMockRead[]);
 }
+/** Arguments to `terragrunt` that list one unit and the units it depends on, expanded blocks included. */
+export declare function terragruntUnitDependenciesArgs(unit: string): string[];
 export interface TerragruntMockCheckInput extends TerragruntRunOptions {
     units: readonly string[];
     /** How many `render` and `output` calls run at once. Default 8. */
@@ -85,7 +87,8 @@ export interface TerragruntMockCheckInput extends TerragruntRunOptions {
 /**
  * Which dependencies of the wave's units would read `mock_outputs` at plan,
  * asked of Terragrunt: `render --json` in each unit for its evaluated
- * `dependency` blocks, then `output -json` in each upstream they read. Empty
+ * `dependency` blocks (and `find --dependencies` for a unit with an expanded
+ * one, #4225), then `output -json` in each upstream they read. Empty
  * when the wave would plan on real outputs only. Throws when Terragrunt
  * cannot render a unit or read an upstream's outputs, since then nobody
  * knows what the plan would read. A unit with no `terragrunt.hcl` in `dir`

package/dist/terragrunt/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/terragrunt/run.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,EAIL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAaL,KAAK,kBAAkB,EACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,QAAQ,CAAC;AAEhB,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8GAA8G;AAC9G,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAEnJ,eAAO,MAAM,qBAAqB,EAAE,cAWhC,CAAC;AAEL,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED,6DAA6D;AAC7D,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,oEAAoE;AACpE,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3F;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAajI;AAID;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAuB/G;AAED,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAE9E;AAED,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,qGAAqG;IACrG,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;IAC5C,QAAQ,CAAC,KAAK,EAAE,kBAAkB,EAAE;IAAhD,YAAqB,KAAK,EAAE,kBAAkB,EAAE,EAG/C;CACF;AA2BD,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiC7G;AAED,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2CAA2C;IAC3C,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,8BAA8B;IAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0CnG;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6BrG"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/terragrunt/run.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEnF,OAAO,EAKL,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EAcL,KAAK,kBAAkB,EACxB,MAAM,SAAS,CAAC;AACjB,OAAO,EAML,KAAK,oBAAoB,EAC1B,MAAM,QAAQ,CAAC;AAEhB,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8GAA8G;AAC9G,MAAM,MAAM,cAAc,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAEnJ,eAAO,MAAM,qBAAqB,EAAE,cAWhC,CAAC;AAEL,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,GAAG,EAAE,MAAM,CAAC;IACZ,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB;AAED,6DAA6D;AAC7D,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,oEAAoE;AACpE,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ3F;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE,oBAAoB,GAAG,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAajI;AAID;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAuB/G;AAED,qGAAqG;AACrG,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAE9E;AAED,MAAM,WAAW,sBAAuB,SAAQ,oBAAoB;IAClE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,qGAAqG;IACrG,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;GAIG;AACH,qBAAa,qBAAsB,SAAQ,eAAe;IAC5C,QAAQ,CAAC,KAAK,EAAE,kBAAkB,EAAE;IAAhD,YAAqB,KAAK,EAAE,kBAAkB,EAAE,EAG/C;CACF;AA2BD,0GAA0G;AAC1G,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAErE;AAED,MAAM,WAAW,wBAAyB,SAAQ,oBAAoB;IACpE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiD7G;AAED,MAAM,WAAW,kBAAkB;IACjC,qFAAqF;IACrF,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,2CAA2C;IAC3C,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,8BAA8B;IAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0CnG;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAChC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6BrG"}

package/dist/terragrunt/run.js

@@ -9,8 +9,8 @@ import { execFile } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { plannerForBinary } from "../change-set.js";
-import { parseTerragruntFind, terragruntFindArgs, terragruntVersionProblem, } from "./units.js";
-import { describeMockRefusal, failMockedParts, markProvisional, parseRenderedDependencies, parseTerragruntOutputs, PROVISIONAL_MARKER, terragruntMockReads, terragruntMockWarnings, terragruntOutputArgs, terragruntOutputUpstreams, terragruntRenderArgs, } from "./mocks.js";
+import { parseTerragruntFind, terragruntFindArgs, terragruntVersionProblem, unitPathFilter, } from "./units.js";
+import { describeMockRefusal, failMockedParts, hasExpandedDependency, markProvisional, parseRenderedDependencies, parseTerragruntOutputs, PROVISIONAL_MARKER, terragruntMockReads, terragruntMockWarnings, terragruntOutputArgs, terragruntOutputUpstreams, terragruntRenderArgs, } from "./mocks.js";
 import { parseTerragruntReport, terragruntEnv, terragruntUnitResults, terragruntWaveArgs, terragruntWaveParts, } from "./wave.js";
 export const defaultTerragruntExec = (file, args, options) => new Promise((done) => {
     execFile(file, [...args], { cwd: options.cwd, env: { ...process.env, ...options.env }, maxBuffer: 256 * 1024 * 1024 }, (err, stdout, stderr) => {
@@ -128,10 +128,15 @@ function dirsOf(dir) {
         return [abs];
     }
 }
+/** Arguments to `terragrunt` that list one unit and the units it depends on, expanded blocks included. */
+export function terragruntUnitDependenciesArgs(unit) {
+    return ["find", "--json", "--dependencies", "--no-color", "--filter", unitPathFilter(unit)];
+}
 /**
  * Which dependencies of the wave's units would read `mock_outputs` at plan,
  * asked of Terragrunt: `render --json` in each unit for its evaluated
- * `dependency` blocks, then `output -json` in each upstream they read. Empty
+ * `dependency` blocks (and `find --dependencies` for a unit with an expanded
+ * one, #4225), then `output -json` in each upstream they read. Empty
  * when the wave would plan on real outputs only. Throws when Terragrunt
  * cannot render a unit or read an upstream's outputs, since then nobody
  * knows what the plan would read. A unit with no `terragrunt.hcl` in `dir`
@@ -146,15 +151,35 @@ export async function checkTerragruntWaveMocks(input) {
     // A unit this change removed has no terragrunt.hcl here: Terragrunt plans its destroy from the old checkout.
     // It is not rendered; the plan log check still covers it.
     const units = [...new Set(input.units)].sort().filter((u) => existsSync(join(resolve(input.dir), u, "terragrunt.hcl")));
+    const unitDependencies = async (unit) => {
+        const args = terragruntUnitDependenciesArgs(unit);
+        const r = await exec(tg, args, { cwd: input.dir, env });
+        if (r.code !== 0)
+            throw new TerragruntError(`\`${tg} ${args.join(" ")}\` failed (exit ${r.code}), so ${unit}'s expanded dependencies are unknown: ${r.stderr.trim()}`);
+        let found;
+        try {
+            found = parseTerragruntFind(r.stdout);
+        }
+        catch (err) {
+            throw new TerragruntError(`could not read \`terragrunt find\` output for ${unit}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return found.find((u) => u.path === unit)?.dependencies ?? [];
+    };
     const rendered = await pool(units, limit, async (unit) => {
         const args = terragruntRenderArgs(unit);
         const r = await exec(tg, args, { cwd: input.dir, env });
         if (r.code !== 0)
             throw new TerragruntError(`\`${tg} ${args.join(" ")}\` failed (exit ${r.code}), so the wave's dependencies are unknown: ${r.stderr.trim()}`);
+        let found;
         try {
-            return [unit, parseRenderedDependencies(unit, r.stdout, dirs)];
+            // An expanded dependency (#4225) names its instances only through find.
+            if (hasExpandedDependency(r.stdout))
+                found = await unitDependencies(unit);
+            return [unit, parseRenderedDependencies(unit, r.stdout, dirs, found)];
         }
         catch (err) {
+            if (err instanceof TerragruntError)
+                throw err;
             throw new TerragruntError(`could not read \`terragrunt render --json\` for ${unit}: ${err instanceof Error ? err.message : String(err)}`);
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.124.38",
+  "version": "0.124.39",
   "type": "module",
   "files": [
     "src/",
@@ -67,7 +67,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.38",
+    "@intentius/chant": "^0.124.39",
     "zod": "^4.3.6"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/terragrunt/mocks.test.ts

@@ -307,3 +307,116 @@ describe("a wave's plan with the mock check, Terragrunt stubbed", () => {
     await expect(checkTerragruntWaveMocks({ dir, units: ["live/dev/app"], exec })).rejects.toThrow(/could not read the outputs of live\/dev\/db.*backend not reachable/s);
   });
 });
+
+describe("expanded dependency blocks (Terragrunt 1.2, #4225)", () => {
+  /**
+   * `render --json` prints an expanded block's body as written
+   * (`pkg/config/config_as_cty.go:723-733` at v1.2.0), so `config_path`
+   * still holds `${count.index}` or `${each.value}`.
+   */
+  const RENDER_EXPANDED = JSON.stringify({
+    dependency: {
+      shard: {
+        config_path: "../shard-${count.index}",
+        count: 2,
+        mock_outputs: { id: "mock" },
+        mock_outputs_allowed_terraform_commands: ["plan"],
+        mock_outputs_merge_strategy_with_state: "shallow",
+        name: "shard",
+      },
+      region: {
+        config_path: "../regions/${each.value}",
+        for_each: ["eu", "us"],
+        mock_outputs: { id: "mock" },
+        skip: true,
+        name: "region",
+      },
+      vpc: { config_path: "../vpc", mock_outputs: { id: "mock" }, name: "vpc" },
+    },
+  });
+  /** The unit's `find --dependencies` paths: the expanded instances, the plain upstream and an ordering-only `dependencies` edge. */
+  const FOUND = ["live/dev/shard-0", "live/dev/shard-1", "live/dev/regions/eu", "live/dev/regions/us", "live/dev/vpc", "live/dev/ordering"];
+
+  it("expands each block to the found paths its config_path matches, keeping its settings", () => {
+    const deps = parseRenderedDependencies("live/dev/app", RENDER_EXPANDED, "/r", FOUND);
+    expect(deps.map((d) => [d.name, d.upstream])).toEqual([
+      ["region[live/dev/regions/eu]", "live/dev/regions/eu"],
+      ["region[live/dev/regions/us]", "live/dev/regions/us"],
+      ["shard[live/dev/shard-0]", "live/dev/shard-0"],
+      ["shard[live/dev/shard-1]", "live/dev/shard-1"],
+      ["vpc", "live/dev/vpc"],
+    ]);
+    expect(deps.find((d) => d.upstream === "live/dev/shard-1")).toMatchObject({ mockOutputs: { id: "mock" }, mockAllowed: ["plan"], mergeStrategy: "shallow" });
+    expect(deps.find((d) => d.upstream === "live/dev/regions/us")).toMatchObject({ skipOutputs: true });
+    // The ordering-only edge is not a data dependency.
+    expect(deps.some((d) => d.upstream === "live/dev/ordering")).toBe(false);
+  });
+
+  it("never takes the literal config_path as an upstream, and needs find to expand", () => {
+    expect(() => parseRenderedDependencies("live/dev/app", RENDER_EXPANDED, "/r")).toThrow(/expanded .*terragrunt find --dependencies/);
+    expect(() => parseRenderedDependencies("live/dev/app", RENDER_EXPANDED, "/r", ["live/dev/vpc"])).toThrow(/none of the unit's dependencies from terragrunt find matches it/);
+  });
+
+  it("a plain block's upstream is not claimed by an expanded one", () => {
+    const render = JSON.stringify({
+      dependency: {
+        any: { config_path: "../${each.value}", for_each: ["a", "b"], name: "any" },
+        a: { config_path: "../a", name: "a" },
+      },
+    });
+    const deps = parseRenderedDependencies("live/app", render, "/r", ["live/a", "live/b"]);
+    expect(deps.map((d) => [d.name, d.upstream])).toEqual([
+      ["a", "live/a"],
+      ["any[live/b]", "live/b"],
+    ]);
+  });
+
+  it("the wave check reads each expanded upstream's outputs, through find for that unit only", async () => {
+    const dir = tmp();
+    cpSync(fixture, dir, { recursive: true });
+    const seen: string[][] = [];
+    const exec: TerragruntExec = async (_f, args) => {
+      seen.push([...args]);
+      if (args[0] === "render") return { code: 0, stdout: RENDER_EXPANDED, stderr: "" };
+      if (args[0] === "find") {
+        const doc = [{ type: "unit", path: "live/dev/app", dependencies: FOUND.map((p) => `./${p}`) }];
+        return { code: 0, stdout: JSON.stringify(doc), stderr: "" };
+      }
+      const unit = args[args.indexOf("--working-dir") + 1]!;
+      return { code: 0, stdout: unit === "live/dev/shard-1" ? OUTPUT_NONE : OUTPUT_APPLIED, stderr: "" };
+    };
+    const reads = await checkTerragruntWaveMocks({ dir, units: ["live/dev/app"], exec });
+    expect(reads).toEqual([
+      { unit: "live/dev/app", dependency: "region[live/dev/regions/eu]", upstream: "live/dev/regions/eu", reason: "skip-outputs" },
+      { unit: "live/dev/app", dependency: "region[live/dev/regions/us]", upstream: "live/dev/regions/us", reason: "skip-outputs" },
+      { unit: "live/dev/app", dependency: "shard[live/dev/shard-1]", upstream: "live/dev/shard-1", reason: "no-outputs" },
+    ]);
+    expect(seen.find((a) => a[0] === "find")).toEqual(["find", "--json", "--dependencies", "--no-color", "--filter", "{./live/dev/app}"]);
+    const outputsRead = seen.filter((a) => a.includes("output")).map((a) => a[a.indexOf("--working-dir") + 1]).sort();
+    expect(outputsRead).toEqual(["live/dev/shard-0", "live/dev/shard-1", "live/dev/vpc"]);
+    expect(outputsRead.some((u) => u.includes("${"))).toBe(false);
+  });
+
+  it("a unit with plain blocks only never runs find", async () => {
+    const dir = tmp();
+    cpSync(fixture, dir, { recursive: true });
+    const seen: string[][] = [];
+    const exec: TerragruntExec = async (_f, args) => {
+      seen.push([...args]);
+      if (args[0] === "render") return { code: 0, stdout: RENDER_DEV_APP, stderr: "" };
+      return { code: 0, stdout: OUTPUT_APPLIED, stderr: "" };
+    };
+    await checkTerragruntWaveMocks({ dir, units: ["live/dev/app"], exec });
+    expect(seen.some((a) => a[0] === "find")).toBe(false);
+  });
+
+  it("reads Terragrunt 1.2's fallback warning beside the 1.1 one", () => {
+    const log =
+      "WARN   [live/dev/app] Failed to read outputs from /private/r/live/dev/shard-1/terragrunt.hcl referenced in /private/r/live/dev/app/terragrunt.hcl as shard, fallback to mock outputs. Error: no state\n" +
+      "WARN   [live/dev/db] Config /private/r/live/dev/vpc/terragrunt.hcl is a dependency of /private/r/live/dev/db/terragrunt.hcl that has no outputs, but mock outputs provided and returning those in dependency output.\n";
+    expect(terragruntMockWarnings(log + log, ["/r", "/private/r"])).toEqual([
+      { unit: "live/dev/app", upstream: "live/dev/shard-1" },
+      { unit: "live/dev/db", upstream: "live/dev/vpc" },
+    ]);
+  });
+});

package/src/terragrunt/mocks.ts

@@ -26,6 +26,10 @@
  *
  * The blocks come from `terragrunt render --json`, so includes, locals and
  * expressions in `config_path` are Terragrunt's to evaluate, not chant's.
+ * A block with an `expansion` (`for_each` or `count`, Terragrunt 1.2) is the
+ * exception: render prints the block's body as written, `${count.index}` and
+ * all (`pkg/config/config_as_cty.go:723-733` at v1.2.0; #4225). Its instances are the unit's `find --dependencies` paths that
+ * match that path with each `${...}` read as one path segment.
  *
  * A provisional plan is the other side: a dependent planned at PR time
  * (`dependents: plan`), before its upstream applied. It may read mocks. Its
@@ -92,16 +96,67 @@ export function upstreamOfConfigPath(unit: string, configPath: string, dirs: str
   return abs;
 }
 
+/** Whether a rendered `dependency` block is expanded (`for_each` or `count`), so its `config_path` is not a path yet. */
+const isExpanded = (raw: Record<string, unknown>): boolean =>
+  raw.expansion !== undefined ||
+  raw.for_each !== undefined ||
+  raw.count !== undefined ||
+  (typeof raw.config_path === "string" && raw.config_path.includes("${"));
+
+function renderedDoc(output: string | unknown): Record<string, unknown> {
+  const doc = typeof output === "string" ? (JSON.parse(output) as unknown) : output;
+  if (!isObject(doc)) throw new Error("terragrunt render --json did not print an object");
+  return doc;
+}
+
+/** Whether `terragrunt render --json` output holds an expanded `dependency` block, which needs the unit's `find --dependencies` paths. */
+export function hasExpandedDependency(output: string | unknown): boolean {
+  const doc = renderedDoc(output);
+  const blocks = isObject(doc.dependency) ? doc.dependency : {};
+  return Object.values(blocks).some((raw) => isObject(raw) && isExpanded(raw));
+}
+
+const SEGMENT = "\u0000";
+
+/**
+ * The paths an expanded block's `config_path` can name, as a pattern over
+ * upstream paths: each `${...}` is one path segment, or part of one.
+ */
+function expandedPattern(unit: string, configPath: string, dirs: string | readonly string[]): RegExp {
+  const marked = upstreamOfConfigPath(unit, configPath.replace(/\$\{[^}]*\}/g, SEGMENT), dirs);
+  const source = marked
+    .split(SEGMENT)
+    .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"))
+    .join("[^/]+");
+  return new RegExp(`^${source}$`);
+}
+
 /**
  * The `dependency` blocks of one unit, from `terragrunt render --json` run
  * in it. `unit` is the unit's path relative to where Terragrunt runs (`dirs`).
- * Throws when the output is not the rendered config.
+ *
+ * An expanded block (#4225) needs `found`, the unit's dependency paths from
+ * `terragrunt find --dependencies`, relative to `dirs`: it becomes one entry
+ * per found path that matches its `config_path` and that no plain block
+ * names, labelled `<label>[<upstream>]` and carrying the block's mocks,
+ * merge strategy and `skip_outputs`. `find` lists ordering-only
+ * `dependencies` edges too, which is why a path is matched, not assumed.
+ * Throws when the output is not the rendered config, when an expanded block
+ * comes without `found`, and when one matches no found path.
  */
-export function parseRenderedDependencies(unit: string, output: string | unknown, dirs: string | readonly string[]): RenderedDependency[] {
-  const doc = typeof output === "string" ? (JSON.parse(output) as unknown) : output;
-  if (!isObject(doc)) throw new Error("terragrunt render --json did not print an object");
+export function parseRenderedDependencies(
+  unit: string,
+  output: string | unknown,
+  dirs: string | readonly string[],
+  found?: readonly string[],
+): RenderedDependency[] {
+  const doc = renderedDoc(output);
   const blocks = isObject(doc.dependency) ? doc.dependency : {};
   const out: RenderedDependency[] = [];
+  const plain = new Set<string>();
+  for (const raw of Object.values(blocks)) {
+    if (isObject(raw) && typeof raw.config_path === "string" && !isExpanded(raw)) plain.add(upstreamOfConfigPath(unit, raw.config_path, dirs));
+  }
   for (const [label, raw] of Object.entries(blocks)) {
     if (!isObject(raw) || typeof raw.config_path !== "string") continue;
     const allowed = Array.isArray(raw.mock_outputs_allowed_terraform_commands)
@@ -113,16 +168,26 @@ export function parseRenderedDependencies(unit: string, output: string | unknown
         : raw.mock_outputs_merge_with_state === true
           ? "shallow"
           : undefined;
-    out.push({
-      name: typeof raw.name === "string" && raw.name ? raw.name : label,
-      upstream: upstreamOfConfigPath(unit, raw.config_path, dirs),
+    const name = typeof raw.name === "string" && raw.name ? raw.name : label;
+    const settings = {
       ...(isObject(raw.mock_outputs) ? { mockOutputs: raw.mock_outputs } : {}),
       ...(allowed ? { mockAllowed: allowed } : {}),
       ...(strategy && strategy !== "no_merge" ? { mergeStrategy: strategy } : {}),
       // render prints skip_outputs under `skip`.
       ...(raw.skip === true || raw.skip_outputs === true ? { skipOutputs: true } : {}),
       ...(raw.enabled === false ? { disabled: true } : {}),
-    });
+    };
+    if (!isExpanded(raw)) {
+      out.push({ name, upstream: upstreamOfConfigPath(unit, raw.config_path, dirs), ...settings });
+      continue;
+    }
+    if (!found) throw new Error(`dependency "${name}" is expanded (${raw.config_path}); its instances come from terragrunt find --dependencies`);
+    const pattern = expandedPattern(unit, raw.config_path, dirs);
+    const instances = [...new Set(found.map(normalize))].filter((p) => !plain.has(p) && pattern.test(p)).sort();
+    if (instances.length === 0) {
+      throw new Error(`dependency "${name}" is expanded (${raw.config_path}), and none of the unit's dependencies from terragrunt find matches it`);
+    }
+    for (const upstream of instances) out.push({ name: `${name}[${upstream}]`, upstream, ...settings });
   }
   return out.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
 }
@@ -272,6 +337,14 @@ export function describeMockRefusal(reads: readonly TerragruntMockRead[]): strin
  */
 const MOCK_WARNING = /Config (\S+?) is a dependency of (\S+?) that has no outputs, but mock outputs provided/g;
 
+/**
+ * The line Terragrunt 1.2 logs instead when it reads outputs straight from
+ * state and an upstream was never applied (`pkg/config/dependency.go:1166-1172`
+ * at v1.2.0): "Failed to read outputs from <upstream> referenced in <unit>
+ * as <name>, fallback to mock outputs. Error: ...".
+ */
+const MOCK_FALLBACK = /Failed to read outputs from (\S+?) referenced in (\S+?) as \S+?, fallback to mock outputs/g;
+
 /**
  * The units a plan log says read mocks, with the upstream each read,
  * relative to where Terragrunt ran (`dirs`, as for
@@ -282,14 +355,16 @@ const MOCK_WARNING = /Config (\S+?) is a dependency of (\S+?) that has no output
 export function terragruntMockWarnings(log: string, dirs: string | readonly string[]): Array<{ unit: string; upstream: string }> {
   const seen = new Set<string>();
   const out: Array<{ unit: string; upstream: string }> = [];
-  for (const m of log.matchAll(MOCK_WARNING)) {
-    const unit = upstreamOfConfigPath(".", m[2]!, dirs);
-    const upstream = upstreamOfConfigPath(".", m[1]!, dirs);
+  const add = (rawUnit: string, rawUpstream: string): void => {
+    const unit = upstreamOfConfigPath(".", rawUnit, dirs);
+    const upstream = upstreamOfConfigPath(".", rawUpstream, dirs);
     const key = `${unit}\u0000${upstream}`;
-    if (seen.has(key)) continue;
+    if (seen.has(key)) return;
     seen.add(key);
     out.push({ unit, upstream });
-  }
+  };
+  for (const m of log.matchAll(MOCK_WARNING)) add(m[2]!, m[1]!);
+  for (const m of log.matchAll(MOCK_FALLBACK)) add(m[2]!, m[1]!);
   return out.sort((a, b) => (a.unit < b.unit ? -1 : a.unit > b.unit ? 1 : a.upstream < b.upstream ? -1 : 1));
 }
 

package/src/terragrunt/run.ts

@@ -15,12 +15,14 @@ import {
   parseTerragruntFind,
   terragruntFindArgs,
   terragruntVersionProblem,
+  unitPathFilter,
   type TerragruntFindOptions,
   type TerragruntUnit,
 } from "./units";
 import {
   describeMockRefusal,
   failMockedParts,
+  hasExpandedDependency,
   markProvisional,
   parseRenderedDependencies,
   parseTerragruntOutputs,
@@ -208,6 +210,11 @@ function dirsOf(dir: string): string[] {
   }
 }
 
+/** Arguments to `terragrunt` that list one unit and the units it depends on, expanded blocks included. */
+export function terragruntUnitDependenciesArgs(unit: string): string[] {
+  return ["find", "--json", "--dependencies", "--no-color", "--filter", unitPathFilter(unit)];
+}
+
 export interface TerragruntMockCheckInput extends TerragruntRunOptions {
   units: readonly string[];
   /** How many `render` and `output` calls run at once. Default 8. */
@@ -217,7 +224,8 @@ export interface TerragruntMockCheckInput extends TerragruntRunOptions {
 /**
  * Which dependencies of the wave's units would read `mock_outputs` at plan,
  * asked of Terragrunt: `render --json` in each unit for its evaluated
- * `dependency` blocks, then `output -json` in each upstream they read. Empty
+ * `dependency` blocks (and `find --dependencies` for a unit with an expanded
+ * one, #4225), then `output -json` in each upstream they read. Empty
  * when the wave would plan on real outputs only. Throws when Terragrunt
  * cannot render a unit or read an upstream's outputs, since then nobody
  * knows what the plan would read. A unit with no `terragrunt.hcl` in `dir`
@@ -232,13 +240,29 @@ export async function checkTerragruntWaveMocks(input: TerragruntMockCheckInput):
   // A unit this change removed has no terragrunt.hcl here: Terragrunt plans its destroy from the old checkout.
   // It is not rendered; the plan log check still covers it.
   const units = [...new Set(input.units)].sort().filter((u) => existsSync(join(resolve(input.dir), u, "terragrunt.hcl")));
+  const unitDependencies = async (unit: string): Promise<string[]> => {
+    const args = terragruntUnitDependenciesArgs(unit);
+    const r = await exec(tg, args, { cwd: input.dir, env });
+    if (r.code !== 0) throw new TerragruntError(`\`${tg} ${args.join(" ")}\` failed (exit ${r.code}), so ${unit}'s expanded dependencies are unknown: ${r.stderr.trim()}`);
+    let found: TerragruntUnit[];
+    try {
+      found = parseTerragruntFind(r.stdout);
+    } catch (err) {
+      throw new TerragruntError(`could not read \`terragrunt find\` output for ${unit}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return found.find((u) => u.path === unit)?.dependencies ?? [];
+  };
   const rendered = await pool(units, limit, async (unit): Promise<[string, RenderedDependency[]]> => {
     const args = terragruntRenderArgs(unit);
     const r = await exec(tg, args, { cwd: input.dir, env });
     if (r.code !== 0) throw new TerragruntError(`\`${tg} ${args.join(" ")}\` failed (exit ${r.code}), so the wave's dependencies are unknown: ${r.stderr.trim()}`);
+    let found: string[] | undefined;
     try {
-      return [unit, parseRenderedDependencies(unit, r.stdout, dirs)];
+      // An expanded dependency (#4225) names its instances only through find.
+      if (hasExpandedDependency(r.stdout)) found = await unitDependencies(unit);
+      return [unit, parseRenderedDependencies(unit, r.stdout, dirs, found)];
     } catch (err) {
+      if (err instanceof TerragruntError) throw err;
       throw new TerragruntError(`could not read \`terragrunt render --json\` for ${unit}: ${err instanceof Error ? err.message : String(err)}`);
     }
   });