@intentius/chant-lexicon-terraform 0.124.51 → 0.124.54

package/README.md

@@ -54,9 +54,10 @@ just docs
 
 ## Acceptance evidence
 
-Four `describe` blocks run this lexicon against a real `terraform`, `tofu` or
-`choudoufu` binary, and each of them skips rather than fails when its
-dependency is absent. `src/__fixtures__/ACCEPTANCE.md` records, per block,
-what it proves, what gates it, the command that runs it, and the last binary
-and emulator it passed against with the date. Two of the four have never
-passed against anything, and that file says so.
+Eleven `describe` blocks across eight files run this lexicon against a real
+`terraform`, `tofu`, `choudoufu` or `terragrunt` binary, and each of them
+skips rather than fails when its dependency is absent.
+`src/__fixtures__/ACCEPTANCE.md` records, per block, what it proves, what
+gates it, the command that runs it, and a "Last passed" line: the binary,
+emulator and date of its last recorded pass. Eight blocks have one. The three
+Terragrunt suites read "not recorded" until their first run is written down.

package/dist/__fixtures__/pr-loop/estate.component.d.ts

@@ -0,0 +1,7 @@
+import { type Component } from "@intentius/chant/components";
+export declare const net: Component;
+export declare const a: Component;
+export declare const b: Component;
+export declare const app: Component;
+export declare const dns: Component;
+//# sourceMappingURL=estate.component.d.ts.map

package/dist/__fixtures__/pr-loop/estate.component.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"estate.component.d.ts","sourceRoot":"","sources":["../../../src/__fixtures__/pr-loop/estate.component.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,SAAS,EAAE,MAAM,6BAA6B,CAAC;AAKjF,eAAO,MAAM,GAAG,EAAE,SAAgE,CAAC;AACnF,eAAO,MAAM,CAAC,EAAE,SAAuG,CAAC;AACxH,eAAO,MAAM,CAAC,EAAE,SAAuG,CAAC;AACxH,eAAO,MAAM,GAAG,EAAE,SAAuG,CAAC;AAC1H,eAAO,MAAM,GAAG,EAAE,SAAgE,CAAC"}

package/dist/__fixtures__/pr-loop/estate.component.js

@@ -0,0 +1,7 @@
+import { phase, stackOutput } from "@intentius/chant/components";
+const apply = (root, vars) => [phase("Apply", [{ kind: "terraform-apply", root, noRollback: "test roots with local state", vars: vars ?? {} }])];
+export const net = { name: "net", dependsOn: [], deploy: apply("net") };
+export const a = { name: "a", dependsOn: ["net"], deploy: apply("a", { cidr: stackOutput("net", "cidr") }) };
+export const b = { name: "b", dependsOn: ["net"], deploy: apply("b", { cidr: stackOutput("net", "cidr") }) };
+export const app = { name: "app", dependsOn: ["a"], deploy: apply("app", { subnet: stackOutput("a", "id") }) };
+export const dns = { name: "dns", dependsOn: [], deploy: apply("dns") };

package/dist/__fixtures__/report/generate.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Regenerate the `chant terraform report` fixture behold renders (#4439):
+ *
+ *     npx tsx lexicons/terraform/src/__fixtures__/report/generate.ts
+ *
+ * It reads `plan.show.json` (a three-estate composed plan: network, app and
+ * edge, with app reading network and edge reading app) and `applied.show.json`
+ * (the plan made after the apply), runs `terraformReport` for both stages, and
+ * writes `<stage>/report.json` and `<stage>/change-set.json` beside them.
+ * `report.test.ts` runs `generateReportFixture` and compares it with the
+ * files, so a change to the writer shows as a diff here.
+ */
+export declare const FIXTURE_RUN: {
+    project: string;
+    commit: string;
+    job_url: string;
+    pull_request: string;
+};
+export declare const FIXTURE_ESTATES: {
+    network: string;
+    app: string;
+    edge: string;
+};
+/** The fixture's output files by path under this directory: `<stage>/report.json` and `<stage>/change-set.json`. */
+export declare function generateReportFixture(): Promise<Record<string, string>>;
+//# sourceMappingURL=generate.d.ts.map

package/dist/__fixtures__/report/generate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../../src/__fixtures__/report/generate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,eAAO,MAAM,WAAW;IAAK,OAAO;IAAwC,MAAM;IAAgB,OAAO;IAA8D,YAAY;CAAO,CAAC;AAC3L,eAAO,MAAM,eAAe;IAAK,OAAO;IAAkB,GAAG;IAAc,IAAI;CAAe,CAAC;AAK/F,oHAAoH;AACpH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA0B7E"}

package/dist/__fixtures__/report/generate.js

@@ -0,0 +1,58 @@
+/**
+ * Regenerate the `chant terraform report` fixture behold renders (#4439):
+ *
+ *     npx tsx lexicons/terraform/src/__fixtures__/report/generate.ts
+ *
+ * It reads `plan.show.json` (a three-estate composed plan: network, app and
+ * edge, with app reading network and edge reading app) and `applied.show.json`
+ * (the plan made after the apply), runs `terraformReport` for both stages, and
+ * writes `<stage>/report.json` and `<stage>/change-set.json` beside them.
+ * `report.test.ts` runs `generateReportFixture` and compares it with the
+ * files, so a change to the writer shows as a diff here.
+ */
+import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { terraformReport, writeReport } from "../../report.js";
+const here = dirname(fileURLToPath(import.meta.url));
+export const FIXTURE_RUN = { project: "forgejo:3000/admin/demo-terragrunt", commit: "4439c0ffee", job_url: "http://forgejo:3000/admin/demo-terragrunt/actions/runs/1", pull_request: "1" };
+export const FIXTURE_ESTATES = { network: "demo-network", app: "demo-app", edge: "demo-edge" };
+const FINISHED = { "tf-plan": "2026-10-25T10:00:00Z", "tf-apply": "2026-10-25T10:05:00Z" };
+const readJson = (name) => JSON.parse(readFileSync(join(here, name), "utf8"));
+/** The fixture's output files by path under this directory: `<stage>/report.json` and `<stage>/change-set.json`. */
+export async function generateReportFixture() {
+    const plan = readJson("plan.show.json");
+    const applied = readJson("applied.show.json");
+    const files = {};
+    const store = {
+        async read() {
+            return undefined;
+        },
+        async put(key, body) {
+            const m = /\/(tf-plan|tf-apply)\/(report|change-set)\.json$/.exec(key);
+            if (m)
+                files[`${m[1]}/${m[2]}.json`] = body;
+        },
+    };
+    for (const stage of ["tf-plan", "tf-apply"]) {
+        await writeReport(store, terraformReport({
+            stage,
+            plan,
+            ...(stage === "tf-apply" ? { applied } : {}),
+            run: FIXTURE_RUN,
+            binary: "choudoufu",
+            rootDir: "estates",
+            estates: FIXTURE_ESTATES,
+            finished: FINISHED[stage],
+        }));
+    }
+    return files;
+}
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1]) {
+    const files = await generateReportFixture();
+    for (const [name, body] of Object.entries(files)) {
+        mkdirSync(dirname(join(here, name)), { recursive: true });
+        writeFileSync(join(here, name), body);
+    }
+    console.log(`wrote ${Object.keys(files).join(", ")}`);
+}

package/dist/applied-state.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What applied, read from `show -json` of a plan made after the apply: its
+ * `prior_state` is the state the apply left (chant#4445). choudoufu refuses a
+ * bare `show` under a `live` block, since there is no state file to show, so
+ * a post-apply plan is the one place its applied values can be read.
+ *
+ * `chant terraform report` (`./report.ts`) and the composed estate run
+ * (`./compose/estate.ts`) both read through {@link priorStateValues}.
+ */
+type Json = Record<string, unknown>;
+/**
+ * The `values` of the state a `show -json` holds: a plan's `prior_state`, or
+ * a state's own `values` when it is a `show -json` of state. Undefined when
+ * it holds neither.
+ */
+export declare function priorStateValues(show: unknown): Json | undefined;
+/** One resource of a state: its values and its sensitivity map. */
+export interface StateResourceValues {
+    values: Json;
+    sensitive: Json;
+}
+/** Every resource of the state a `show -json` holds, by address. A deposed object is left out. */
+export declare function stateResources(show: unknown): Map<string, StateResourceValues>;
+/** The outputs of the state a `show -json` holds, by name, each its value. */
+export declare function stateOutputs(show: unknown): Record<string, unknown>;
+export {};
+//# sourceMappingURL=applied-state.d.ts.map

package/dist/applied-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applied-state.d.ts","sourceRoot":"","sources":["../src/applied-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAIpC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,CAIhE;AAED,mEAAmE;AACnE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,IAAI,CAAC;IACb,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,kGAAkG;AAClG,wBAAgB,cAAc,CAAC,IAAI,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAY9E;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAInE"}

package/dist/applied-state.js

@@ -0,0 +1,44 @@
+/**
+ * What applied, read from `show -json` of a plan made after the apply: its
+ * `prior_state` is the state the apply left (chant#4445). choudoufu refuses a
+ * bare `show` under a `live` block, since there is no state file to show, so
+ * a post-apply plan is the one place its applied values can be read.
+ *
+ * `chant terraform report` (`./report.ts`) and the composed estate run
+ * (`./compose/estate.ts`) both read through {@link priorStateValues}.
+ */
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+/**
+ * The `values` of the state a `show -json` holds: a plan's `prior_state`, or
+ * a state's own `values` when it is a `show -json` of state. Undefined when
+ * it holds neither.
+ */
+export function priorStateValues(show) {
+    const root = isObject(show) ? show : {};
+    const state = isObject(root.prior_state) ? root.prior_state : root;
+    return isObject(state.values) ? state.values : undefined;
+}
+/** Every resource of the state a `show -json` holds, by address. A deposed object is left out. */
+export function stateResources(show) {
+    const out = new Map();
+    const walk = (mod) => {
+        if (!isObject(mod))
+            return;
+        for (const r of Array.isArray(mod.resources) ? mod.resources : []) {
+            if (!isObject(r) || typeof r.address !== "string" || r.deposed_key !== undefined)
+                continue;
+            out.set(r.address, { values: isObject(r.values) ? r.values : {}, sensitive: isObject(r.sensitive_values) ? r.sensitive_values : {} });
+        }
+        for (const c of Array.isArray(mod.child_modules) ? mod.child_modules : [])
+            walk(c);
+    };
+    walk(priorStateValues(show)?.root_module);
+    return out;
+}
+/** The outputs of the state a `show -json` holds, by name, each its value. */
+export function stateOutputs(show) {
+    const outputs = priorStateValues(show)?.outputs;
+    if (!isObject(outputs))
+        return {};
+    return Object.fromEntries(Object.entries(outputs).map(([k, v]) => [k, isObject(v) && "value" in v ? v.value : v]));
+}

package/dist/backend-config.d.ts

@@ -0,0 +1,53 @@
+/**
+ * A root's `-backend-config` (chant#4459): the files it names in
+ * `terraform.roots.<name>.backendConfigFiles` and the pairs in
+ * `backendConfig`, as the flags every init the lexicon runs passes, and the
+ * keys a file holds, as the readers that find a root's state before init see
+ * them.
+ *
+ * Files go first and pairs after, because init applies later flags over
+ * earlier ones and a pair is the more specific of the two. A file's path is
+ * passed as written: init runs in the root's directory, so a relative path
+ * resolves against it, as `varFiles` does. A reader of the file resolves it
+ * the same way.
+ *
+ * Plain node: `op/activities/terraform.ts` imports this, and it stays out of
+ * the HCL parser's dependency graph.
+ */
+/** The two keys of a root that say what init's `-backend-config` flags are. */
+export interface BackendConfigFlags {
+    backendConfigFiles?: readonly string[];
+    backendConfig?: Readonly<Record<string, string>>;
+}
+/** The `-backend-config` values in the order init takes them: each file's path, then each `key=value` pair. Unquoted, one per flag. */
+export declare function backendConfigValues(root: BackendConfigFlags): string[];
+/** {@link backendConfigValues} as argv: `-backend-config=<value>` each. */
+export declare function backendConfigArgs(root: BackendConfigFlags): string[];
+/** A backend-config file's path as init in `dir` reads it: an absolute path as it is, a relative one against `dir`. */
+export declare function backendConfigFilePath(dir: string, file: string): string;
+/**
+ * The text of `body` with everything nested deeper than `level` braces
+ * blanked, newlines kept, so only the attributes at that level are left to
+ * read. Strings are read through, so a brace in one does not count.
+ */
+export declare function blankBelow(body: string, level: number): string;
+/**
+ * The literal attributes of HCL text at brace depth `level` (0 for a file of
+ * bare attributes, 1 for the body of a block given with its header): plain
+ * strings, booleans and numbers, typed as init records them. A string with an
+ * interpolation, and anything that is not one line of `name = literal`, is
+ * left out. Comments are left to the caller to blank.
+ */
+export declare function literalAttributes(text: string, level: number): Record<string, unknown>;
+/** The keys one backend-config file sets: its top-level `key = "value"` lines. Throws when the file cannot be read. */
+export declare function readBackendConfigFile(path: string): Record<string, unknown>;
+/**
+ * The keys a root's backend-config files set, later files over earlier ones,
+ * each path resolved against `dir`; and the files that could not be read,
+ * which init itself will refuse.
+ */
+export declare function backendConfigFileKeys(dir: string, files?: readonly string[]): {
+    config: Record<string, unknown>;
+    unread: string[];
+};
+//# sourceMappingURL=backend-config.d.ts.map

package/dist/backend-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-config.d.ts","sourceRoot":"","sources":["../src/backend-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,+EAA+E;AAC/E,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAED,uIAAuI;AACvI,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAEtE;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,EAAE,CAEpE;AAED,uHAAuH;AACvH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAmB9D;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWtF;AA0BD,uHAAuH;AACvH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,SAAS,MAAM,EAAO,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAWvI"}

package/dist/backend-config.js

@@ -0,0 +1,136 @@
+/**
+ * A root's `-backend-config` (chant#4459): the files it names in
+ * `terraform.roots.<name>.backendConfigFiles` and the pairs in
+ * `backendConfig`, as the flags every init the lexicon runs passes, and the
+ * keys a file holds, as the readers that find a root's state before init see
+ * them.
+ *
+ * Files go first and pairs after, because init applies later flags over
+ * earlier ones and a pair is the more specific of the two. A file's path is
+ * passed as written: init runs in the root's directory, so a relative path
+ * resolves against it, as `varFiles` does. A reader of the file resolves it
+ * the same way.
+ *
+ * Plain node: `op/activities/terraform.ts` imports this, and it stays out of
+ * the HCL parser's dependency graph.
+ */
+import { readFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+/** The `-backend-config` values in the order init takes them: each file's path, then each `key=value` pair. Unquoted, one per flag. */
+export function backendConfigValues(root) {
+    return [...(root.backendConfigFiles ?? []), ...Object.entries(root.backendConfig ?? {}).map(([k, v]) => `${k}=${v}`)];
+}
+/** {@link backendConfigValues} as argv: `-backend-config=<value>` each. */
+export function backendConfigArgs(root) {
+    return backendConfigValues(root).map((v) => `-backend-config=${v}`);
+}
+/** A backend-config file's path as init in `dir` reads it: an absolute path as it is, a relative one against `dir`. */
+export function backendConfigFilePath(dir, file) {
+    return isAbsolute(file) ? file : resolve(dir, file);
+}
+/**
+ * The text of `body` with everything nested deeper than `level` braces
+ * blanked, newlines kept, so only the attributes at that level are left to
+ * read. Strings are read through, so a brace in one does not count.
+ */
+export function blankBelow(body, level) {
+    const out = body.split("");
+    let depth = 0;
+    let inString = false;
+    for (let i = 0; i < body.length; i++) {
+        const c = body[i];
+        if (depth > level && c !== "\n")
+            out[i] = " ";
+        if (inString) {
+            if (c === "\\") {
+                if (depth > level && body[i + 1] !== undefined && body[i + 1] !== "\n")
+                    out[i + 1] = " ";
+                i++;
+            }
+            else if (c === '"')
+                inString = false;
+            continue;
+        }
+        if (c === '"')
+            inString = true;
+        else if (c === "{")
+            depth++;
+        else if (c === "}")
+            depth--;
+    }
+    return out.join("");
+}
+/**
+ * The literal attributes of HCL text at brace depth `level` (0 for a file of
+ * bare attributes, 1 for the body of a block given with its header): plain
+ * strings, booleans and numbers, typed as init records them. A string with an
+ * interpolation, and anything that is not one line of `name = literal`, is
+ * left out. Comments are left to the caller to blank.
+ */
+export function literalAttributes(text, level) {
+    const out = {};
+    for (const m of blankBelow(text, level).matchAll(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*("(?:[^"\\]|\\.)*"|true|false|-?\d+(?:\.\d+)?)\s*$/gm)) {
+        const raw = m[2];
+        if (raw.startsWith('"')) {
+            const s = raw.slice(1, -1);
+            if (/\$\{|%\{/.test(s))
+                continue;
+            out[m[1]] = s.replace(/\\(.)/g, "$1");
+        }
+        else
+            out[m[1]] = raw === "true" ? true : raw === "false" ? false : Number(raw);
+    }
+    return out;
+}
+/** HCL text with its `#`, `//` and `/* *\/` comments blanked, strings read through. */
+function withoutComments(text) {
+    const out = text.split("");
+    let inString = false;
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (inString) {
+            if (c === "\\")
+                i++;
+            else if (c === '"')
+                inString = false;
+            continue;
+        }
+        if (c === '"')
+            inString = true;
+        else if (c === "#" || (c === "/" && text[i + 1] === "/")) {
+            for (; i < text.length && text[i] !== "\n"; i++)
+                out[i] = " ";
+        }
+        else if (c === "/" && text[i + 1] === "*") {
+            const end = text.indexOf("*/", i + 2);
+            const stop = end < 0 ? text.length : end + 2;
+            for (; i < stop; i++)
+                if (text[i] !== "\n")
+                    out[i] = " ";
+            i--;
+        }
+    }
+    return out.join("");
+}
+/** The keys one backend-config file sets: its top-level `key = "value"` lines. Throws when the file cannot be read. */
+export function readBackendConfigFile(path) {
+    return literalAttributes(withoutComments(readFileSync(path, "utf-8")), 0);
+}
+/**
+ * The keys a root's backend-config files set, later files over earlier ones,
+ * each path resolved against `dir`; and the files that could not be read,
+ * which init itself will refuse.
+ */
+export function backendConfigFileKeys(dir, files = []) {
+    const config = {};
+    const unread = [];
+    for (const f of files) {
+        try {
+            Object.assign(config, readBackendConfigFile(backendConfigFilePath(dir, f)));
+        }
+        catch {
+            unread.push(f);
+        }
+    }
+    return { config, unread };
+}

package/dist/behaviour/kinds.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kinds.d.ts","sourceRoot":"","sources":["../../src/behaviour/kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AA4G7D;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAmB/F,CAAC;AAoBF,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,EAAE,cAiBrC,CAAC"}
+{"version":3,"file":"kinds.d.ts","sourceRoot":"","sources":["../../src/behaviour/kinds.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAEvE,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAgH7D;;;;GAIG;AACH,eAAO,MAAM,8BAA8B,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAmB/F,CAAC;AAoBF,gDAAgD;AAChD,eAAO,MAAM,uBAAuB,EAAE,cAiBrC,CAAC"}

package/dist/behaviour/kinds.js

@@ -127,6 +127,10 @@ const BLOCKS = {
     "Terraform::Module": "a call to a child module; the blocks the call expands to are entities of their own and carry the figures",
     "Terraform::Data": "a read of something that exists outside this root; whatever it reads is priced where it is declared",
     "Terraform::Live": "choudoufu's estate declaration, which names the ownership marker every resource of the root carries and holds nothing itself",
+    "Terraform::Moved": "an instruction to rename an address in state; the resource it names carries the figures",
+    "Terraform::Import": "an instruction to adopt an existing object into state; the resource it names carries the figures",
+    "Terraform::Removed": "an instruction to drop an address from state; nothing is created by it",
+    "Terraform::Check": "an assertion terraform evaluates after a plan or apply, which holds nothing in any account",
 };
 /**
  * Provider prefixes that are a substrate boundary rather than a missing row,

package/dist/behaviour/predict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"predict.d.ts","sourceRoot":"","sources":["../../src/behaviour/predict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAE7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK1F,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,WAAW,CAAC;AAEnB,oDAAoD;AACpD,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxC;;;;OAIG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;IAC5E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;OAeG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CAC3B;AAmBD,6FAA6F;AAC7F,MAAM,MAAM,0BAA0B,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAElH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,0BA0BtC,CAAC;AAKF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,uBAAuB,EAChC,SAAS,GAAE,0BAAqD,GAC/D,OAAO,CAAC,uBAAuB,CAAC,CA+ClC;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,GACtD,MAAM,EAAE,CAQV;AAQD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,IAAI,GAAE,sBAAkC,GACvC,OAAO,CAAC,eAAe,CAAC,CA4E1B"}
+{"version":3,"file":"predict.d.ts","sourceRoot":"","sources":["../../src/behaviour/predict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAE7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK1F,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,WAAW,CAAC;AAEnB,oDAAoD;AACpD,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxC;;;;OAIG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;IAC5E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;OAeG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CAC3B;AAmBD,6FAA6F;AAC7F,MAAM,MAAM,0BAA0B,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAElH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,0BA6BtC,CAAC;AAKF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,uBAAuB,EAChC,SAAS,GAAE,0BAAqD,GAC/D,OAAO,CAAC,uBAAuB,CAAC,CA+ClC;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,GACtD,MAAM,EAAE,CAQV;AAQD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,IAAI,GAAE,sBAAkC,GACvC,OAAO,CAAC,eAAe,CAAC,CA4E1B"}

package/dist/behaviour/predict.js

@@ -90,11 +90,15 @@ export const readTerraformDeclaration = async (cwd) => {
     const { config, configPath } = await loadChantConfigUpward(start);
     const namespace = config.terraform;
     const entities = new Map();
-    if (!namespace?.roots || Object.keys(namespace.roots).length === 0)
+    // A `signalOnly` root (#4484) builds nothing, as in `buildRoots`.
+    if (!namespace)
+        return entities;
+    const roots = Object.fromEntries(Object.entries(namespace.roots ?? {}).filter(([, r]) => r.signalOnly !== true));
+    if (Object.keys(roots).length === 0)
         return entities;
     const rendered = await renderTerraformRoots({
         projectRoot: configPath ? dirname(configPath) : start,
-        roots: namespace.roots,
+        roots,
         binary: namespace.binary,
         callModuleType: namespace.callModuleType,
         moduleRoot: namespace.moduleRoot,

package/dist/behaviour/reference-catalog.d.ts

@@ -16,11 +16,22 @@
  * Every terraform `resource` block is `Terraform::Resource` to chant. A rule
  * keyed on that would apply to a VPC and an instance alike, so the nodes
  * `./request.ts` builds for the resolver carry the **provider type** as their
- * `kind` — `aws_subnet` — and the rules here are keyed the same way. That is
- * also why this catalog is not declared on the plugin as `referenceCatalog`:
- * `chant graph --live` builds its nodes with `kind: "Terraform::Resource"`
- * and attributes that carry no arguments at all, so declaring it there would
- * be a catalog that matched nothing and looked like coverage.
+ * `kind` — `aws_subnet` — and the rules here are keyed the same way.
+ *
+ * ## On the plugin (#4535)
+ *
+ * The plugin declares it as `referenceCatalog` since #4535, so a reader that
+ * asks every lexicon of a graph for its catalog (behold#1030's gate, before
+ * behold#1005 retires behold's name matcher) finds terraform's. What it
+ * matches depends on the nodes. A declared or live `chant graph` node is
+ * `Terraform::Resource`, with its provider type in `attrs.type` and no
+ * arguments in `attrs`, so no rule here reads it: those graphs keep the edges
+ * the HCL references and the state dependencies give them, and gain none. A
+ * node whose `kind` is the provider type and whose `attrs` are the block's
+ * arguments (`./request.ts`'s, an engine's instance roster) is what the rules
+ * are for. `chant graph --live` merges a catalog's edges with the
+ * observation's own since #4535; before, any catalog replaced them, which is
+ * what kept this one off the plugin.
  *
  * ## Two relations, and why the split matters to an engine
  *

package/dist/behaviour/reference-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reference-catalog.d.ts","sourceRoot":"","sources":["../../src/behaviour/reference-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAMjD,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,2BAA2B,EAAE,gBA8FzC,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAgE,CAAC;AAElH;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD"}
+{"version":3,"file":"reference-catalog.d.ts","sourceRoot":"","sources":["../../src/behaviour/reference-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAMjD,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,2BAA2B,EAAE,gBA8FzC,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAgE,CAAC;AAElH;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD"}

package/dist/behaviour/reference-catalog.js

@@ -16,11 +16,22 @@
  * Every terraform `resource` block is `Terraform::Resource` to chant. A rule
  * keyed on that would apply to a VPC and an instance alike, so the nodes
  * `./request.ts` builds for the resolver carry the **provider type** as their
- * `kind` — `aws_subnet` — and the rules here are keyed the same way. That is
- * also why this catalog is not declared on the plugin as `referenceCatalog`:
- * `chant graph --live` builds its nodes with `kind: "Terraform::Resource"`
- * and attributes that carry no arguments at all, so declaring it there would
- * be a catalog that matched nothing and looked like coverage.
+ * `kind` — `aws_subnet` — and the rules here are keyed the same way.
+ *
+ * ## On the plugin (#4535)
+ *
+ * The plugin declares it as `referenceCatalog` since #4535, so a reader that
+ * asks every lexicon of a graph for its catalog (behold#1030's gate, before
+ * behold#1005 retires behold's name matcher) finds terraform's. What it
+ * matches depends on the nodes. A declared or live `chant graph` node is
+ * `Terraform::Resource`, with its provider type in `attrs.type` and no
+ * arguments in `attrs`, so no rule here reads it: those graphs keep the edges
+ * the HCL references and the state dependencies give them, and gain none. A
+ * node whose `kind` is the provider type and whose `attrs` are the block's
+ * arguments (`./request.ts`'s, an engine's instance roster) is what the rules
+ * are for. `chant graph --live` merges a catalog's edges with the
+ * observation's own since #4535; before, any catalog replaced them, which is
+ * what kept this one off the plugin.
  *
  * ## Two relations, and why the split matters to an engine
  *

package/dist/behaviour/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/behaviour/request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAU,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAI/B;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACzC;AAED,qDAAqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gCACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IACxH,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD;;;;OAIG;IACH,IAAI,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,iGAAiG;IACjG,OAAO,EAAE,uBAAuB,CAAC;IACjC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC;IAC7C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAQD,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3D;AAmCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,UAAU,EAAE,SAAS,eAAe,EAAE,EACtC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC7C,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB;AAgRD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,kBAAkB,CAAC,EACxE,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,qBAAqB,CASvB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CA8D9G"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/behaviour/request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAU,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAI/B;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACzC;AAED,qDAAqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gCACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IACxH,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD;;;;OAIG;IACH,IAAI,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,iGAAiG;IACjG,OAAO,EAAE,uBAAuB,CAAC;IACjC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC;IAC7C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAQD,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3D;AAmCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,UAAU,EAAE,SAAS,eAAe,EAAE,EACtC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC7C,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB;AAiRD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,kBAAkB,CAAC,EACxE,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,qBAAqB,CASvB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CA8D9G"}

package/dist/behaviour/request.js

@@ -202,8 +202,9 @@ function liveVerdictOf(address, plan) {
             kind: "unobserved",
             instances,
             // `no-credentials` is an observation reason and not a prediction one;
-            // the credential wording stays in the detail.
-            reason: unobserved.reason === "no-credentials" ? "read-failed" : unobserved.reason,
+            // the credential wording stays in the detail. `not-reached` is a
+            // stream's reason (#4451) and a live-plan omission never gives it.
+            reason: unobserved.reason === "no-credentials" || unobserved.reason === "not-reached" ? "read-failed" : unobserved.reason,
             detail: unobserved.detail,
         };
     }

package/dist/changed-roots.d.ts

@@ -9,9 +9,11 @@
  * in a local module it calls (followed through modules that call modules),
  * or is one of its var files.
  *
- * The module calls are read with a regex over the root's `.tf` and `.tofu`
+ * The module calls are read with a regex over the root's HCL configuration
  * files, the way `./op/activities/live-detect.ts` reads a live block, so
- * this stays out of the HCL parser's dependency graph. Only a `source` that
+ * this stays out of the HCL parser's dependency graph. Which files those are
+ * follows the root's binary through the lexicon's one lister (chant#4457):
+ * `.tf`, plus `.tofu` for a tofu or choudoufu root. Only a `source` that
  * starts with `./` or `../` is followed; a registry or git source is a
  * version pin in the root's own files, which a change to it already touches.
  */
@@ -20,11 +22,11 @@ import type { TerraformRootConfig } from "./config.js";
  * Every path, relative to `projectRoot`, whose change touches `root`: its
  * directory, each local module it reaches, and its var files.
  */
-export declare function rootWatchPaths(projectRoot: string, root: Pick<TerraformRootConfig, "dir" | "varFiles">): string[];
+export declare function rootWatchPaths(projectRoot: string, root: Pick<TerraformRootConfig, "dir" | "varFiles">, binary?: string): string[];
 /**
  * The names of the roots in `roots` that a change to `changedFiles` touches,
  * sorted. `changedFiles` are relative to `projectRoot` with `/` separators,
  * as `git diff --name-only --relative` prints them.
  */
-export declare function changedRoots(projectRoot: string, roots: Record<string, Pick<TerraformRootConfig, "dir" | "varFiles">>, changedFiles: readonly string[]): string[];
+export declare function changedRoots(projectRoot: string, roots: Record<string, Pick<TerraformRootConfig, "dir" | "varFiles">>, changedFiles: readonly string[], binary?: string): string[];
 //# sourceMappingURL=changed-roots.d.ts.map

package/dist/changed-roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"changed-roots.d.ts","sourceRoot":"","sources":["../src/changed-roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAuCpD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,UAAU,CAAC,GAAG,MAAM,EAAE,CAajH;AAQD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC,EACpE,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,EAAE,CAQV"}
+{"version":3,"file":"changed-roots.d.ts","sourceRoot":"","sources":["../src/changed-roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAkCpD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,UAAU,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAalI;AAQD;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,UAAU,CAAC,CAAC,EACpE,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,EAAE,CAQV"}