@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/dist/hcl/parse.js

@@ -1,11 +1,13 @@
 /**
  * The one shared HCL parse for the terraform lexicon.
  *
- * Two entry points, one entity shape. `parseTerraformRootDir` reads the `.tf`
- * files of a directory (non-recursive, matching Terraform's own module
- * scoping) and is what `buildRoots()` calls. `parseTerraformRootContent` takes
- * the joined-file string `chant audit` hands a lexicon for a discovered root
- * module: every `.tf` in filename order behind a `# file: <name>` line comment.
+ * Two entry points, one entity shape. `parseTerraformRootDir` reads the
+ * configuration files of a directory (non-recursive, matching Terraform's own
+ * module scoping; `.tf` and `.tf.json`, plus `.tofu` and `.tofu.json` for a
+ * tofu or choudoufu root, see `./files.ts`) and is what `buildRoots()` calls.
+ * `parseTerraformRootContent` takes the joined-file string `chant audit` hands
+ * a lexicon for a discovered root module: every configuration file in filename
+ * order behind a `# file: <name>` line comment, narrowed to the same set.
  * Both funnel through `blocksToEntities`, so an entity the audit path sees is
  * the entity the build path sees.
  *
@@ -17,12 +19,14 @@
  * core's exports map already carries (`"./*"` to `./src/*.ts`), so nothing
  * changed in `packages/core/package.json` for this.
  */
-import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { loadHcl2json } from "@intentius/chant/terraform/hcl2json";
 import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
 import { redactSensitiveBody, redactSensitiveSource } from "./redact.js";
 import { scanSuppressions, directivesFor } from "./suppressions.js";
+import { isJsonConfigFile, jsonConfigTree, listConfigFiles, selectConfigFiles } from "./files.js";
+export { TERRAFORM_SUFFIXES, TOFU_SUFFIXES, isConfigFileFor, isJsonConfigFile, isTofuConfigFile, jsonConfigTree, listConfigFiles, listConfigFilesSafe, readsTofuFiles, selectConfigFiles, } from "./files.js";
 /** `entityType` per block kind. */
 export const TERRAFORM_TYPE = "Terraform::Terraform";
 export const PROVIDER_TYPE = "Terraform::Provider";
@@ -34,6 +38,23 @@ export const OUTPUT_TYPE = "Terraform::Output";
 export const LOCALS_TYPE = "Terraform::Locals";
 /** A `live { estate = "..." }` block, or an `estate.chdf.hcl` sidecar's content (#2103). */
 export const LIVE_TYPE = "Terraform::Live";
+/**
+ * The four configuration blocks that change how a plan treats addresses
+ * rather than declaring anything (#4458): `moved`, `import`, `removed` and
+ * `check`. The first three carry no label and key as `moved`, `import`,
+ * `removed` (numbered `~2`, `~3` when a root holds several, as `locals` is);
+ * a `check` keys as `check.<name>`. Their references are edges like any other
+ * block's: a `moved` block's `from` and `to`, an `import` block's `to`, a
+ * `removed` block's `from`, and everything a `check` block's assertions and
+ * scoped `data` blocks read. A `from` usually names an address that is no
+ * longer declared, which resolves to no entity and so draws no edge, and
+ * that is all that happens: an unresolved reference is dropped, never
+ * reported (`./edges.ts`).
+ */
+export const MOVED_TYPE = "Terraform::Moved";
+export const IMPORT_TYPE = "Terraform::Import";
+export const REMOVED_TYPE = "Terraform::Removed";
+export const CHECK_TYPE = "Terraform::Check";
 /**
  * Terragrunt config entities (#3417). A `terragrunt.hcl` or `root.hcl` is not
  * a Terraform module, so its blocks are read into these types and never into
@@ -61,6 +82,58 @@ function expansionOf(body) {
         return "for_each";
     return undefined;
 }
+/** The most instance keys read off one literal; past it the block draws as the block alone. */
+const MAX_LITERAL_INSTANCES = 256;
+/**
+ * The instance keys a literal expansion gives (#4454), as Terraform prints
+ * them, or undefined when the expansion is not a literal a read of the
+ * source can count. `count` as a number (`count = 3`), `for_each` as a
+ * literal map (`{ a = 1 }`, keys in Terraform's lexical order) or
+ * `toset([...])` over string literals. Anything holding a reference is a
+ * plan-time answer.
+ */
+export function literalInstanceKeys(body) {
+    const keys = literalKeys(body);
+    if (keys === undefined || keys.length > MAX_LITERAL_INSTANCES)
+        return undefined;
+    return keys;
+}
+function literalKeys(body) {
+    if ("count" in body) {
+        const count = body.count;
+        const n = typeof count === "number" ? count
+            : typeof count === "string" && /^\$\{\s*\d+\s*\}$/.test(count.trim()) ? Number(count.trim().slice(2, -1))
+                : undefined;
+        if (n === undefined || !Number.isInteger(n) || n < 0)
+            return undefined;
+        return Array.from({ length: n }, (_, i) => `[${i}]`);
+    }
+    if ("for_each" in body) {
+        const each = body.for_each;
+        if (typeof each === "object" && each !== null && !Array.isArray(each)) {
+            const names = Object.keys(each);
+            if (names.some((k) => k.includes("${")))
+                return undefined;
+            return names.sort().map((k) => `[${JSON.stringify(k)}]`);
+        }
+        if (typeof each === "string") {
+            const m = /^\$\{\s*toset\(\s*(\[[\s\S]*\])\s*\)\s*\}$/.exec(each.trim());
+            if (!m)
+                return undefined;
+            let list;
+            try {
+                list = JSON.parse(m[1].replace(/,\s*\]$/, "]"));
+            }
+            catch {
+                return undefined;
+            }
+            if (!Array.isArray(list) || !list.every((v) => typeof v === "string"))
+                return undefined;
+            return [...new Set(list)].sort().map((k) => `[${JSON.stringify(k)}]`);
+        }
+    }
+    return undefined;
+}
 /**
  * Build one entity. Written out rather than run through `createResource`
  * from `@intentius/chant/runtime`: that factory is for generated resource
@@ -71,6 +144,7 @@ function expansionOf(body) {
  */
 export function terraformEntity(entityType, address, body, file, root, extra, source = "", line, suppressions) {
     const expansion = expansionOf(body);
+    const instanceKeys = expansion && (entityType === RESOURCE_TYPE || entityType === DATA_TYPE) ? literalInstanceKeys(body) : undefined;
     const labels = entityType === RESOURCE_TYPE ? blockLabels(address)
         : entityType === DATA_TYPE && address.startsWith("data.") ? blockLabels(address.slice("data.".length))
             : undefined;
@@ -80,6 +154,7 @@ export function terraformEntity(entityType, address, body, file, root, extra, so
         entityType,
         kind: "resource",
         stack: root,
+        ...(instanceKeys ? { instanceKeys } : {}),
         props: {
             address,
             ...(labels ?? {}),
@@ -130,11 +205,20 @@ export function splitBundleContent(content, fallbackName = "main.tf") {
     }
     return files.filter((f) => f.source.trim() !== "");
 }
-/** Every `.tf` directly under `dir`, in filename order. Non-recursive. */
-export function listTerraformFiles(dir) {
-    return readdirSync(dir)
-        .filter((f) => f.endsWith(".tf"))
-        .sort();
+/**
+ * Every configuration file directly under `dir` that a root run by `binary`
+ * reads, in filename order, non-recursive: `.tf` and `.tf.json`, plus `.tofu`
+ * and `.tofu.json` for a tofu or choudoufu root, with `x.tofu` shadowing
+ * `x.tf` (chant#4457). The shared lister is `./files.ts`'s `listConfigFiles`.
+ */
+export function listTerraformFiles(dir, binary) {
+    return listConfigFiles(dir, binary);
+}
+/** One file's tree in hcl2json's shape: hcl2json for HCL, {@link jsonConfigTree} for Terraform's JSON syntax. */
+export async function parseFileTree(parser, file) {
+    if (isJsonConfigFile(file.name))
+        return jsonConfigTree(file.source);
+    return (await parser.parse(file.name, file.source));
 }
 /** The Terragrunt config files directly under `dir` (`root.hcl`, `terragrunt.hcl`), in filename order like the audit's bundle. */
 export function listTerragruntFiles(dir) {
@@ -241,7 +325,7 @@ export async function blocksToEntities(files, root, hcl2json, modeOptions, sidec
         }
     };
     for (const file of files) {
-        const tree = (await parser.parse(file.name, file.source));
+        const tree = await parseFileTree(parser, file);
         const scan = scanSuppressions(file.name, file.source);
         if (isTerragruntFileName(file.name)) {
             terragruntBlocks(tree, file, scan, add);
@@ -257,6 +341,10 @@ export async function blocksToEntities(files, root, hcl2json, modeOptions, sidec
         oneLabel(tree, "output", OUTPUT_TYPE, (n) => `output.${n}`, file, scan);
         twoLabels(tree, "resource", RESOURCE_TYPE, (t, n) => `${t}.${n}`, file, scan);
         twoLabels(tree, "data", DATA_TYPE, (t, n) => `data.${t}.${n}`, file, scan);
+        unlabelled(tree, "moved", MOVED_TYPE, file, scan);
+        unlabelled(tree, "import", IMPORT_TYPE, file, scan);
+        unlabelled(tree, "removed", REMOVED_TYPE, file, scan);
+        oneLabel(tree, "check", CHECK_TYPE, (n) => `check.${n}`, file, scan);
     }
     if (sidecar) {
         const tree = (await parser.parse(sidecar.name, sidecar.source));
@@ -319,14 +407,15 @@ function terragruntBlocks(tree, file, scan, add) {
     }
 }
 /**
- * Parse a root module directory. Reads every `.tf` directly under `dir`, plus
- * the `estate.chdf.hcl` sidecar beside them when present. Throws whatever the
+ * Parse a root module directory. Reads the configuration files directly under
+ * `dir` that `modeOptions.binary` reads ({@link listTerraformFiles}), plus the
+ * `estate.chdf.hcl` sidecar beside them when present. Throws whatever the
  * parser throws for malformed HCL; `buildRoots()` is where that becomes a
  * warning.
  */
 export async function parseTerraformRootDir(dir, root, hcl2json, modeOptions, callers = []) {
     // A child module is a Terraform module, never a Terragrunt unit (#3417).
-    const names = [...listTerraformFiles(dir), ...(callers.length === 0 ? listTerragruntFiles(dir) : [])];
+    const names = [...listTerraformFiles(dir, modeOptions?.binary), ...(callers.length === 0 ? listTerragruntFiles(dir) : [])];
     const files = names.map((name) => ({
         name,
         source: readFileSync(join(dir, name), "utf-8"),
@@ -349,7 +438,16 @@ export async function parseTerraformRootDir(dir, root, hcl2json, modeOptions, ca
  * the same way `parseTerraformRootDir`'s callers exercise it against files.
  */
 export async function parseTerraformRootContent(content, root, hcl2json, modeOptions) {
-    return blocksToEntities(splitBundleContent(content), root, hcl2json, modeOptions);
+    return blocksToEntities(bundleFilesFor(splitBundleContent(content), modeOptions?.binary), root, hcl2json, modeOptions);
+}
+/**
+ * The files of a joined bundle a root run by `binary` reads: the same set
+ * {@link listTerraformFiles} gives for a directory holding them, plus the
+ * Terragrunt files, in bundle order (chant#4457).
+ */
+export function bundleFilesFor(files, binary) {
+    const keep = new Set(selectConfigFiles(files.map((f) => f.name), binary));
+    return files.filter((f) => keep.has(f.name) || isTerragruntFileName(f.name));
 }
 /** The root name an audit of the audited directory itself parses under. */
 export const AUDIT_ROOT_NAME = "audit-root";

package/dist/hcl/roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roots.d.ts","sourceRoot":"","sources":["../../src/hcl/roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAyC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAGvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAiE/B"}
+{"version":3,"file":"roots.d.ts","sourceRoot":"","sources":["../../src/hcl/roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAyC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAIvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAsE/B"}

package/dist/hcl/roots.js

@@ -31,6 +31,7 @@ import { isResourceDeclarable } from "@intentius/chant/declarable";
 import { LIVE_TYPE, parseTerraformRootDir } from "./parse.js";
 import { descendModules, resolveCallModuleType } from "./descend.js";
 import { resolveEntityReferences } from "./edges.js";
+import { resolveInstanceNodes } from "./instances.js";
 /**
  * Parse each configured root into entities keyed `<root>/<address>`, plus its
  * local child modules, keyed `<root>/module.<name>/<address>` (#2112). Roots
@@ -71,6 +72,10 @@ export async function renderTerraformRoots(opts) {
             for (const [key, entity] of descended.entities)
                 entities.set(key, entity);
             warnings.push(...descended.warnings);
+            // Instance nodes the root's variables let the declared graph count,
+            // and those under expanded module calls (#4486). Needs the root and
+            // every child scope parsed, so it runs once the descent has.
+            await resolveInstanceNodes(entities, name, { dir, ...(root.varFiles ? { varFiles: root.varFiles } : {}), hcl2json: opts.hcl2json });
             // A `live` block or `estate.chdf.hcl` sidecar only takes effect under
             // choudoufu; under any other binary it parses fine but is inert, which
             // is worth a warning rather than silence (#2103).

package/dist/hcl/suppressions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/hcl/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAkB,MAAM,oCAAoC,CAAC;AAgF/F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAClD,kHAAkH;IAClH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CA8D3E;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,oBAAoB,EAAE,CAAA;CAAE,CAKvH"}
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/hcl/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAkB,MAAM,oCAAoC,CAAC;AAsF/F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAClD,kHAAkH;IAClH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CA8D3E;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,oBAAoB,EAAE,CAAA;CAAE,CAKvH"}

package/dist/hcl/suppressions.js

@@ -24,9 +24,9 @@
  * queue slot in file order, same as they're numbered `~2`/`~3` in file order.
  */
 /** A block header keyword with zero labels (`terraform {`, `locals {`). */
-const BARE_RE = /^\s*(terraform|locals|remote_state)\s*\{/;
+const BARE_RE = /^\s*(terraform|locals|remote_state|moved|import|removed)\s*\{/;
 /** One label (`provider "aws" {`, `module "vpc" {`, `variable "x" {`, `output "x" {`). */
-const ONE_LABEL_RE = /^\s*(provider|module|variable|output|dependency|generate)\s+"([^"]*)"\s*\{/;
+const ONE_LABEL_RE = /^\s*(provider|module|variable|output|check|dependency|generate)\s+"([^"]*)"\s*\{/;
 /** Two labels (`resource "aws_s3_bucket" "assets" {`, `data "aws_ami" "x" {`). */
 const TWO_LABEL_RE = /^\s*(resource|data)\s+"([^"]*)"\s+"([^"]*)"\s*\{/;
 /** A `#`/`//` comment naming one of the three suppression forms. */
@@ -40,6 +40,12 @@ function addressFor(keyword, labels) {
             return "locals";
         case "remote_state":
             return "remote_state";
+        case "moved":
+        case "import":
+        case "removed":
+            return keyword;
+        case "check":
+            return `check.${labels[0]}`;
         case "dependency":
             return `dependency.${labels[0]}`;
         case "generate":

package/dist/index.d.ts

@@ -1,10 +1,19 @@
 export { terraformPlugin } from "./plugin.js";
-export { terraformCapabilityPlugin, terraformApplyCapability, TerraformPlanMovedError, TERRAFORM_VERB_FAMILIES, type TerraformApplyStepInput, type TerraformApplyStepOutput, } from "./components/capability-plugin.js";
+export { terraformCapabilityPlugin, terraformApplyCapability, TerraformPlanMovedError, TERRAFORM_VERB_FAMILIES, choudoufuOutputSource, choudoufuMemberPlannedOutputs, type TerraformApplyStepInput, type TerraformApplyStepOutput, } from "./components/capability-plugin.js";
+export { mergeStates, splitState, splitStates, derivedLineage, COMPOSE_LINEAGE, type SplitState } from "./compose/state-merge.js";
+export { slicePlan as sliceComposedPlan, sliceText, planCounts, composedReads, composedMemberPlans, type PlanCounts, type ComposedMemberRead, type ComposedMemberPlan, type ComposedMemberPlansOptions, } from "./compose/slice.js";
+export { readApplyEvents, memberApply, composedApplyOutcomes, type ApplyEvents, type MemberApply, type MemberApplyOutcome } from "./compose/apply-events.js";
+export { topModule, stripModule, stripChange, moduleChanges } from "./compose/module-address.js";
+export { EstateRun, estateVersionFallback, estateOutcomes, readEstateApplyText, type ComposedRunner, type ComposedRunPlan, type ComposedRunApply, type ComposedMemberOutcome, type EstateRunOptions, } from "./compose/estate.js";
+export { priorStateValues, stateResources, stateOutputs, type StateResourceValues } from "./applied-state.js";
+export { ComposedRun, composedPlanDigest, changesSomething, type ComposedRunOptions, type ComposedRunStage, type StateRunPlan, type StateRunApply, type StateMemberOutcome, type ComposedStateWrite, type ComposeHook, type ComposeHookMoment, } from "./compose/run.js";
+export { terraformPlanShape, type TerraformPlanShapeOptions } from "./plan-shape.js";
+export { compositionFor, compositionIfEnabled, composeOff, composeSet, readOrder, moduleNames, fallbackLine, withPlanFailed, identityKey, DEFAULT_COMPOSE_MAX, COMPOSE_STEP_KIND, type Composition, type CompositionInput, type ComposedRead, type ComposeFallback, type ComposeFallbackKind, type ExpectedBinary, } from "./compose.js";
 export { terraformSerializer } from "./serializer.js";
 export { terraformConfigSchema, terraformRootSchema, type TerraformConfig, type TerraformRootConfig, type TerraformConfigNamespace, } from "./config.js";
 export { blocksToEntities, parseTerraformRootContent, parseTerraformRootDir, readLiveSidecarFile, splitBundleContent, terraformEntity, DATA_TYPE, LIVE_SIDECAR_FILENAME, LIVE_TYPE, LOCALS_TYPE, MODULE_TYPE, OUTPUT_TYPE, PROVIDER_TYPE, RESOURCE_TYPE, TERRAFORM_TYPE, VARIABLE_TYPE, type BlockBody, type TerraformEntity, type TerraformFile, type TerraformRootMode, type TerraformRootModeOptions, } from "./hcl/parse.js";
 export { renderTerraformRoots, type TerraformRootsResult } from "./hcl/roots.js";
-export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformPinRollout, } from "./op/builders.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, choudoufuPlanSet, terraformPinRollout, } from "./op/builders.js";
 export { parseAdoptionCommands, readAdoptionLedger, renderAdoptionLedger, type AdoptionCandidate, type AdoptionLedger, type AdoptionMatch, } from "./op/adoption.js";
 export { TerraformApplyOp } from "./composites/terraform-apply-op.js";
 export type { TerraformApplyOpConfig, TerraformApplyOpResources, TerraformGateMode, } from "./composites/terraform-apply-op.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAM3C,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAIzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,YAAY,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAKzH,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAQnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAM3C,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EAEvB,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,gCAAgC,CAAC;AAIxC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC/H,OAAO,EACL,SAAS,IAAI,iBAAiB,EAC9B,SAAS,EACT,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC1J,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG9F,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3G,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAIlF,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAIzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,YAAY,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAKzH,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAQnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -4,7 +4,26 @@ export { terraformPlugin } from "./plugin.js";
 // capability-plugin seam. Core loads `terraformCapabilityPlugin` when a
 // project's chant.config lists this lexicon, so a component can deploy a root
 // and a fan-out can run many of them in gated waves.
-export { terraformCapabilityPlugin, terraformApplyCapability, TerraformPlanMovedError, TERRAFORM_VERB_FAMILIES, } from "./components/capability-plugin.js";
+export { terraformCapabilityPlugin, terraformApplyCapability, TerraformPlanMovedError, TERRAFORM_VERB_FAMILIES, 
+// #4455: a choudoufu member's outputs, read for core's `member-outputs`.
+choudoufuOutputSource, choudoufuMemberPlannedOutputs, } from "./components/capability-plugin.js";
+// Composed runs (#4442): the working state merged and split, the composed
+// plan cut into one plan per member, and each member's apply outcome.
+export { mergeStates, splitState, splitStates, derivedLineage, COMPOSE_LINEAGE } from "./compose/state-merge.js";
+export { slicePlan as sliceComposedPlan, sliceText, planCounts, composedReads, composedMemberPlans, } from "./compose/slice.js";
+export { readApplyEvents, memberApply, composedApplyOutcomes } from "./compose/apply-events.js";
+export { topModule, stripModule, stripChange, moduleChanges } from "./compose/module-address.js";
+// Composed runs of choudoufu estates (#4445): one plan and one apply, values read from a post-apply plan.
+export { EstateRun, estateVersionFallback, estateOutcomes, readEstateApplyText, } from "./compose/estate.js";
+export { priorStateValues, stateResources, stateOutputs } from "./applied-state.js";
+// Composed runs over roots with state (#4444): one plan and one apply, each
+// state written back whatever happened. Implements `ComposedRunner` (#4445).
+export { ComposedRun, composedPlanDigest, changesSomething, } from "./compose/run.js";
+// The plan shape of a `show -json` plan (#4436), for core's `coveredRound`.
+export { terraformPlanShape } from "./plan-shape.js";
+// Composed runs (#4419, #4438): which roots compose, in what order, and why
+// the others fall back. Off unless `terraform.compose.enabled` is set.
+export { compositionFor, compositionIfEnabled, composeOff, composeSet, readOrder, moduleNames, fallbackLine, withPlanFailed, identityKey, DEFAULT_COMPOSE_MAX, COMPOSE_STEP_KIND, } from "./compose.js";
 // Serializer
 export { terraformSerializer } from "./serializer.js";
 // The `terraform` config namespace. Importing this package is what brings the
@@ -18,7 +37,7 @@ export { renderTerraformRoots } from "./hcl/roots.js";
 // Typed Op step builders (#2086). Same names as the activities they wrap, and
 // like k3s's they are opt-in from the lexicon root — the activities themselves
 // are reached by the registry through `./op/activities`, never from here.
-export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformPinRollout, } from "./op/builders.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, choudoufuPlanSet, terraformPinRollout, } from "./op/builders.js";
 // The adoption ledger over `live-plan -json`'s document (#2105). Pure, and
 // exported because the ledger's shape is what a project reading an Op's own
 // result is reading.

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "2b3f8b18903d43627d811f5ccfb418ddbcf2ce8aecde7fe38eafd28a6a593559",
+    "manifest.json": "a4392033f97c3faba6875ccbdaee0d9702511e9c441b628b5ad7352aa61bd101",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "7c10245b2c3335253b48ee7d8b075d89f43116bde20313a5d1031b343fef1282",
@@ -54,7 +54,7 @@
     "rules/tf043.ts": "c8724a7c0734870101d73e411ed97240c03a01a1133adbf0b445a5083f40faee",
     "rules/tf044.ts": "4e9b17a6080074d2b2e02862a9f1c9c2baf0ef32d4f3b48df1e62d9d8c362008",
     "rules/tf045.ts": "760b1f4f385fbe7a86897efe3078fdeac11bcc9bfb806285d63db50488174b7b",
-    "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
+    "skills/chant-terraform.md": "53dd11c7b289652f92fdaf2c03766abda46d8964e31fe709e8b142ced4f19c50"
   },
-  "composite": "acd11f24f4546441f7084748e2617792a690dedbd9677aa19333461e23c47a0d"
+  "composite": "8f145fa60592252c6d7e4bb60ce4599c7bcfb273853c12a1626757b34bd72411"
 }

package/dist/live-plan-reasons.d.ts

@@ -0,0 +1,21 @@
+/**
+ * choudoufu's live-plan omission codes, in chant's vocabulary.
+ *
+ * Its own module so the observation reader (`./describe-resources.ts`) and
+ * the drift adapters (`./drift-record.ts`) read one table, and the drift
+ * adapters bundle without the reader's process and file-system imports.
+ */
+import type { UnobservedReason } from "@intentius/chant/observation";
+/**
+ * choudoufu's omission reason codes, mapped onto chant's total vocabulary
+ * (`internal/live/projection/result.go`). `"absent"` is not an
+ * {@link UnobservedReason}: it is the tri-state's OBSERVED-ABSENT, the one
+ * omission that is a claim of knowledge rather than of ignorance.
+ *
+ * A code this table does not know maps to `read-failed`, which is the safe
+ * direction: no NOT-OBSERVED verdict ever becomes a create or a delete.
+ */
+export declare const LIVE_PLAN_OMISSION_REASONS: Readonly<Record<string, UnobservedReason | "absent">>;
+/** Does this text name a credentials or authorization failure rather than any other error? */
+export declare function readsAsCredentials(text: string): boolean;
+//# sourceMappingURL=live-plan-reasons.d.ts.map

package/dist/live-plan-reasons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-plan-reasons.d.ts","sourceRoot":"","sources":["../src/live-plan-reasons.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,QAAQ,CAAC,CA0B5F,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIxD"}

package/dist/live-plan-reasons.js

@@ -0,0 +1,47 @@
+/**
+ * choudoufu's live-plan omission codes, in chant's vocabulary.
+ *
+ * Its own module so the observation reader (`./describe-resources.ts`) and
+ * the drift adapters (`./drift-record.ts`) read one table, and the drift
+ * adapters bundle without the reader's process and file-system imports.
+ */
+/**
+ * choudoufu's omission reason codes, mapped onto chant's total vocabulary
+ * (`internal/live/projection/result.go`). `"absent"` is not an
+ * {@link UnobservedReason}: it is the tri-state's OBSERVED-ABSENT, the one
+ * omission that is a claim of knowledge rather than of ignorance.
+ *
+ * A code this table does not know maps to `read-failed`, which is the safe
+ * direction: no NOT-OBSERVED verdict ever becomes a create or a delete.
+ */
+export const LIVE_PLAN_OMISSION_REASONS = {
+    // The provider was asked and reported, normally, that nothing is there.
+    ABSENT: "absent",
+    // The provider errored, or could not be reached in a usable order.
+    FAILED: "read-failed",
+    PARENT_UNAVAILABLE: "read-failed",
+    CYCLE: "read-failed",
+    INCOMPLETE_BLOCK: "read-failed",
+    LISTED_NOT_IMPORTABLE: "read-failed",
+    // Something exists at the identity and does not carry this estate's marker.
+    // Normally answered by the `unowned[]` section before this table is read;
+    // this entry is what happens if a document ever carries the omission alone.
+    UNOWNED: "read-failed",
+    // The mode cannot name, list or tag this instance at all: a server-assigned
+    // identity with no marker to find it by, a resource with no cloud object to
+    // read, or an address another declared instance has taken over.
+    NEEDS_DISCOVERY: "unsupported-kind",
+    UNREADABLE: "unsupported-kind",
+    SUPERSEDED: "unsupported-kind",
+    // The run's own tag index saw an object at the identity and the import
+    // read could not confirm it (choudoufu #1043). The read failed; the
+    // object is not proposed for creation.
+    VERIFIED_NOT_IMPORTABLE: "read-failed",
+    // -target or -exclude left the block out of the plan graph (choudoufu
+    // #1176): nothing was read because the caller asked for it not to be.
+    OUT_OF_SCOPE: "filtered",
+};
+/** Does this text name a credentials or authorization failure rather than any other error? */
+export function readsAsCredentials(text) {
+    return /\b(no valid credential|credentials?|not authorized|unauthorized|accessdenied|access denied|expiredtoken|invalidclienttokenid|signature)\b/i.test(text);
+}

package/dist/lsp/option-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAMtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAYpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAStC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}
+{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAQtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAYpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAStC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}

package/dist/lsp/option-keys.js

@@ -18,7 +18,9 @@ export const ROOT_ENTRY_KEYS = [
     { key: "workspace", detail: "Terraform workspace to select for this root. Omitted means `default`." },
     { key: "varFiles", detail: "`-var-file` arguments, in order, relative to `dir`." },
     { key: "backendConfig", detail: "`-backend-config` key/value pairs handed to `init`." },
+    { key: "backendConfigFiles", detail: "Backend-config files handed to `init` as `-backend-config=<path>`, before the pairs, relative to `dir`." },
     { key: "delete", detail: '"never" | "owned-only" | "gated" — this root\'s delete mode, mapped onto choudoufu\'s policy block on a live root.' },
+    { key: "signalOnly", detail: "`true` when the root is declared only so a change to it brings this project into the change. The build and live reads skip it." },
 ];
 /** `TerraformApplyOpConfig`'s keys (`TerraformApplyOp({ <here> })`). */
 export const APPLY_OP_KEYS = [

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.124.52",
+  "version": "0.124.54",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/op/activities/index.d.ts

@@ -16,6 +16,10 @@
  *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
  *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
  *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
+ *   - choudoufuPlanSet: `live-plan-set -json` over one live root, as a
+ *     one-root set (#3459). Its `changeSet` is the root's part, so an Op can
+ *     plan several clouds' roots and hand the parts to `composeChangeSet`
+ *     (#4483).
  *   - terraformPinRollout: one run of a pin-bump rollout, opening at most one
  *     wave's pull request (#3189). It loads the HCL parser on first call.
  *
@@ -25,8 +29,8 @@
  * run time. The pure command and environment builders are exported alongside
  * the activities because they are what the tests assert on.
  */
-export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
-export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformApprovalRefusal, TerraformShowResult, ChoudoufuLivePlanResult, ChoudoufuLiveLsResult, ChoudoufuLiveCheckResult, ChoudoufuAdoptResult, AdoptionRefusal, PlanChangeCounts, LivePlanUnownedCounts, } from "./terraform.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, choudoufuPlanSet, choudoufuPlanSetCommand, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, MIN_CHOUDOUFU_ESTATES_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
+export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformApprovalRefusal, TerraformShowResult, ChoudoufuLivePlanResult, ChoudoufuLiveLsResult, ChoudoufuLiveCheckResult, ChoudoufuAdoptResult, ChoudoufuPlanSet, ChoudoufuPlanSetResult, AdoptionRefusal, PlanChangeCounts, LivePlanUnownedCounts, } from "./terraform.js";
 export { detectLiveEstate } from "./live-detect.js";
 export { terraformPinRollout } from "./pin-rollout.js";
 export type { TerraformPinRolloutArgs, TerraformPinRolloutResult } from "./pin-rollout.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC"}

package/dist/op/activities/index.js

@@ -16,6 +16,10 @@
  *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
  *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
  *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
+ *   - choudoufuPlanSet: `live-plan-set -json` over one live root, as a
+ *     one-root set (#3459). Its `changeSet` is the root's part, so an Op can
+ *     plan several clouds' roots and hand the parts to `composeChangeSet`
+ *     (#4483).
  *   - terraformPinRollout: one run of a pin-bump rollout, opening at most one
  *     wave's pull request (#3189). It loads the HCL parser on first call.
  *
@@ -25,6 +29,6 @@
  * run time. The pure command and environment builders are exported alongside
  * the activities because they are what the tests assert on.
  */
-export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, choudoufuPlanSet, choudoufuPlanSetCommand, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, MIN_CHOUDOUFU_ESTATES_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
 export { detectLiveEstate } from "./live-detect.js";
 export { terraformPinRollout } from "./pin-rollout.js";

package/dist/op/activities/live-detect.d.ts

@@ -1,7 +1,8 @@
 /**
  * A fast, regex-based read of whether a root module directory declares a
  * live estate: an `estate.chdf.hcl` sidecar, or a `live { ... }` block nested
- * inside a `terraform { ... }` block of some `.tf` file (#2103).
+ * inside a `terraform { ... }` block of some configuration file (#2103), the
+ * `terraform` object of a `.tf.json` file included (chant#4504).
  *
  * Deliberately separate from `../../hcl/parse.ts`'s AST-accurate detection
  * (`blocksToEntities`'s `liveBlocksIn`), which the build and lint paths use.
@@ -25,7 +26,7 @@
  * no sidecar (or one this function cannot read) yields `undefined` rather
  * than throwing, since this is a best-effort check, not the authoritative parse.
  */
-export declare function detectLiveEstate(dir: string): string | undefined;
+export declare function detectLiveEstate(dir: string, binary?: string): string | undefined;
 /**
  * The `undeclared_tagged`/`undeclared_untagged` verbs a live root's `policy {
  * }` block assigns, or `undefined` when the directory declares no `policy`
@@ -47,5 +48,5 @@ export interface LivePolicyVerbs {
     /** The `undeclared_untagged` quadrant's verb, verbatim, or `undefined` when the attribute is absent. */
     undeclaredUntagged?: string;
 }
-export declare function detectLivePolicyVerbs(dir: string): LivePolicyVerbs | undefined;
+export declare function detectLivePolicyVerbs(dir: string, binary?: string): LivePolicyVerbs | undefined;
 //# sourceMappingURL=live-detect.d.ts.map

package/dist/op/activities/live-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-detect.d.ts","sourceRoot":"","sources":["../../../src/op/activities/live-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA6CH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoChE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,+HAA+H;IAC/H,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CA8B9E"}
+{"version":3,"file":"live-detect.d.ts","sourceRoot":"","sources":["../../../src/op/activities/live-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA2EH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAc,GAAG,MAAM,GAAG,SAAS,CAgCtF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,+HAA+H;IAC/H,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAc,GAAG,eAAe,GAAG,SAAS,CAgCpG"}