@intentius/chant-lexicon-terraform 0.124.51 → 0.124.54

package/dist/op/activities/terraform.js

@@ -44,10 +44,12 @@ import { tmpdir } from "node:os";
 import { promisify } from "node:util";
 import { resolve, dirname, join, relative, sep } from "node:path";
 import { loadChantConfigUpward } from "@intentius/chant/config";
+import { findWorkspaceRoot } from "@intentius/chant/project-root";
 import { liveReadKey, memoLiveRead } from "@intentius/chant/live-read-session";
 import { terraformPlanDigest } from "../../plan-digest.js";
 import { choudoufuSetPlanParts, plannerForBinary, terraformChangeSetPart } from "../../change-set.js";
 import { detectLiveEstate } from "./live-detect.js";
+import { backendConfigValues } from "../../backend-config.js";
 import { parseAdoptionCommands, readAdoptionLedger, renderAdoptionLedger, } from "../adoption.js";
 const execAsync = promisify(exec);
 /**
@@ -100,6 +102,34 @@ export const MIN_CHOUDOUFU_VERSION = "0.15.0";
  * choudoufu#1754, and {@link choudoufuPlanSet} refuses it.
  */
 export const MIN_CHOUDOUFU_WAVES_VERSION = "0.22.0";
+/**
+ * The choudoufu release a composed run of estates needs (#4445): a root with
+ * no `live` block that calls estate directories as modules, planned and
+ * applied as one walk, with a `terraform_estate_outputs` read of another
+ * estate in the run answered inside it (choudoufu#2059, first released in
+ * v0.31.0). Only the composed estate run (`compose/estate.ts`) checks it;
+ * below it the members plan wave by wave. A dev build names no release and
+ * passes, as for the other floors.
+ */
+export const MIN_CHOUDOUFU_ESTATES_VERSION = "0.31.0";
+/**
+ * The choudoufu release whose `live-graph -json -from-plan=<file>` prints the
+ * engine graph document (chant#4520's design section 4, choudoufu#2285), the
+ * one `describeResources()` reads engine facts from on a live root
+ * (chant#4528). choudoufu's changelog lists the command under
+ * `v0.32.0 (Unreleased)`, so this is the version it releases as. The chant
+ * side of the same contract, the first chant that writes those facts, is
+ * `ENGINE_FACTS_FLOOR` in core's engine-facts.ts, which is NEXT_RELEASE
+ * until the cut.
+ *
+ * Not a refusal. Facts are for people and never feed a decision, so a
+ * choudoufu without the command (a usage error, see
+ * {@link classifyLiveGraphFailure}) leaves `facts` absent with one note
+ * naming this version, and the rest of the read is unchanged. The check is
+ * the capability, not the version string: a local or dev build names a
+ * version below this or none at all, and still carries the command.
+ */
+export const MIN_CHOUDOUFU_GRAPH_VERSION = "0.32.0";
 /**
  * Where a choudoufu root's wave files live, relative to the project root:
  * `<root>/plan-set.json` (the set plan document chant planned and the
@@ -151,16 +181,21 @@ export function terraformEnvironment(root) {
         ...(root?.workspace ? { TF_WORKSPACE: root.workspace } : {}),
     };
 }
-/** `terraform init`, with the root's `backendConfig` as `-backend-config=k=v` flags. */
+/**
+ * `terraform init`, with the root's `backendConfigFiles` as
+ * `-backend-config=<path>` flags and then its `backendConfig` as
+ * `-backend-config=k=v` flags (chant#4459): init applies later flags over
+ * earlier ones, so a pair overrides a file. A path is passed as written; init
+ * runs in the root's directory, which a relative one resolves against.
+ */
 export function terraformInitCommand(opts) {
     const parts = [opts.binary, "init", "-input=false"];
     if (opts.upgrade)
         parts.push("-upgrade");
     if (opts.reconfigure)
         parts.push("-reconfigure");
-    for (const [key, value] of Object.entries(opts.backendConfig ?? {})) {
-        parts.push(`-backend-config=${quoteArg(`${key}=${value}`)}`);
-    }
+    for (const value of backendConfigValues(opts))
+        parts.push(`-backend-config=${quoteArg(value)}`);
     return parts.join(" ");
 }
 /**
@@ -229,6 +264,39 @@ export function choudoufuLivePlanCommand(opts) {
         parts.push(`-estate=${quoteArg(opts.estate)}`);
     return parts.join(" ");
 }
+/**
+ * `live-graph -json -from-plan=<file> [-estate=<estate>]` (choudoufu#2285).
+ * No `DIR` argument: like {@link choudoufuLiveCheckCommand}, the activity
+ * runs in the root directory, which is DIR's default. `-estate` follows
+ * {@link choudoufuLivePlanCommand}'s rule: only for a root that does not
+ * name its own estate. `-history` is never passed: record versions take a
+ * listing per record and `s3:ListBucketVersions`, and an observation read
+ * has no use for them (the #4520 ruling, Q6: opt-in).
+ */
+export function choudoufuLiveGraphCommand(opts) {
+    const parts = [opts.binary, "live-graph", "-json", `-from-plan=${quoteArg(opts.fromPlan)}`];
+    if (opts.estate !== undefined)
+        parts.push(`-estate=${quoteArg(opts.estate)}`);
+    return parts.join(" ");
+}
+/**
+ * Whether a failed `live-graph` run is a choudoufu that has no such command
+ * or flag (`"unsupported"`), or a real failure (`"failed"`). Older builds
+ * answer an unknown command two ways: the new CLI prints `OpenTofu has no
+ * command named "live-graph"` and exits 1 (cmd/choudoufu/command_main.go),
+ * and the older mitchellh/cli path prints its usage and exits 127. A build
+ * whose `live-graph` predates `-from-plan` fails the flag parse with `flag
+ * provided but not defined`.
+ */
+export function classifyLiveGraphFailure(code, output) {
+    if (code === 127)
+        return "unsupported";
+    if (/no command named "?live-graph"?/i.test(output))
+        return "unsupported";
+    if (/flag provided but not defined: -(?:from-plan|json|estate)\b/.test(output))
+        return "unsupported";
+    return "failed";
+}
 /** `live-ls -estate=<estate> -json [-consistent]`. */
 export function choudoufuLiveLsCommand(opts) {
     const parts = [opts.binary, "live-ls", `-estate=${quoteArg(opts.estate)}`, "-json"];
@@ -477,8 +545,8 @@ function report(stdout, stderr) {
 }
 // ── Activities ──────────────────────────────────────────────────────────────
 /**
- * `terraform init` in the named root, with the root's `backendConfig` supplied
- * as `-backend-config` flags. Uses the longInfra profile: init downloads
+ * `terraform init` in the named root, with the root's `backendConfigFiles` and
+ * `backendConfig` supplied as `-backend-config` flags. Uses the longInfra profile: init downloads
  * providers and modules, a network call of unpredictable size.
  */
 export async function terraformInit(args, signal) {
@@ -486,16 +554,53 @@ export async function terraformInit(args, signal) {
     const cmd = terraformInitCommand({
         binary,
         ...(root.backendConfig ? { backendConfig: root.backendConfig } : {}),
+        ...(root.backendConfigFiles ? { backendConfigFiles: root.backendConfigFiles } : {}),
         ...(args.upgrade ? { upgrade: true } : {}),
         ...(args.reconfigure ? { reconfigure: true } : {}),
     });
-    const { stdout, stderr } = await run(cmd, dir, terraformEnvironment(root), signal);
-    report(stdout, stderr);
-    return { dir, ...(root.workspace ? { workspace: root.workspace } : {}) };
+    // Known once the root resolves, before init runs (chant#4512), so a failed
+    // init still publishes them and the ledger names the root it was for.
+    const rootPath = workspaceRelativePath(dir);
+    const result = { dir, ...(root.workspace ? { workspace: root.workspace } : {}), ...(rootPath !== undefined ? { rootPath } : {}) };
+    let out;
+    try {
+        out = await run(cmd, dir, terraformEnvironment(root), signal);
+    }
+    catch (err) {
+        throw withKnownOutputs(err, result);
+    }
+    report(out.stdout, out.stderr);
+    return result;
+}
+/**
+ * `err` carrying `outputs` as the outputs the activity knew when it failed
+ * (chant#4512): the `knownOutputs` property core's executor reads a failed
+ * step's outcome attributes from (core's `withKnownOutputs`). It is set here
+ * rather than imported so the lexicon needs no newer core; an older executor
+ * reads the error as any other failure.
+ */
+function withKnownOutputs(err, outputs) {
+    const e = err instanceof Error ? err : new Error(String(err));
+    return Object.assign(e, { knownOutputs: outputs });
+}
+/**
+ * `dir` relative to the chant workspace that holds it, `/`-separated, or
+ * undefined outside a workspace or outside its root (chant#4482). The
+ * workspace root `"."` stands for itself.
+ */
+export function workspaceRelativePath(dir) {
+    const found = findWorkspaceRoot(dir);
+    if (!found)
+        return undefined;
+    const rel = relative(found.dir, dir);
+    if (rel.startsWith(".."))
+        return undefined;
+    return rel === "" ? "." : rel.split(sep).join("/");
 }
 /**
  * `terraform plan -detailed-exitcode -out=<planFile>` in the named root, then
- * `terraform show` over the written plan in both `-json` and `-no-color` form.
+ * `terraform show` over the written plan in both `-json` and `-no-color` form
+ * (`-json` alone with `text: false`).
  *
  * The exit code is the answer, not an error condition: 0 is a plan with no
  * changes, 2 is a plan with changes, and anything else, 1 included, is a
@@ -538,14 +643,14 @@ export async function terraformPlan(args, signal) {
         changed = true;
     }
     const jsonRun = await run(terraformShowCommand({ binary, json: true, planFile }), dir, env, signal);
-    const textRun = await run(terraformShowCommand({ binary, json: false, planFile }), dir, env, signal);
+    const text = args.text === false ? "" : (await run(terraformShowCommand({ binary, json: false, planFile }), dir, env, signal)).stdout;
     const json = JSON.parse(jsonRun.stdout);
     return {
         changed,
         planFile,
         dir,
         json,
-        text: textRun.stdout,
+        text,
         planDigest: terraformPlanDigest(json),
         changeSet: terraformChangeSetPart({
             member: args.root,
@@ -629,7 +734,10 @@ export async function terraformApply(args, signal) {
  * asked for the values to hand them on.
  */
 export async function terraformOutputs(args, signal) {
-    const { binary, root, dir } = await resolveRoot(args, signal);
+    return outputsIn(await resolveRoot(args, signal), signal);
+}
+/** `<binary> output -json` in a resolved root, as `{ name: value }`. */
+async function outputsIn({ binary, root, dir }, signal) {
     const { stdout } = await run(`${binary} output -json`, dir, terraformEnvironment(root), signal);
     const parsed = JSON.parse(stdout || "{}");
     return Object.fromEntries(Object.entries(parsed).map(([name, entry]) => [name, entry?.value]));
@@ -694,7 +802,7 @@ export async function choudoufuWaveRoot(args, signal) {
     if (resolved.root.varFiles && resolved.root.varFiles.length > 0) {
         return { wave: false, reason: "the root has var files, which live-plan-set does not take" };
     }
-    if (resolved.root.backendConfig && Object.keys(resolved.root.backendConfig).length > 0) {
+    if ((resolved.root.backendConfig && Object.keys(resolved.root.backendConfig).length > 0) || (resolved.root.backendConfigFiles?.length ?? 0) > 0) {
         return { wave: false, reason: "the root has backend config, which live-plan-set does not take" };
     }
     const root = choudoufuSetRootPath(resolved.projectRoot, resolved.dir);
@@ -764,15 +872,18 @@ function fromProject(projectRoot, path) {
  * `live-wave-apply` hands back to choudoufu with the set digest.
  */
 export async function choudoufuPlanSet(args, signal) {
-    const resolved = await resolveRoot(args, signal);
+    return planSetIn(await resolveRoot(args, signal), args.root, signal);
+}
+/** {@link choudoufuPlanSet} over a resolved root, `key` naming it in errors, in the waves directory and as the change-set member. */
+async function planSetIn(resolved, key, signal) {
     const { binary, root, dir, projectRoot } = resolved;
     if (binary !== "choudoufu")
-        throw new Error(`choudoufuPlanSet: root "${args.root}" runs ${binary}, not choudoufu`);
+        throw new Error(`choudoufuPlanSet: root "${key}" runs ${binary}, not choudoufu`);
     await ensureChoudoufuWavesVersion(binary, signal);
     const rootPath = choudoufuSetRootPath(projectRoot, dir);
     if (rootPath === undefined)
-        throw new Error(`choudoufuPlanSet: root "${args.root}" (${dir}) is not inside ${projectRoot}`);
-    const wavesDir = choudoufuWavesDir(projectRoot, args.root);
+        throw new Error(`choudoufuPlanSet: root "${key}" (${dir}) is not inside ${projectRoot}`);
+    const wavesDir = choudoufuWavesDir(projectRoot, key);
     mkdirSync(wavesDir, { recursive: true });
     const cmd = choudoufuPlanSetCommand({ binary, root: rootPath, outDir: fromProject(projectRoot, join(wavesDir, "out")) });
     let stdout;
@@ -790,11 +901,42 @@ export async function choudoufuPlanSet(args, signal) {
         report("", failure.stderr ?? "");
         stdout = failure.stdout ?? "";
     }
-    const parsed = parseChoudoufuPlanSet(stdout, { member: args.root, root: rootPath });
+    const parsed = parseChoudoufuPlanSet(stdout, { member: key, root: rootPath });
     const planSetFile = join(wavesDir, "plan-set.json");
     writeFileSync(planSetFile, stdout);
     return { ...parsed, planSetFile, root: rootPath };
 }
+async function resolveMemberRoot(args, signal) {
+    const binary = "choudoufu";
+    await ensureChoudoufuVersion(binary, signal);
+    const dir = resolve(args.dir);
+    const estate = detectLiveEstate(dir);
+    return { binary, root: { dir }, dir, ...(estate !== undefined ? { estate } : {}), live: estate !== undefined, projectRoot: resolve(args.projectRoot) };
+}
+/**
+ * The member's outputs as applied (#4455): `choudoufu init`, then `choudoufu
+ * output -json` in its directory, the read the `terraform-apply` capability's
+ * `outputs` makes for a root. A live estate's outputs come from its record
+ * store.
+ */
+export async function choudoufuMemberOutputs(args, signal) {
+    const resolved = await resolveMemberRoot(args, signal);
+    const { stdout, stderr } = await run(terraformInitCommand({ binary: resolved.binary }), resolved.dir, terraformEnvironment(resolved.root), signal);
+    report(stdout, stderr);
+    return outputsIn(resolved, signal);
+}
+/**
+ * The member planned as a one-root set (#4455), the way a choudoufu root in
+ * a gated wave is ({@link choudoufuPlanSet}): `live-plan-set -json` from
+ * `projectRoot`. The document's embedded plan carries `planned_values` and
+ * `output_changes`, which say what the member's outputs will be.
+ */
+export async function choudoufuMemberPlanSet(args, signal) {
+    const resolved = await resolveMemberRoot(args, signal);
+    if (!resolved.live)
+        throw new Error(`choudoufu member "${args.member}" (${resolved.dir}) declares no live estate, so live-plan-set cannot plan it`);
+    return planSetIn(resolved, args.member, signal);
+}
 /**
  * The resume file to hand choudoufu for `setDigest`, from what an earlier
  * attempt carried, or `undefined`. choudoufu refuses a resume file written
@@ -958,6 +1100,7 @@ export function terraformInitLine(opts) {
     const init = terraformInitCommand({
         binary: opts.binary,
         ...(opts.backendConfig ? { backendConfig: opts.backendConfig } : {}),
+        ...(opts.backendConfigFiles ? { backendConfigFiles: opts.backendConfigFiles } : {}),
     });
     return init.replace(`${opts.binary} init`, `${opts.binary} -chdir=${quoteArg(opts.dir)} init`);
 }
@@ -1019,7 +1162,12 @@ export function rootIsInitialised(dir, env = process.env) {
 export async function terraformPlanRead(args, signal) {
     const { binary, root, dir } = await resolveRoot(args, signal);
     const env = terraformEnvironment(root);
-    const initLine = terraformInitLine({ binary, dir, ...(root.backendConfig ? { backendConfig: root.backendConfig } : {}) });
+    const initLine = terraformInitLine({
+        binary,
+        dir,
+        ...(root.backendConfig ? { backendConfig: root.backendConfig } : {}),
+        ...(root.backendConfigFiles ? { backendConfigFiles: root.backendConfigFiles } : {}),
+    });
     const notInitialised = (detail) => new TerraformPlanReadError("not-initialised", `terraform.roots.${args.root} (${dir}) ${detail}: run \`${initLine}\` first. chant never runs init on a read, since init writes into the root.`, dir, initLine);
     if (!rootIsInitialised(dir, { ...process.env, ...env }))
         throw notInitialised("has never been initialised");
@@ -1255,6 +1403,43 @@ export async function choudoufuLivePlan(args, signal) {
         ...parseChoudoufuPlanSummary(text),
     };
 }
+/**
+ * `choudoufu live-graph -json -from-plan=<file>` (choudoufu#2285, read by
+ * chant#4528): the root's graph as one engine graph document, its facts taken
+ * from a `live-plan -json` document this process already read. No second live
+ * read: choudoufu builds the graph from the configuration and that file
+ * alone, starts no provider and calls no cloud, so facts and verdicts come
+ * from the same refresh (choudoufu #1014).
+ *
+ * A usage error ({@link classifyLiveGraphFailure}) resolves `supported:
+ * false` rather than throwing, since the caller degrades to no facts; any
+ * other failure throws with choudoufu's output. Warnings (an empty scope
+ * estate, a plan without `observed_at`) go to stderr and are echoed like
+ * every other activity's.
+ */
+export async function choudoufuLiveGraph(args, signal) {
+    const resolved = await resolveRoot(args, signal);
+    const { binary, dir } = resolved;
+    const env = terraformEnvironment(resolved.root);
+    const estateFlag = resolved.estate === undefined && args.estate !== undefined ? { estate: args.estate } : {};
+    const cmd = choudoufuLiveGraphCommand({ binary, fromPlan: args.fromPlan, ...estateFlag });
+    try {
+        const { stdout, stderr } = await run(cmd, dir, env, signal);
+        if (stderr)
+            console.error(stderr);
+        return { supported: true, json: JSON.parse(liveDocumentFrom(stdout)), dir };
+    }
+    catch (err) {
+        const failure = err;
+        if (typeof failure.code !== "number")
+            throw err;
+        const output = `${failure.stderr ?? ""}\n${failure.stdout ?? ""}`;
+        const detail = output.trim().split("\n").find((line) => line.trim() !== "")?.trim() ?? `exit ${failure.code}`;
+        if (classifyLiveGraphFailure(failure.code, output) === "unsupported")
+            return { supported: false, detail, dir };
+        throw new Error(`${binary} live-graph failed in ${dir} (exit ${failure.code})${detail ? `\n${output.trim()}` : ""}`);
+    }
+}
 /**
  * `choudoufu live-ls -estate=<estate> -json [-consistent]`: every resource
  * the account holds under the estate, read straight from the Resource Groups

package/dist/op/activity-contracts.d.ts

@@ -37,6 +37,7 @@ export declare const terraformInitContract: import("@intentius/chant/op").Activi
 }, {
     dir: string;
     workspace?: string | undefined;
+    rootPath?: string | undefined;
 }>;
 export declare const terraformPlanContract: import("@intentius/chant/op").ActivityContract<{
     root: string;
@@ -155,6 +156,32 @@ export declare const choudoufuAdoptContract: import("@intentius/chant/op").Activ
     ambiguous: number;
     dir: string;
 }>;
+/**
+ * `choudoufuPlanSet` (#4483): one live choudoufu root planned as a one-root
+ * set. `changeSet` is the root's part, the field an Op hands to
+ * `composeChangeSet`; `planDigest` is what a gate binds; `planSetFile` and
+ * `setDigest` are what a later `live-wave-apply` takes.
+ */
+export declare const choudoufuPlanSetContract: import("@intentius/chant/op").ActivityContract<{
+    root: string;
+    cwd?: string | undefined;
+}, {
+    setDigest: string;
+    rootDigest: string;
+    planDigest: string;
+    changed: boolean;
+    json: unknown;
+    changeSet: {
+        member: {
+            [x: string]: unknown;
+            member: string;
+            planDigest: string | null;
+        };
+        entries: unknown[];
+    };
+    planSetFile: string;
+    root: string;
+}>;
 /**
  * `terraformPinRollout` (#3189). It names no `terraform.roots` key: a rollout
  * moves a module's pin across many roots, found by directory, so it carries no

package/dist/op/activity-contracts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../src/op/activity-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AA+BH,eAAO,MAAM,qBAAqB;;;;;;;;EASjC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;EAoBjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;EAWlC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;EAYjC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;EASnC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;EAKtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;EAgBlC,CAAC;AAKF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BvC,CAAC"}
+{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../src/op/activity-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AA+BH,eAAO,MAAM,qBAAqB;;;;;;;;;EAUjC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;EAoBjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;EAWlC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;EAYjC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;EASnC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;EAKtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;EAgBlC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;EAcpC,CAAC;AAKF;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4BvC,CAAC"}

package/dist/op/activity-contracts.js

@@ -57,7 +57,9 @@ export const terraformInitContract = activityContract("terraformInit", z.strictO
     ...rootArgs,
     upgrade: z.boolean().optional(),
     reconfigure: z.boolean().optional(),
-}), z.object({ dir: z.string(), workspace: z.string().optional() }), rootEntity);
+}), 
+// `rootPath` (#4482) is what TerraformApplyOp's Init step publishes as `TerraformRootPath`; OPS012 checks it here.
+z.object({ dir: z.string(), workspace: z.string().optional(), rootPath: z.string().optional() }), rootEntity);
 export const terraformPlanContract = activityContract("terraformPlan", z.strictObject({
     ...rootArgs,
     planFile: z.string().optional(),
@@ -127,6 +129,22 @@ export const choudoufuAdoptContract = activityContract("choudoufuAdopt", z.stric
     ambiguous: z.number(),
     dir: z.string(),
 }), rootEntity);
+/**
+ * `choudoufuPlanSet` (#4483): one live choudoufu root planned as a one-root
+ * set. `changeSet` is the root's part, the field an Op hands to
+ * `composeChangeSet`; `planDigest` is what a gate binds; `planSetFile` and
+ * `setDigest` are what a later `live-wave-apply` takes.
+ */
+export const choudoufuPlanSetContract = activityContract("choudoufuPlanSet", z.strictObject({ ...rootArgs }), z.object({
+    setDigest: z.string(),
+    rootDigest: z.string(),
+    planDigest: z.string(),
+    changed: z.boolean(),
+    json: z.unknown(),
+    changeSet: z.object({ member: z.object({ member: z.string(), planDigest: z.string().nullable() }).passthrough(), entries: z.array(z.unknown()) }),
+    planSetFile: z.string(),
+    root: z.string(),
+}), rootEntity);
 /** One root of a pin-bump rollout ({@link PinRoot} in `../pin/waves.ts`). */
 const pinRoot = z.strictObject({ root: z.string(), dependsOn: z.array(z.string()).optional(), tsSource: z.string().optional() });
 /**

package/dist/op/builders.d.ts

@@ -15,7 +15,7 @@
  * path a second time.
  */
 import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";
-import type { TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs } from "./activities/terraform.js";
+import type { TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs, TerraformRootArgs } from "./activities/terraform.js";
 import type { TerraformPinRolloutArgs } from "./activities/pin-rollout.js";
 /** Extra opts every wrapper below accepts alongside its activity's own fields. */
 type StepOpts = {
@@ -95,6 +95,12 @@ export declare const choudoufuAdopt: (root: string, opts: WithStepRefs<Omit<Chou
  * provider.
  */
 export declare const terraformShow: (root: string, opts?: WithStepRefs<Omit<TerraformShowArgs, "root">> & StepOpts) => NamedActivityStep;
+/**
+ * `choudoufuPlanSet` (#4483): `live-plan-set -json` over one live choudoufu
+ * root. Hand `step.out.changeSet` from each root's step to `composeChangeSet`
+ * to make one change-set document over several roots, such as one per cloud.
+ */
+export declare const choudoufuPlanSet: (root: string, opts?: WithStepRefs<Omit<TerraformRootArgs, "root">> & StepOpts) => NamedActivityStep;
 /**
  * One run of a pin-bump rollout (#3189). `opts` is
  * {@link TerraformPinRolloutArgs} itself. It names no root: the rollout finds

package/dist/op/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAExE,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,SAClB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,SAClB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC/D,iBAGF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,SACtB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAClE,iBAOF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,SACpB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAChE,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,SACvB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KACnE,iBAOF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,QACN,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,SAClB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,SAAU,YAAY,CAAC,uBAAuB,CAAC,GAAG,QAAQ,KAAG,iBAG5F,CAAC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAExE,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,SAClB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,SAClB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC/D,iBAGF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,SACtB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAClE,iBAOF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,SACpB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAChE,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,SACvB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KACnE,iBAOF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,SACnB,MAAM,QACN,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,SAClB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,SACrB,MAAM,SACL,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,SAAU,YAAY,CAAC,uBAAuB,CAAC,GAAG,QAAQ,KAAG,iBAG5F,CAAC"}

package/dist/op/builders.js

@@ -112,6 +112,15 @@ export const terraformShow = (root, opts) => {
     const { args, profile, id } = takeProfileAndId(opts);
     return activity("terraformShow", { root, ...args }, { profile: profile ?? "fastIdempotent", ...(id ? { id } : {}) });
 };
+/**
+ * `choudoufuPlanSet` (#4483): `live-plan-set -json` over one live choudoufu
+ * root. Hand `step.out.changeSet` from each root's step to `composeChangeSet`
+ * to make one change-set document over several roots, such as one per cloud.
+ */
+export const choudoufuPlanSet = (root, opts) => {
+    const { args, profile, id } = takeProfileAndId(opts);
+    return activity("choudoufuPlanSet", { root, ...args }, { profile: profile ?? "longInfra", ...(id ? { id } : {}) });
+};
 /**
  * One run of a pin-bump rollout (#3189). `opts` is
  * {@link TerraformPinRolloutArgs} itself. It names no root: the rollout finds

package/dist/pin/edit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"edit.d.ts","sourceRoot":"","sources":["../../src/pin/edit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAGjD,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,mEAAmE;AACnE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AA2CD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAgDxH"}
+{"version":3,"file":"edit.d.ts","sourceRoot":"","sources":["../../src/pin/edit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAW,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAIjD,4FAA4F;AAC5F,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,mEAAmE;AACnE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG;IACpC,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,4DAA4D;AAC5D,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AA2CD;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC,CAiDxH"}

package/dist/pin/edit.js

@@ -22,6 +22,7 @@
  * module (terragucci's `tf-rollout` stage, #3421) decides how it is loaded.
  */
 import { movePin } from "./source.js";
+import { isJsonConfigFile, jsonConfigTree } from "../hcl/files.js";
 import { escapeHcl, scanBlocks, unescapeHcl } from "./scan.js";
 /** Whether a file is read as a Terragrunt configuration rather than a `.tf` file. */
 export function isTerragruntFile(file) {
@@ -58,6 +59,8 @@ function sites(tree, blocks, terragrunt) {
  * is reported with its reason and left as it was.
  */
 export async function editPins(text, file, request, parser) {
+    if (isJsonConfigFile(file))
+        return jsonPins(text, file, request);
     const terragrunt = isTerragruntFile(file);
     const tree = (await parser.parse(file, text));
     const blocks = scanBlocks(text, file);
@@ -116,3 +119,35 @@ export async function editPins(text, file, request, parser) {
 function rewriteLiteral(raw, was, value) {
     return raw === was ? value : escapeHcl(value);
 }
+/**
+ * The calls of the module in a `.tf.json` or `.tofu.json` file (chant#4457).
+ * The pin edit splices HCL text and has no splice for JSON syntax, so a call
+ * that would move is refused by name and the file is left as it is; a call
+ * already at the new pin, or at another one, reads as it does in HCL.
+ */
+function jsonPins(text, file, request) {
+    const calls = [];
+    let tree;
+    try {
+        tree = jsonConfigTree(text);
+    }
+    catch (err) {
+        return { content: text, calls: [{ outcome: "refused", reason: `not JSON the binary reads: ${err instanceof Error ? err.message : String(err)}`, file, call: "(file)" }] };
+    }
+    const modules = (tree.module && typeof tree.module === "object" ? tree.module : {});
+    for (const [name, bodies] of Object.entries(modules)) {
+        for (const body of Array.isArray(bodies) ? bodies : []) {
+            if (typeof body.source !== "string")
+                continue;
+            const move = movePin(body.source, typeof body.version === "string" ? body.version : undefined, request);
+            if (!move)
+                continue;
+            const at = { file, call: `module.${name}` };
+            if (move.outcome === "moved")
+                calls.push({ outcome: "refused", reason: "the call is in Terraform's JSON syntax, which the pin edit does not write; move its pin by hand", ...at });
+            else
+                calls.push({ ...move, ...at });
+        }
+    }
+    return { content: text, calls };
+}

package/dist/pin/rollout.d.ts

@@ -70,6 +70,8 @@ export interface PinRolloutOptions extends PinRequest {
     editTs?: TsPinEditor;
     /** Markdown appended to a wave's PR body, such as the grouped plan summary of #3188 once a caller has the wave's plans. */
     planSummary?: (wave: PinWave) => Promise<string | undefined>;
+    /** The binary the roots run: `tofu` or `choudoufu` reads `.tofu` files too (chant#4457). Default `terraform`. */
+    binary?: string;
 }
 /** Where one root's pin stood on the base branch. */
 export interface PinRootState {

package/dist/pin/rollout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rollout.d.ts","sourceRoot":"","sources":["../../src/pin/rollout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAOH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAY,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE3F,OAAO,EAAuD,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAIpD,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,aAAa,CAAC;AAE7F,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,cAAc,CAAC;AAEvD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0IAA0I;IAC1I,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,yGAAyG;IACzG,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,gGAAgG;IAChG,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+HAA+H;IAC/H,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,MAAM,EAAE,QAAQ,CAAC;IACjB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,gGAAgG;IAChG,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,2HAA2H;IAC3H,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;CAC9D;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,2GAA2G;IAC3G,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,iBAAiB,GACjB,QAAQ,GACR,YAAY,GACZ,MAAM,GACN,eAAe,GACf,QAAQ,GACR,QAAQ,GACR,aAAa,CAAC;AAElB,MAAM,WAAW,aAAc,SAAQ,OAAO;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IACrE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAgCD,6CAA6C;AAC7C,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AA4GD,4GAA4G;AAC5G,wBAAsB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuJzF;AAcD,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,GAAG,MAAM,CAWlF"}
+{"version":3,"file":"rollout.d.ts","sourceRoot":"","sources":["../../src/pin/rollout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAOH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gDAAgD,CAAC;AAEpF,OAAO,EAAY,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AAE3F,OAAO,EAAuD,KAAK,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAKpD,6FAA6F;AAC7F,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,aAAa,CAAC;AAE7F,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,cAAc,CAAC;AAEvD,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,yEAAyE;IACzE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0IAA0I;IAC1I,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,yGAAyG;IACzG,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,gGAAgG;IAChG,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+HAA+H;IAC/H,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,MAAM,EAAE,QAAQ,CAAC;IACjB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,+DAA+D;IAC/D,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,gGAAgG;IAChG,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,2HAA2H;IAC3H,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC7D,iHAAiH;IACjH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,2GAA2G;IAC3G,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1D,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,YAAY,GACpB,SAAS,GACT,iBAAiB,GACjB,QAAQ,GACR,YAAY,GACZ,MAAM,GACN,eAAe,GACf,QAAQ,GACR,QAAQ,GACR,aAAa,CAAC;AAElB,MAAM,WAAW,aAAc,SAAQ,OAAO;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,YAAY,CAAC;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;IACrE,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAgCD,6CAA6C;AAC7C,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AA8GD,4GAA4G;AAC5G,wBAAsB,aAAa,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuJzF;AAcD,+CAA+C;AAC/C,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,GAAG,MAAM,CAWlF"}

package/dist/pin/rollout.js

@@ -45,6 +45,7 @@ import { editPins } from "./edit.js";
 import { checkPinRequest, moduleOf } from "./source.js";
 import { planPinWaves, restrictWaves, terragruntDependencies } from "./waves.js";
 import { ghPinForge } from "./forge.js";
+import { isConfigFileFor, listConfigFilesSafe } from "../hcl/files.js";
 const execFileAsync = /* @__PURE__ */ promisify(execFile);
 // `gh pr list/create` and `gh api repos/{owner}/{repo}/...` name no host, so
 // a `gh` call is told the job's forge or `origin`'s host (core's `ghHostEnv`,
@@ -73,22 +74,24 @@ function slug(value) {
 export function pinWaveBranch(request, wave) {
     return `chant/pin/${slug(request.module)}/${slug(request.to)}/wave-${wave}`;
 }
-/** The files the pin edit reads in a root directory: its `.tf` files and its `terragrunt.hcl`. */
-function rootFiles(worktree, root) {
+/**
+ * The files the pin edit reads in a root directory: the configuration files
+ * the root's binary reads (the lexicon's one lister, chant#4457) and its
+ * `terragrunt.hcl`.
+ */
+function rootFiles(worktree, root, binary) {
     const dir = join(worktree, root);
     if (!existsSync(dir))
         return [];
-    return readdirSync(dir)
-        .filter((f) => f.endsWith(".tf") || f === "terragrunt.hcl")
-        .sort()
-        .map((f) => posix.join(root, f));
+    const names = [...listConfigFilesSafe(dir, binary), ...(existsSync(join(dir, "terragrunt.hcl")) ? ["terragrunt.hcl"] : [])];
+    return names.sort().map((f) => posix.join(root, f));
 }
-/** Every directory under the worktree with a `.tf` file or a `terragrunt.hcl`. */
-function candidateRoots(worktree) {
+/** Every directory under the worktree with a configuration file the binary reads, or a `terragrunt.hcl`. */
+function candidateRoots(worktree, binary) {
     const out = [];
     const walk = (rel) => {
         const entries = readdirSync(join(worktree, rel), { withFileTypes: true });
-        if (entries.some((e) => e.isFile() && (e.name.endsWith(".tf") || e.name === "terragrunt.hcl")))
+        if (entries.some((e) => e.isFile() && (isConfigFileFor(e.name, binary) || e.name === "terragrunt.hcl")))
             out.push(rel || ".");
         for (const e of entries)
             if (e.isDirectory() && !SKIP_DIRS.has(e.name))
@@ -108,7 +111,7 @@ async function editRoot(worktree, root, request, options) {
         }
     }
     else {
-        files = rootFiles(worktree, root.root);
+        files = rootFiles(worktree, root.root, options.binary);
     }
     for (const file of files) {
         const path = join(worktree, file);
@@ -216,7 +219,7 @@ export async function runPinRollout(options) {
     await run("git", ["worktree", "add", "--quiet", "--detach", worktree, baseRef], repo);
     try {
         // 1. Every root's pin on the base branch.
-        const declared = (options.roots ?? candidateRoots(worktree).map((root) => ({ root }))).map((r) => ({
+        const declared = (options.roots ?? candidateRoots(worktree, options.binary).map((root) => ({ root }))).map((r) => ({
             ...r,
             root: dirOf(r.root),
             ...(r.dependsOn ? { dependsOn: r.dependsOn.map(dirOf) } : {}),