@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/dist/drift-record.js

@@ -0,0 +1,383 @@
+/**
+ * Drift-record adapters for the terraform family (#4451): a stock root's
+ * state read and plan, and a choudoufu live root's `live-plan -json`,
+ * `live-ls -json` and plan, each into `@intentius/chant/drift-record`
+ * records.
+ *
+ * | source | read | status |
+ * |---|---|---|
+ * | `show -json` over state | `state` | in state: recorded. Declared and not in state: pending |
+ * | `show -json` of a saved plan | `plan` | no `resource_drift` row: in-sync. Drift update: drifted with paths. Drift delete: missing. Create with no prior row: pending. Delete with no drift: undeclared |
+ * | `live-plan -json` | `ownership` | `bound[]`: in-sync, owned by its `source`. `unowned[]` and `adoptable[]`: unclaimed. `ABSENT`: pending. Any other omission: not-observed. `foreign[]`: undeclared, foreign. `controller_held[]`: runtime |
+ * | `live-ls -json` | `ownership` | `declared: false`: undeclared. A gap no live-plan row answers: not-observed |
+ * | live-plan and a plan together | `plan` | bound with a planned update or replace: drifted with paths, the live-plan ownership kept |
+ *
+ * A state read never says in-sync or drifted: `driftRecord` refuses it.
+ *
+ * An omission keeps its token in `evidence.engineCode`, and so does the
+ * `UNOWNED` omission that has no `unowned[]` row: chant reads it as
+ * not-observed (`read-failed`), not as unclaimed, since nothing in the
+ * document says what holds the identity.
+ *
+ * ## Values
+ *
+ * Attribute values come from `./plan-observation.ts`, which already replaced
+ * every value the planner flagged, or that equals a flagged string, with
+ * `(sensitive)`. Here a `(sensitive)` side makes the attribute `sensitive:
+ * true` with neither value, and the record constructor's key-name pass runs
+ * after. `before` is what was expected and `after` what the read found, so
+ * a stock root's drift row reads state then refreshed object, and a live
+ * root's planned update reads declared then live (the plan's after, then
+ * its before).
+ *
+ * ## The import graph
+ *
+ * Like `./change-set.ts`, this imports chant's `drift-record` subpath, the
+ * plan projection and the omission table, never the lexicon's entry point
+ * or `./describe-resources.ts`, so it bundles without TypeScript, node's
+ * process modules or the lint rules (#3421).
+ */
+import { driftRecord, placeDriftRecord, } from "@intentius/chant/drift-record";
+import { LIVE_PLAN_OMISSION_REASONS, readsAsCredentials } from "./live-plan-reasons.js";
+import { blockAddressOf, indexPlan, KNOWN_AFTER_APPLY, SENSITIVE_VALUE } from "./plan-observation.js";
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const asArray = (v) => (Array.isArray(v) ? v : []);
+const asString = (v) => (typeof v === "string" && v.length > 0 ? v : undefined);
+const byString = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+const byAddress = (a, b) => byString(a.address, b.address);
+/** True for an address inside a `data` block, which has no drift. */
+function isDataAddress(address) {
+    return /(^|\.)data\./.test(blockAddressOf(address));
+}
+function common(input, engine, read, address) {
+    return {
+        member: input.member,
+        engine,
+        address,
+        ...placeDriftRecord(input, engine, address),
+        observedAt: input.observedAt,
+        read,
+        ...(input.fellBackFrom !== undefined ? { fellBackFrom: input.fellBackFrom } : {}),
+    };
+}
+/** One projected plan change as a drift attribute. `swap` reads the change's after as expected. */
+function attributeOf(change, swap) {
+    const path = change.path;
+    if (change.before === SENSITIVE_VALUE || change.after === SENSITIVE_VALUE)
+        return { path, sensitive: true };
+    const expected = swap ? change.after : change.before;
+    const found = swap ? change.before : change.after;
+    return {
+        path,
+        ...(expected !== null && expected !== undefined && expected !== KNOWN_AFTER_APPLY ? { before: expected } : {}),
+        ...(found !== null && found !== undefined && found !== KNOWN_AFTER_APPLY ? { after: found } : {}),
+    };
+}
+// ── state ──────────────────────────────────────────────────────────────────────
+/** Every managed resource row of a `show -json` state document: address and type. */
+function stateRows(showJson) {
+    const rows = new Map();
+    const walk = (module, prefix) => {
+        const node = isObject(module) ? module : {};
+        for (const entry of asArray(node.resources)) {
+            if (!isObject(entry))
+                continue;
+            const raw = asString(entry.address);
+            if (!raw || entry.mode === "data")
+                continue;
+            const address = prefix && !raw.startsWith(`${prefix}.`) ? `${prefix}.${raw}` : raw;
+            rows.set(address, asString(entry.type) ? { type: asString(entry.type) } : {});
+        }
+        for (const child of asArray(node.child_modules)) {
+            if (isObject(child))
+                walk(child, asString(child.address) ?? prefix);
+        }
+    };
+    const doc = isObject(showJson) ? showJson : {};
+    walk(isObject(doc.values) ? doc.values.root_module : undefined, "");
+    return rows;
+}
+/**
+ * A stock root's records from its state: every managed instance in state is
+ * recorded, every declared block with no instance there is pending, and a
+ * failed read makes every declared block not-observed. Never in-sync or
+ * drifted: state says what the last apply recorded, not what the account
+ * holds.
+ */
+export function terraformStateDriftRecords(input) {
+    const engine = input.engine ?? "terraform";
+    const evidence = { tool: engine, ...(input.version ? { version: input.version } : {}), command: `${engine} show -json` };
+    if (input.failed) {
+        return (input.declared ?? [])
+            .map((address) => driftRecord({
+            ...common(input, engine, "state", address),
+            status: "not-observed",
+            unobserved: { reason: input.failed.reason, ...(input.failed.detail ? { detail: input.failed.detail } : {}) },
+            evidence,
+        }))
+            .sort(byAddress);
+    }
+    const rows = stateRows(input.state);
+    const out = [];
+    for (const [address, row] of rows) {
+        out.push(driftRecord({ ...common(input, engine, "state", address), ...(row.type ? { resourceType: row.type } : {}), status: "recorded", ownership: { verdict: "owned", by: "state" }, evidence }));
+    }
+    const blocks = new Set([...rows.keys()].map(blockAddressOf));
+    for (const address of input.declared ?? []) {
+        if (blocks.has(address) || rows.has(address))
+            continue;
+        out.push(driftRecord({ ...common(input, engine, "state", address), status: "pending", evidence }));
+    }
+    return out.sort(byAddress);
+}
+/**
+ * A stock root's records from a saved plan's `show -json`, one per managed
+ * instance the plan names. A `resource_drift[]` row decides: update is
+ * drifted with its paths (before is state, after the refreshed object),
+ * delete is missing. With no drift row, a create with no prior-state row is
+ * pending, a delete or forget the configuration no longer declares is
+ * undeclared, and anything else is in-sync, since a planned change from
+ * configuration is the change set's to show and not drift.
+ */
+export function terraformPlanDriftRecords(input) {
+    const engine = input.engine ?? "terraform";
+    const doc = isObject(input.plan) ? input.plan : {};
+    const version = input.version ?? asString(doc.terraform_version);
+    const evidence = { tool: engine, ...(version ? { version } : {}), command: `${engine} show -json` };
+    const index = indexPlan(input.plan);
+    const prior = stateRows({ values: isObject(index.priorState) ? index.priorState.values : undefined });
+    const types = new Map();
+    for (const entry of asArray(doc.resource_changes)) {
+        if (isObject(entry) && asString(entry.address) && asString(entry.type))
+            types.set(entry.address, entry.type);
+    }
+    const addresses = [...new Set([...index.changes.keys(), ...index.drift.keys()])].filter((a) => !isDataAddress(a)).sort(byString);
+    return addresses.map((address) => {
+        const type = types.get(address) ?? prior.get(address)?.type;
+        const at = { ...common(input, engine, "plan", address), ...(type ? { resourceType: type } : {}), evidence };
+        const drift = index.drift.get(address);
+        if (drift?.actions.includes("delete"))
+            return driftRecord({ ...at, status: "missing" });
+        if (drift && drift.actions.includes("update")) {
+            const attributes = drift.changes.map((c) => attributeOf(c, false));
+            return driftRecord({ ...at, status: "drifted", ...(attributes.length > 0 ? { attributes } : {}) });
+        }
+        const actions = index.changes.get(address)?.actions ?? [];
+        if (actions.length === 1 && actions[0] === "create" && !prior.has(address))
+            return driftRecord({ ...at, status: "pending" });
+        if (actions.length === 1 && (actions[0] === "delete" || actions[0] === "forget"))
+            return driftRecord({ ...at, status: "undeclared" });
+        return driftRecord({ ...at, status: "in-sync" });
+    });
+}
+// ── choudoufu live-plan ────────────────────────────────────────────────────────
+const BOUND_SOURCES = ["marker", "record", "derived", "cache"];
+/**
+ * A live root's records from `live-plan -json`, read `ownership`, one per
+ * address the document names.
+ *
+ * - `bound[]`: in-sync, `owned` by the row's `source`, the marker on the
+ *   object exactly when the source is `marker`.
+ * - `unowned[]`: unclaimed, `adoptable` when the row carries the adopting
+ *   tag values and `foreign` otherwise, with the estate it does carry. It
+ *   answers before the paired `UNOWNED` omission.
+ * - `adoptable[]`: unclaimed, `adoptable`, the paired omission's token kept.
+ * - an `ABSENT` omission: pending.
+ * - any other omission, `UNOWNED` with no row included: not-observed with
+ *   the reason `LIVE_PLAN_OMISSION_REASONS` gives (`VERIFIED_NOT_IMPORTABLE`
+ *   read-failed, `OUT_OF_SCOPE` filtered), a credentials failure named as
+ *   such.
+ * - `foreign[]`: undeclared, `foreign`, addressed by its identity.
+ * - `controller_held[]`: runtime, `foreign`, held by its controller,
+ *   addressed by the marker's address when it has one and its identity
+ *   otherwise.
+ */
+export function choudoufuLivePlanDriftRecords(input) {
+    const doc = isObject(input.livePlan) ? input.livePlan : {};
+    const version = input.version ?? asString(doc.choudoufu_version);
+    const evidence = (engineCode) => ({
+        tool: "choudoufu",
+        ...(version ? { version } : {}),
+        command: "choudoufu live-plan -json",
+        ...(engineCode ? { engineCode } : {}),
+    });
+    const out = new Map();
+    const put = (address, record) => {
+        if (!out.has(address))
+            out.set(address, driftRecord({ ...common(input, "choudoufu", "ownership", address), ...record }));
+    };
+    const typed = (row) => (asString(row.type) ? { resourceType: asString(row.type) } : {});
+    const omissions = new Map();
+    for (const row of asArray(doc.omissions).filter(isObject)) {
+        const addr = asString(row.addr);
+        if (addr)
+            omissions.set(addr, { reason: asString(row.reason) ?? "", detail: asString(row.detail) ?? "" });
+    }
+    for (const row of asArray(doc.unowned).filter(isObject)) {
+        const addr = asString(row.addr);
+        if (!addr)
+            continue;
+        const heldBy = asString(row.tofu_estate);
+        const adopt = asString(row.adopt_tofu_address);
+        const ownership = adopt || asString(row.adopt_tofu_estate)
+            ? { verdict: "adoptable", markerOnObject: heldBy !== undefined, ...(heldBy ? { by: "marker", ownedBy: heldBy } : {}), ...(adopt ? { adopt } : {}) }
+            : { verdict: "foreign", markerOnObject: heldBy !== undefined, ...(heldBy ? { by: "marker", ownedBy: heldBy } : {}) };
+        put(addr, { ...typed(row), status: "unclaimed", ownership, evidence: evidence(omissions.get(addr)?.reason || "UNOWNED") });
+    }
+    for (const row of asArray(doc.bound).filter(isObject)) {
+        const addr = asString(row.addr);
+        if (!addr)
+            continue;
+        const source = asString(row.source);
+        const by = BOUND_SOURCES.find((s) => s === source);
+        put(addr, { ...typed(row), status: "in-sync", ownership: { verdict: "owned", ...(by ? { by } : {}), markerOnObject: source === "marker" }, evidence: evidence() });
+    }
+    for (const row of asArray(doc.adoptable).filter(isObject)) {
+        const addr = asString(row.addr);
+        if (!addr)
+            continue;
+        const adopt = asString(row.adopt_tofu_address);
+        put(addr, {
+            ...typed(row),
+            status: "unclaimed",
+            ownership: { verdict: "adoptable", markerOnObject: false, ...(adopt ? { adopt } : {}) },
+            evidence: evidence(omissions.get(addr)?.reason),
+        });
+    }
+    for (const [addr, row] of omissions) {
+        const mapped = LIVE_PLAN_OMISSION_REASONS[row.reason] ?? "read-failed";
+        if (mapped === "absent") {
+            put(addr, { status: "pending", evidence: evidence(row.reason) });
+            continue;
+        }
+        const reason = mapped === "read-failed" && readsAsCredentials(row.detail) ? "no-credentials" : mapped;
+        put(addr, {
+            status: "not-observed",
+            unobserved: { reason, ...(row.detail ? { detail: row.detail } : {}) },
+            evidence: evidence(row.reason || undefined),
+        });
+    }
+    for (const row of asArray(doc.foreign).filter(isObject)) {
+        const identity = asString(row.identity);
+        if (!identity)
+            continue;
+        const heldBy = asString(row.tofu_estate);
+        put(identity, {
+            ...typed(row),
+            status: "undeclared",
+            ownership: { verdict: "foreign", markerOnObject: heldBy !== undefined, ...(heldBy ? { by: "marker", ownedBy: heldBy } : {}) },
+            evidence: evidence(),
+        });
+    }
+    for (const row of asArray(doc.controller_held).filter(isObject)) {
+        const address = asString(row.addr) ?? asString(row.identity);
+        if (!address)
+            continue;
+        const heldBy = asString(row.held_by) ?? asString(row.controller);
+        put(address, {
+            ...typed(row),
+            status: "runtime",
+            ownership: { verdict: "foreign", by: "label", ...(heldBy ? { ownedBy: heldBy } : {}) },
+            evidence: evidence(asString(row.controller)),
+        });
+    }
+    return [...out.values()].sort(byAddress);
+}
+/**
+ * A live root's records from `live-ls -json`, read `ownership`. An item with
+ * `declared: false` is undeclared, addressed by its marker's address or else
+ * its identity: `owned` when its marker names this estate, held by the
+ * controller (runtime) when it has `held_by`, `foreign` when it names
+ * another estate. A declared item is live-plan's to answer and is left out.
+ * A gap is not-observed `unsupported-kind` with its rung as the token,
+ * unless `answered` holds its address.
+ */
+export function choudoufuLiveLsDriftRecords(input) {
+    const doc = isObject(input.liveLs) ? input.liveLs : {};
+    const estate = asString(doc.estate);
+    const answered = new Set(input.answered ?? []);
+    const evidence = (engineCode) => ({
+        tool: "choudoufu",
+        ...(input.version ? { version: input.version } : {}),
+        command: "choudoufu live-ls -json",
+        ...(engineCode ? { engineCode } : {}),
+    });
+    const out = new Map();
+    for (const row of asArray(doc.items).filter(isObject)) {
+        if (row.declared !== false)
+            continue;
+        const address = asString(row.address) ?? asString(row.id);
+        if (!address || out.has(address))
+            continue;
+        const tags = isObject(row.tags) ? row.tags : {};
+        const marker = asString(tags["tofu-estate"]);
+        const heldBy = asString(row.held_by);
+        const ownership = heldBy
+            ? { verdict: "foreign", by: "label", ownedBy: heldBy }
+            : marker === undefined
+                ? { verdict: "unknown" }
+                : marker === estate
+                    ? { verdict: "owned", by: "marker", markerOnObject: true }
+                    : { verdict: "foreign", by: "marker", markerOnObject: true, ownedBy: marker };
+        out.set(address, driftRecord({
+            ...common(input, "choudoufu", "ownership", address),
+            ...(asString(row.type) ? { resourceType: asString(row.type) } : {}),
+            status: heldBy ? "runtime" : "undeclared",
+            ownership,
+            evidence: evidence(),
+        }));
+    }
+    for (const row of asArray(doc.gaps).filter(isObject)) {
+        const address = asString(row.address);
+        if (!address || answered.has(address) || out.has(address))
+            continue;
+        out.set(address, driftRecord({
+            ...common(input, "choudoufu", "ownership", address),
+            ...(asString(row.type) ? { resourceType: asString(row.type) } : {}),
+            status: "not-observed",
+            unobserved: { reason: "unsupported-kind", ...(asString(row.detail) ? { detail: asString(row.detail) } : {}) },
+            evidence: evidence(asString(row.rung)),
+        }));
+    }
+    return [...out.values()].sort(byAddress);
+}
+/** live-plan's records, then live-ls's undeclared items and the gaps live-plan did not answer. */
+export function choudoufuLiveDriftRecords(input) {
+    const plan = choudoufuLivePlanDriftRecords(input);
+    if (input.liveLs === undefined)
+        return plan;
+    const answered = new Set(plan.map((r) => r.address));
+    const ls = choudoufuLiveLsDriftRecords({ ...input, liveLs: input.liveLs, answered }).filter((r) => !answered.has(r.address));
+    return [...plan, ...ls].sort(byAddress);
+}
+/**
+ * A live root at the plan depth. Every bound instance is read `plan`: a
+ * planned update or replace is drifted with the plan's paths, since a live
+ * root's prior state is the account itself, and anything else is in-sync.
+ * Its ownership facet is live-plan's. Every other address keeps its
+ * live-plan or live-ls record, read `ownership`, because the plan does not
+ * say who holds it.
+ */
+export function choudoufuLivePlusPlanDriftRecords(input) {
+    const live = choudoufuLiveDriftRecords(input);
+    const index = indexPlan(input.plan);
+    const doc = isObject(input.plan) ? input.plan : {};
+    const version = input.version ?? asString(doc.terraform_version);
+    return live
+        .map((r) => {
+        if (r.read !== "ownership" || r.status !== "in-sync" || r.ownership?.verdict !== "owned")
+            return r;
+        const change = index.changes.get(r.address);
+        const actions = change?.actions ?? [];
+        const moves = actions.includes("update") || (actions.includes("create") && actions.includes("delete"));
+        const attributes = moves ? change.changes.map((c) => attributeOf(c, true)) : [];
+        return driftRecord({
+            ...r,
+            read: "plan",
+            status: moves ? "drifted" : "in-sync",
+            ...(attributes.length > 0 ? { attributes } : {}),
+            evidence: { tool: "choudoufu", ...(version ? { version } : {}), command: "choudoufu live-plan -json, choudoufu show -json" },
+        });
+    })
+        .sort(byAddress);
+}

package/dist/hcl/edges.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"edges.d.ts","sourceRoot":"","sources":["../../src/hcl/edges.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAA2C,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAkBxF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAItG;AAiED,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AA6CD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAChD,eAAe,EAAE,CA4BnB;AAOD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,IAAI,CAAC,CAuBf"}
+{"version":3,"file":"edges.d.ts","sourceRoot":"","sources":["../../src/hcl/edges.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoFG;AAEH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAgB,KAAK,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAElF,OAAO,EAAuD,KAAK,eAAe,EAAE,MAAM,SAAS,CAAC;AAkBpG;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAItG;AAiED,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AA6CD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,GAChD,eAAe,EAAE,CAgCnB;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACjC,QAAQ,CAAC,EAAE,QAAQ,GAClB,OAAO,CAAC,IAAI,CAAC,CAuBf"}

package/dist/hcl/edges.js

@@ -86,7 +86,7 @@
 import { isResourceDeclarable } from "@intentius/chant/declarable";
 import { loadHcl2json } from "@intentius/chant/terraform/hcl2json";
 import { refFromAccessor } from "@intentius/chant/terraform/graph";
-import { LOCALS_TYPE, scopeOfKey } from "./parse.js";
+import { CHECK_TYPE, LOCALS_TYPE, scopeOfKey } from "./parse.js";
 /** An identifier as Terraform's grammar allows it. Same as `./references.ts`. */
 const NAME = "[A-Za-z_][A-Za-z0-9_-]*";
 /** `var.<name>` / `local.<name>` at the head of a traversal accessor. */
@@ -217,8 +217,13 @@ export function referencesOfEntity(key, entity, scopes, accessors) {
     const index = scopes.get(scopeOfKey(key));
     if (!index)
         return [];
+    const shadowed = entity.entityType === CHECK_TYPE ? scopedDataAddresses(bodyOf(entity)) : undefined;
     const grouped = new Map();
     for (const raw of rawReferences(bodyOf(entity), accessors)) {
+        // An assertion reading the check's own scoped `data` block reads that
+        // block, never a root-level data source of the same address (#4458).
+        if (shadowed?.has(raw.address))
+            continue;
         const to = resolveAddress(raw.address, index);
         if (!to || to === key)
             continue;
@@ -243,6 +248,24 @@ export function referencesOfEntity(key, entity, scopes, accessors) {
     }
     return out.sort((a, b) => cmp(a.to, b.to) || cmp(a.viaAttr ?? "", b.viaAttr ?? ""));
 }
+/**
+ * The `data.<type>.<name>` addresses a `check` block declares in its own
+ * scope (#4458). hcl2json gives them as `data: { <type>: { <name>: [...] } }`
+ * inside the check's body.
+ */
+function scopedDataAddresses(body) {
+    const out = new Set();
+    const data = body["data"];
+    if (typeof data !== "object" || data === null || Array.isArray(data))
+        return out;
+    for (const [type, named] of Object.entries(data)) {
+        if (typeof named !== "object" || named === null || Array.isArray(named))
+            continue;
+        for (const name of Object.keys(named))
+            out.add(`data.${type}.${name}`);
+    }
+    return out;
+}
 /** Code-point ordering, so output does not depend on the machine's locale. */
 function cmp(a, b) {
     return a < b ? -1 : a > b ? 1 : 0;

package/dist/hcl/files.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Which files of a directory are a root's configuration, and how a JSON-syntax
+ * one reads (chant#4457). Every lister in the lexicon asks here, so the parser,
+ * change detection, the backend readers, the report and the rollout pin all
+ * see the same file set for one root.
+ *
+ * The set follows the root's binary. Terraform reads `.tf` and `.tf.json`.
+ * OpenTofu (and choudoufu, which is OpenTofu) also reads `.tofu` and
+ * `.tofu.json`, and when `x.tofu` and `x.tf` both exist it reads `x.tofu`
+ * only (likewise `x.tofu.json` over `x.tf.json`). A binary that is not given
+ * is `terraform`, the config's default.
+ *
+ * `parse.ts` re-exports all of this; the module is separate so the readers
+ * that never parse HCL (`state/backend.ts`, `changed-roots.ts`) do not load
+ * the parser's dependencies.
+ */
+/** The configuration file suffixes Terraform reads. */
+export declare const TERRAFORM_SUFFIXES: readonly string[];
+/** The ones OpenTofu reads as well. */
+export declare const TOFU_SUFFIXES: readonly string[];
+/** Whether a root run by `binary` reads `.tofu` files: `tofu` and `choudoufu` do (by name or path), `terraform` and an unset binary do not. */
+export declare function readsTofuFiles(binary?: string): boolean;
+/** Whether `name` is a configuration file in Terraform's JSON syntax (`.tf.json`, `.tofu.json`). */
+export declare function isJsonConfigFile(name: string): boolean;
+/** Whether `name` is a `.tofu` or `.tofu.json` file. */
+export declare function isTofuConfigFile(name: string): boolean;
+/** Whether `name` is a configuration file a root run by `binary` reads, before the `.tofu`-over-`.tf` rule. */
+export declare function isConfigFileFor(name: string, binary?: string): boolean;
+/**
+ * The configuration files among `names` a root run by `binary` reads, in
+ * filename order. For a tofu or choudoufu root, `x.tf` is dropped when
+ * `x.tofu` is present and `x.tf.json` when `x.tofu.json` is, which is
+ * OpenTofu's own rule. Names may carry a directory; the rule compares names
+ * in the same directory.
+ */
+export declare function selectConfigFiles(names: Iterable<string>, binary?: string): string[];
+/**
+ * The configuration files directly under `dir` a root run by `binary` reads,
+ * by name, in filename order. Non-recursive, matching Terraform's module
+ * scoping; directories named like a file are left out. Throws when `dir`
+ * cannot be read.
+ */
+export declare function listConfigFiles(dir: string, binary?: string): string[];
+/** {@link listConfigFiles}, empty when `dir` cannot be read. */
+export declare function listConfigFilesSafe(dir: string, binary?: string): string[];
+/**
+ * A `.tf.json` or `.tofu.json` document in the tree shape hcl2json gives an
+ * HCL file, so `blocksToEntities` reads both the same way. Top-level keys it
+ * does not know are kept as written. Throws on malformed JSON, as hcl2json
+ * throws on malformed HCL.
+ */
+export declare function jsonConfigTree(source: string): Record<string, unknown>;
+/**
+ * The bodies of the `live` blocks nested in the `terraform` blocks of a
+ * `.tf.json` or `.tofu.json` document, in the order written (chant#4504).
+ * The fast live readers (`report.ts`'s `estateOfDir`, `op/activities/live-detect.ts`)
+ * read HCL by text and a JSON file through this. Malformed JSON reads as no
+ * `live` block, as those readers treat any file they cannot read.
+ */
+export declare function jsonLiveBlocks(source: string): Record<string, unknown>[];
+//# sourceMappingURL=files.d.ts.map

package/dist/hcl/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../src/hcl/files.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,uDAAuD;AACvD,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAwB,CAAC;AACzE,uCAAuC;AACvC,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAA4B,CAAC;AAExE,+IAA+I;AAC/I,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAGvD;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,wDAAwD;AACxD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED,+GAA+G;AAC/G,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAUtE;AAED,gEAAgE;AAChE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAM1E;AA4GD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CASxE"}