@intentius/chant-lexicon-terraform 0.124.45 → 0.124.46

package/dist/plan-observation.js

@@ -0,0 +1,354 @@
+/**
+ * The plan depth's projection (#4358): a saved plan's `show -json` document,
+ * turned into the attributes an observed terraform block carries.
+ *
+ * The state read (`terraform show -json` over state) says what the last apply
+ * recorded. A plan says what the next apply would do, and four facts exist
+ * only there:
+ *
+ * | plan document | IR attribute |
+ * |---|---|
+ * | `resource_changes[].change.actions` | `planAction`, `planActions` |
+ * | `resource_changes[].change.replace_paths`, `resource_changes[].action_reason` | `planReplacePaths`, `planActionReason` |
+ * | `resource_changes[].change.after_unknown` | `planAfterUnknown` |
+ * | `resource_drift[]`, `relevant_attributes[]` | `planDrift`, `planDriftAction`, `planRelevantAttributes` |
+ *
+ * plus `planChanges`, the attribute-level before and after of each planned
+ * update or replace. `PLAN_ATTRIBUTE_NAMES` lists them for a consumer.
+ *
+ * ## Paths
+ *
+ * Every attribute path is one string: object keys joined with `.`, list
+ * indexes and keys that are not identifiers in brackets, so
+ * `lifecycle_commands[0].read`, `tags["kubernetes.io/role"]`. A `chant search
+ * attr:planReplacePaths=triggers_replace` term matches by substring over that.
+ *
+ * ## Sensitive values never leave this module
+ *
+ * `before_sensitive` and `after_sensitive` are trees parallel to `before` and
+ * `after`: `true` at a node marks that node and everything under it. A value
+ * under a `true` node is replaced with `(sensitive)` before it is put on an
+ * attribute, at any depth, so a sensitive value nested in a map is caught
+ * exactly like a sensitive top-level attribute. Only leaves are ever emitted,
+ * never a whole object, so no unwalked subtree can carry a secret past the
+ * check.
+ *
+ * A flag on either side redacts both sides of that path. On a stock root the
+ * two sides are flagged alike, because state records which paths were
+ * sensitive. On a choudoufu live root (#4371) they are not: prior state is
+ * rebuilt from the account on every run and carries no marks from the
+ * configuration, so an attribute made sensitive by a `sensitive` variable is
+ * flagged on `after` only, while `before` holds the live value, which is the
+ * previous secret. Recorded in `__fixtures__/live-plan-depth/`.
+ *
+ * Flags alone are not enough, as a real plan shows: `terraform_data` copies
+ * `input` to `output`, and the plan flags `input.token` sensitive while
+ * leaving `output.token` unflagged with the same value in it. So every string
+ * found under a sensitive flag anywhere in the document is collected first,
+ * and any emitted value equal to one of them is redacted too. That catches a
+ * copy; it cannot catch a secret a provider transformed (hashed, embedded in a
+ * longer string), and the observation page says so.
+ *
+ * Nothing from `prior_state` is surfaced but each row's `id`, which is the
+ * state read's rule too.
+ */
+/** What stands in for a value flagged sensitive, or equal to one that was. */
+export const SENSITIVE_VALUE = "(sensitive)";
+/** OpenTofu's and Terraform's own phrase for a value the plan cannot know yet. */
+export const KNOWN_AFTER_APPLY = "(known after apply)";
+/**
+ * Every attribute the plan depth adds to an observed block, beside the state
+ * read's `address`, `root`, `resourceType`, `mode` and `provider`. A block the
+ * plan does not touch carries `planAction: "no-op"` and none of the optional
+ * ones.
+ */
+export const PLAN_ATTRIBUTE_NAMES = [
+    "planAction",
+    "planActions",
+    "planActionReason",
+    "planReplacePaths",
+    "planAfterUnknown",
+    "planChanges",
+    "planDrift",
+    "planDriftAction",
+    "planRelevantAttributes",
+];
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function asString(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+/** Render one path segment list as a single string. */
+export function renderPath(segments) {
+    let out = "";
+    for (const segment of segments) {
+        if (typeof segment === "number")
+            out += `[${segment}]`;
+        else if (/^[A-Za-z_][A-Za-z0-9_-]*$/.test(segment))
+            out += out ? `.${segment}` : segment;
+        else
+            out += `[${JSON.stringify(segment)}]`;
+    }
+    return out;
+}
+/** A path from the document (`replace_paths[]`, `relevant_attributes[].attribute`), rendered. */
+function documentPath(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const segments = value.filter((s) => typeof s === "string" || typeof s === "number");
+    return segments.length > 0 ? renderPath(segments) : undefined;
+}
+/** The child of a parallel boolean tree at `key`. `true` is inherited by every descendant. */
+function child(tree, key) {
+    if (tree === true)
+        return true;
+    if (Array.isArray(tree))
+        return typeof key === "number" ? tree[key] : undefined;
+    if (isRecord(tree))
+        return tree[String(key)];
+    return undefined;
+}
+function same(a, b) {
+    if (a === b)
+        return true;
+    if (Array.isArray(a) && Array.isArray(b))
+        return a.length === b.length && a.every((x, i) => same(x, b[i]));
+    if (isRecord(a) && isRecord(b)) {
+        const ka = Object.keys(a);
+        return ka.length === Object.keys(b).length && ka.every((k) => Object.prototype.hasOwnProperty.call(b, k) && same(a[k], b[k]));
+    }
+    return false;
+}
+/** Every string leaf under a `true` node of `flags`, into `out`. */
+function collectSensitive(value, flags, out) {
+    if (flags === true) {
+        const walk = (v) => {
+            if (typeof v === "string" && v.length > 0)
+                out.add(v);
+            else if (Array.isArray(v))
+                v.forEach(walk);
+            else if (isRecord(v))
+                Object.values(v).forEach(walk);
+        };
+        walk(value);
+        return;
+    }
+    if (Array.isArray(value))
+        value.forEach((v, i) => collectSensitive(v, child(flags, i), out));
+    else if (isRecord(value))
+        for (const [k, v] of Object.entries(value))
+            collectSensitive(v, child(flags, k), out);
+}
+/** Every path where `tree` is `true`, as rendered paths. */
+function truePaths(tree, at = []) {
+    if (tree === true)
+        return at.length > 0 ? [renderPath(at)] : ["*"];
+    if (Array.isArray(tree))
+        return tree.flatMap((v, i) => truePaths(v, [...at, i]));
+    if (isRecord(tree))
+        return Object.entries(tree).flatMap(([k, v]) => truePaths(v, [...at, k]));
+    return [];
+}
+/** A scalar for an emitted change: redacted when flagged or equal to a known sensitive string. */
+function shown(value, flagged, secrets) {
+    if (flagged)
+        return SENSITIVE_VALUE;
+    if (value === undefined)
+        return null;
+    if (typeof value === "string" && secrets.has(value))
+        return SENSITIVE_VALUE;
+    return value;
+}
+const isContainer = (v) => Array.isArray(v) || isRecord(v);
+/**
+ * The leaf-level differences between two sides of one change. Exported for
+ * the redaction tests; see the module doc for the rules.
+ */
+export function diffChange(change, secrets) {
+    const out = [];
+    const walk = (before, after, bs, as, au, at) => {
+        const path = renderPath(at) || "*";
+        // Unknown until apply. The before side is still walked to its leaves when
+        // it is a container, so each leaf keeps its own sensitivity, and the
+        // after side of every leaf is the phrase.
+        if (au === true) {
+            const flagged = bs === true || as === true;
+            if (!flagged && isContainer(before) && Object.keys(before).length > 0) {
+                const keys = Array.isArray(before) ? before.map((_, i) => i) : Object.keys(before).sort();
+                for (const key of keys) {
+                    walk(before[key], undefined, child(bs, key), child(as, key), true, [...at, key]);
+                }
+                return;
+            }
+            out.push({ path, before: isContainer(before) && !flagged ? before : shown(before, flagged, secrets), after: KNOWN_AFTER_APPLY });
+            return;
+        }
+        if (same(before, after))
+            return;
+        // A flagged node is emitted whole, as `(sensitive)`, and never walked:
+        // there is nothing under it to show. A container beside a flag on the
+        // other side is redacted too rather than walked without its flags.
+        // Both sides are redacted when either is flagged; see the module doc for
+        // the live root whose `before` is never flagged.
+        if (bs === true || as === true) {
+            const side = (v) => (v === undefined || v === null ? null : SENSITIVE_VALUE);
+            out.push({ path, before: side(before), after: side(after) });
+            return;
+        }
+        if (Array.isArray(before) || Array.isArray(after)) {
+            const b = Array.isArray(before) ? before : [];
+            const a = Array.isArray(after) ? after : [];
+            for (let i = 0; i < Math.max(b.length, a.length); i++) {
+                walk(b[i], a[i], child(bs, i), child(as, i), child(au, i), [...at, i]);
+            }
+            return;
+        }
+        if (isRecord(before) || isRecord(after)) {
+            const b = isRecord(before) ? before : {};
+            const a = isRecord(after) ? after : {};
+            for (const key of [...new Set([...Object.keys(b), ...Object.keys(a)])].sort()) {
+                walk(b[key], a[key], child(bs, key), child(as, key), child(au, key), [...at, key]);
+            }
+            return;
+        }
+        out.push({ path, before: shown(before, false, secrets), after: shown(after, false, secrets) });
+    };
+    walk(change.before, change.after, change.before_sensitive, change.after_sensitive, change.after_unknown, []);
+    return out;
+}
+function actionsOf(change) {
+    return Array.isArray(change.actions) ? change.actions.filter((a) => typeof a === "string") : [];
+}
+/**
+ * Index a `show -json <planfile>` document. Unknown fields are ignored and a
+ * missing section reads as empty, the same tolerance the state read has.
+ */
+export function indexPlan(document) {
+    const doc = isRecord(document) ? document : {};
+    const rawChanges = Array.isArray(doc.resource_changes) ? doc.resource_changes.filter(isRecord) : [];
+    const rawDrift = Array.isArray(doc.resource_drift) ? doc.resource_drift.filter(isRecord) : [];
+    // Pass one: every string under a sensitive flag, anywhere in the document.
+    // Each side is read under both sides' flags, so a live root's unflagged
+    // `before` value at a path `after` flags is a secret too (#4371).
+    const secrets = new Set();
+    for (const entry of [...rawChanges, ...rawDrift]) {
+        const change = isRecord(entry.change) ? entry.change : {};
+        for (const flags of [change.before_sensitive, change.after_sensitive]) {
+            collectSensitive(change.before, flags, secrets);
+            collectSensitive(change.after, flags, secrets);
+        }
+    }
+    const relevant = new Map();
+    for (const entry of Array.isArray(doc.relevant_attributes) ? doc.relevant_attributes.filter(isRecord) : []) {
+        const address = asString(entry.resource);
+        const path = documentPath(entry.attribute);
+        if (!address || !path)
+            continue;
+        const list = relevant.get(address) ?? [];
+        if (!list.includes(path))
+            list.push(path);
+        relevant.set(address, list);
+    }
+    const changes = new Map();
+    for (const entry of rawChanges) {
+        const address = asString(entry.address);
+        if (!address || !isRecord(entry.change))
+            continue;
+        const change = entry.change;
+        const replacePaths = (Array.isArray(change.replace_paths) ? change.replace_paths : [])
+            .map(documentPath)
+            .filter((p) => p !== undefined);
+        const actions = actionsOf(change);
+        const updates = actions.includes("update") || (actions.includes("create") && actions.includes("delete"));
+        changes.set(address, {
+            address,
+            actions,
+            ...(asString(entry.action_reason) ? { actionReason: asString(entry.action_reason) } : {}),
+            replacePaths,
+            afterUnknown: truePaths(change.after_unknown),
+            // Only an update or a replace compares two states of one object. A
+            // create has no before and a delete no after: neither is an attribute
+            // that moved, and both are already the action itself.
+            changes: updates ? diffChange(change, secrets) : [],
+        });
+    }
+    const drift = new Map();
+    for (const entry of rawDrift) {
+        const address = asString(entry.address);
+        if (!address || !isRecord(entry.change))
+            continue;
+        const reads = relevant.get(address) ?? [];
+        drift.set(address, {
+            address,
+            actions: actionsOf(entry.change),
+            changes: diffChange(entry.change, secrets).map((c) => reads.some((r) => c.path === r || c.path.startsWith(`${r}.`) || c.path.startsWith(`${r}[`))
+                ? { ...c, relevant: true }
+                : c),
+        });
+    }
+    return { priorState: doc.prior_state, changes, drift, relevant };
+}
+/**
+ * The block address an instance address belongs to: every instance key
+ * removed, on the resource and on each module call, so `module.a[0].x.y["k"]`
+ * belongs to `module.a.x.y`.
+ */
+export function blockAddressOf(instance) {
+    return instance.replace(/\[(?:"(?:[^"\\]|\\.)*"|\d+)\]/g, "");
+}
+/** One action list as one word: `replace` for either order of delete and create. */
+export function actionWord(actions) {
+    if (actions.includes("create") && actions.includes("delete"))
+        return "replace";
+    if (actions.length === 0)
+        return "no-op";
+    return actions.join(",");
+}
+/**
+ * The plan attributes of one declared block, aggregated over its instances.
+ * `instances` are the block's instance addresses in `prior_state`; a block in
+ * the plan that has none there is a planned create, which the reader reports
+ * absent and annotates with {@link plannedAttributesFor} instead.
+ */
+export function planAttributesFor(address, index) {
+    const mine = (map) => [...map].filter(([instance]) => blockAddressOf(instance) === address).sort(([a], [b]) => a.localeCompare(b));
+    const changes = mine(index.changes);
+    const drift = mine(index.drift);
+    const relevant = mine(index.relevant);
+    const many = new Set([...changes, ...drift].map(([instance]) => instance)).size > 1;
+    const tag = (instance, c) => many || instance !== address ? { ...c, instance } : c;
+    const words = [...new Set(changes.map(([, c]) => actionWord(c.actions)))].sort();
+    const reasons = [...new Set(changes.map(([, c]) => c.actionReason).filter((r) => !!r))].sort();
+    const replacePaths = [...new Set(changes.flatMap(([, c]) => c.replacePaths))].sort();
+    const afterUnknown = [...new Set(changes.flatMap(([, c]) => c.afterUnknown))].sort();
+    const valueChanges = changes.flatMap(([instance, c]) => c.changes.map((v) => tag(instance, v)));
+    const driftChanges = drift.flatMap(([instance, d]) => d.changes.map((v) => tag(instance, v)));
+    const driftWords = [...new Set(drift.map(([, d]) => actionWord(d.actions)))].sort();
+    const relevantPaths = [...new Set(relevant.flatMap(([, paths]) => paths))].sort();
+    return {
+        planAction: words.length > 0 ? words.join(",") : "no-op",
+        ...(changes.length > 0 ? { planActions: Object.fromEntries(changes.map(([i, c]) => [i, c.actions])) } : {}),
+        ...(reasons.length > 0 ? { planActionReason: reasons.join(",") } : {}),
+        ...(replacePaths.length > 0 ? { planReplacePaths: replacePaths } : {}),
+        ...(afterUnknown.length > 0 ? { planAfterUnknown: afterUnknown } : {}),
+        ...(valueChanges.length > 0 ? { planChanges: valueChanges } : {}),
+        ...(drift.length > 0 ? { planDriftAction: driftWords.join(","), planDrift: driftChanges } : {}),
+        ...(relevantPaths.length > 0 ? { planRelevantAttributes: relevantPaths } : {}),
+    };
+}
+/**
+ * The plan attributes of a block that has no row in `prior_state` (#4372),
+ * or undefined when the plan has no change for it either. The usual case is
+ * a planned create: `planAction: "create"`, `planActions`, and
+ * `planAfterUnknown` naming what stays unknown until apply (its `id` among
+ * them). A data block read during apply comes back as `planAction: "read"`.
+ *
+ * The reader puts these on the observation's `annotations`, not on a
+ * `resources` row, so the block stays absent and `lifecycle plan` still
+ * proposes the create.
+ */
+export function plannedAttributesFor(address, index) {
+    const planned = [...index.changes.keys()].some((instance) => blockAddressOf(instance) === address);
+    return planned ? planAttributesFor(address, index) : undefined;
+}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAmElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAqR7B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAoElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAsR7B,CAAC"}

package/dist/plugin.js

@@ -15,6 +15,7 @@ import { auditRootName, LOCK_FILENAME, parseTerraformRootContent, RESOURCE_TYPE
 import { descendModules } from "./hcl/descend.js";
 import { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
 import { terraformCommands } from "./commands.js";
+import { terraformCapabilityPack } from "./capabilities/adapter.js";
 const loadSkills = createSkillsLoader(import.meta.url, [
     {
         file: "chant-terraform.md",
@@ -66,6 +67,7 @@ function looksLikeHcl(text) {
 export const terraformPlugin = {
     behaviourKinds: terraformBehaviourKinds,
     name: "terraform",
+    capabilityPack: terraformCapabilityPack,
     serializer: terraformSerializer,
     configSchema: terraformConfigSchema,
     // ── Required lifecycle methods ────────────────────────────────

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.124.45",
+  "version": "0.124.46",
   "type": "module",
   "files": [
     "src/",
@@ -67,7 +67,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.45",
+    "@intentius/chant": "^0.124.46",
     "zod": "^4.3.6"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/__fixtures__/ACCEPTANCE.md

@@ -1,6 +1,6 @@
 # What the gated acceptance suites have actually run against
 
-Five `describe` blocks across three files run this lexicon against a real
+Eight `describe` blocks across five files run this lexicon against a real
 binary rather than a fixture, and every one of them skips rather than fails
 when its dependency is absent. A skip is silent by design, so without this
 file nothing in the tree says which of them has ever passed, against what, or
@@ -211,6 +211,58 @@ With the Init phase back, the same run reaches its gate:
    its gate
 ```
 
+### 6. `the plan depth against a real terraform` / `tofu`
+
+`../plan-read.acceptance.test.ts`, one block per binary, three tests each, over
+the `plan-read/` fixture (built-in `terraform_data`, `local` backend, so no
+registry, no network and no credentials). The first reads the plan depth
+through `describeResources` and checks the IR attributes, `sources` reading
+`"plan"`, no secret in the result, nothing new or changed in the root, and no
+`chant-terraform-plan-*` directory left in the temp dir. The second holds the
+state lock with an `apply` waiting at its prompt, shows a plan without
+`-lock=false` failing on `Error acquiring the state lock`, and reads through
+it. The third refuses a never-initialised root with the init line and writes
+nothing in it.
+
+Gated on `terraform` / `tofu` on PATH, each block on its own binary.
+
+```
+npx vitest run lexicons/terraform/src/plan-read.acceptance.test.ts
+```
+
+Last passed: 2026-10-23, `Terraform v1.15.8` and `OpenTofu v1.12.5` on
+`darwin_arm64`, 6 passed, by chant #4358. Proved red the same day: with
+`-lock=false` taken out of `terraformPlanReadCommand`, both lock tests failed
+on `Error acquiring the state lock`.
+
+### 7. `the plan depth on a live root against a real choudoufu`
+
+`../live-plan-depth.acceptance.e2e.test.ts` (#4371), one test, in the e2e
+project because it takes about a minute. It copies `live-estate/` under a
+fresh estate name, applies it with three files held back, creates the two
+unowned log groups, drifts a log group's retention and a VPC tag out of band,
+and changes the value of a `sensitive` variable the VPC carries as a tag. Then
+one `describeResources` at the plan depth with the real activities: bound
+blocks carry the plan's attributes (the drift as a planned `update`),
+ownership and the marker still come from `live-plan`, the foreign and
+adoptable blocks carry none, `sources` reads `live+plan`, neither secret
+appears anywhere in the result, and the read adds nothing to the root (the
+plan file and the `live-plan` document included, #4379) or the temp directory.
+
+Gated on a `choudoufu` and an `aws` CLI on PATH and on
+`CHOUDOUFU_EMULATOR_ENDPOINT`.
+
+```
+npx vitest run --project e2e lexicons/terraform/src/live-plan-depth.acceptance.e2e.test.ts
+```
+
+Last passed: 2026-10-23, choudoufu v0.30.0 (release binary, verified against
+`SHA256SUMS`) with floci
+`ghcr.io/lex00/floci@sha256:5ec92ae8046445d62c0009590dd09f04560886e5a5ef31248cb3fcc09b2961ec`,
+by chant #4371. Proved red the same day: with `plan-observation.ts`'s
+redaction put back to flagging each side by its own marks, the old secret
+came through as `tags.token`'s `before`.
+
 ## Running everything that can run on a machine with no choudoufu
 
 ```

package/src/__fixtures__/capabilities/catalog/main.tf

@@ -0,0 +1,105 @@
+# The capabilities the ledger doesn't exercise, each with a case that holds
+# and one that doesn't (#4375).
+
+# in-default-vpc: an instance in a subnet of the default VPC, and one outside it.
+resource "aws_default_vpc" "default" {}
+resource "aws_subnet" "legacy" {
+  vpc_id     = aws_default_vpc.default.id
+  cidr_block = "172.31.200.0/24"
+}
+resource "aws_vpc" "main" { cidr_block = "10.9.0.0/16" }
+resource "aws_subnet" "main" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.9.0.0/24"
+}
+resource "aws_instance" "legacy" {
+  ami                    = "ami-12345678"
+  instance_type          = "t3.micro"
+  subnet_id              = aws_subnet.legacy.id
+  vpc_security_group_ids = [aws_security_group.used.id]
+}
+resource "aws_instance" "current" {
+  ami                    = "ami-12345678"
+  instance_type          = "t3.micro"
+  subnet_id              = aws_subnet.main.id
+  vpc_security_group_ids = [aws_security_group.used.id]
+}
+
+# attached-to-nothing: a group no instance uses, a policy no role holds, and
+# a subnet nothing sits in.
+resource "aws_security_group" "used" { vpc_id = aws_vpc.main.id }
+resource "aws_security_group" "unused" { vpc_id = aws_vpc.main.id }
+resource "aws_subnet" "empty" {
+  vpc_id     = aws_vpc.main.id
+  cidr_block = "10.9.1.0/24"
+}
+resource "aws_iam_policy" "orphan" {
+  policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Action = "s3:ListBucket", Resource = aws_s3_bucket.open.arn }]
+  })
+}
+
+# publicly-readable: a bucket policy for principal "*", once with nothing in
+# its way and once behind a public-access block.
+resource "aws_s3_bucket" "open" { bucket = "catalog-open" }
+resource "aws_s3_bucket_policy" "open" {
+  bucket = aws_s3_bucket.open.id
+  policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Principal = "*", Action = "s3:GetObject", Resource = "${aws_s3_bucket.open.arn}/*" }]
+  })
+}
+resource "aws_s3_bucket" "blocked" { bucket = "catalog-blocked" }
+resource "aws_s3_bucket_policy" "blocked" {
+  bucket = aws_s3_bucket.blocked.id
+  policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Principal = "*", Action = "s3:GetObject", Resource = "${aws_s3_bucket.blocked.arn}/*" }]
+  })
+}
+resource "aws_s3_bucket_public_access_block" "blocked" {
+  bucket              = aws_s3_bucket.blocked.id
+  block_public_policy = true
+}
+
+# holds-secret and encrypted-at-rest: a SecureString and a plain parameter,
+# an encrypted file system and an unencrypted database.
+resource "aws_ssm_parameter" "token" {
+  name  = "/catalog/token"
+  type  = "SecureString"
+  value = "not-a-real-token"
+}
+resource "aws_ssm_parameter" "plain" {
+  name  = "/catalog/plain"
+  type  = "String"
+  value = "hello"
+}
+resource "aws_efs_file_system" "shared" { encrypted = true }
+resource "aws_db_instance" "plain" {
+  engine            = "postgres"
+  instance_class    = "db.t3.micro"
+  allocated_storage = 20
+  username          = "catalog"
+  password          = "not-a-real-password"
+  storage_encrypted = false
+}
+
+# grants: an explicit Deny on the same pair cancels the Allow.
+resource "aws_iam_role" "denied" {
+  assume_role_policy = jsonencode({
+    Version   = "2012-10-17"
+    Statement = [{ Effect = "Allow", Principal = { Service = "ec2.amazonaws.com" }, Action = "sts:AssumeRole" }]
+  })
+}
+resource "aws_iam_role_policy" "denied" {
+  role = aws_iam_role.denied.id
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      { Effect = "Allow", Action = "s3:*", Resource = aws_s3_bucket.open.arn },
+      { Effect = "Deny", Action = "s3:*", Resource = aws_s3_bucket.open.arn },
+      { Effect = "Allow", Action = "s3:GetObject", Resource = aws_s3_bucket.blocked.arn },
+    ]
+  })
+}

package/src/__fixtures__/capabilities/chant.config.ts

@@ -0,0 +1,15 @@
+import type { ChantConfig } from "@intentius/chant/config";
+import "@intentius/chant-lexicon-terraform";
+
+export default {
+  lexicons: ["terraform"],
+  // The estates hold the findings these rules report on purpose.
+  lint: { rules: { TF022: "off", TF030: "off", TF033: "off" } },
+  terraform: {
+    roots: {
+      ledger: { dir: "./ledger" },
+      catalog: { dir: "./catalog" },
+      findings: { dir: "./findings" },
+    },
+  },
+} satisfies ChantConfig;