@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/dist/state/store.d.ts

@@ -0,0 +1,51 @@
+import type { LockableState } from "./backend.js";
+import { type StoreFetch } from "./object-store.js";
+/** The lock a state's backend holds: the ID `force-unlock` takes, and the lock info the binary (or a run) wrote. */
+export interface LockHolder {
+    id: string;
+    /** The lock info as written, JSON. */
+    info: string;
+}
+/** A state where it is, for what locks it and keeps beside it. */
+export interface StateStore {
+    readonly backend: LockableState["backend"];
+    /** Where the state is. */
+    readonly location: string;
+    /** Where its lock is: the lock object, or the blob whose lease is the lock. */
+    readonly lockLocation: string;
+    /** The lock the backend holds now, or undefined. */
+    heldLock(): Promise<LockHolder | undefined>;
+    /** Take the state's lock with `info`, the way the backend takes it: false when it is held. */
+    lock(info: string): Promise<boolean>;
+    /** Release the lock `lock` took, or the one `adopt` took over. */
+    unlock(): Promise<void>;
+    /**
+     * Write a new state under the lock, for a backend whose lock keeps the
+     * binary from writing (azurerm's lease); undefined for a backend the
+     * binary writes with `-lock=false` while the run holds the lock.
+     */
+    write?: (body: string) => Promise<void>;
+    /**
+     * The object beside the state whose key is the state's with `suffix` after
+     * it, in the same bucket, container or directory, under the state's own
+     * access controls: read (undefined when there is none), written, removed.
+     */
+    readBeside(suffix: string): Promise<string | undefined>;
+    writeBeside(suffix: string, body: string): Promise<void>;
+    removeBeside(suffix: string): Promise<void>;
+    /** Where the object beside the state with `suffix` is, for messages. */
+    besideLocation(suffix: string): string;
+    /**
+     * Take over a lock this store finds held, which an earlier run of the same
+     * operation left held on purpose: `unlock` then releases it. A lease
+     * (azurerm) is taken over by its ID, the others need nothing.
+     */
+    adopt(held: LockHolder): void;
+}
+/** The ID in a lock info's JSON, or "" when it names none. */
+export declare function lockId(text: string): string;
+/** The metadata an azurerm backend keeps a lock's info in, base64 JSON, on the leased blob. */
+export declare const LOCK_METADATA = "terraformlockid";
+/** The store a state is in, opened with the credentials stateObject chose. `dir` is the root a local path is relative to. */
+export declare function stateStore(o: LockableState, dir: string, fetchFn?: StoreFetch): StateStore;
+//# sourceMappingURL=store.d.ts.map

package/dist/state/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/state/store.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAoC,aAAa,EAAW,MAAM,WAAW,CAAC;AAE1F,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAG7D,oHAAoH;AACpH,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3C,0BAA0B;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,oDAAoD;IACpD,QAAQ,IAAI,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IAC5C,8FAA8F;IAC9F,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,kEAAkE;IAClE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC;;;;OAIG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACxD,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,wEAAwE;IACxE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;IACvC;;;;OAIG;IACH,KAAK,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAAC;CAC/B;AAED,8DAA8D;AAC9D,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3C;AAiDD,+FAA+F;AAC/F,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAsF/C,6HAA6H;AAC7H,wBAAgB,UAAU,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,UAAU,CAK1F"}

package/dist/state/store.js

@@ -0,0 +1,185 @@
+/**
+ * A state where it is, opened for its lock and for what a run keeps beside
+ * it. Each backend locks its own way:
+ *
+ *   s3       the lock file `use_lockfile` takes, `<key>.tflock`, written only
+ *            when absent
+ *   gcs      the lock object `<prefix>/<workspace>.tflock`, written only when
+ *            absent; the ID `force-unlock` takes is its generation
+ *   azurerm  a lease on the state blob, with the lock info base64 in its
+ *            `terraformlockid` metadata; the binary cannot write the blob
+ *            while chant holds the lease, so the store writes it
+ *   local    a lock file `<path>.tflock` beside the state, created only when
+ *            absent. It keeps another chant run out; the binary's own local
+ *            lock is a file lock it takes per command, so the run writes
+ *            with `-lock=false` while it holds this one. A bare
+ *            `terraform apply` on the same checkout at the same time is not
+ *            kept out. Ruled on #4481 (ruling 4, 2026-10-25): chant's own
+ *            lock file, no Terraform lock-info file, local backends allowed.
+ *
+ * Lifted from terragucci's `backend.ts` (c493e0e): `StateStore`, `s3Store`,
+ * `gcsStore` and `azureStore`, plus a local store and `removeBeside`.
+ */
+import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join } from "node:path";
+import { AzureBlobClient } from "./azure-blob.js";
+import { GcsClient } from "./gcs.js";
+import { StoreError } from "./object-store.js";
+import { S3Client } from "./s3.js";
+/** The ID in a lock info's JSON, or "" when it names none. */
+export function lockId(text) {
+    try {
+        const v = JSON.parse(text);
+        return typeof v.ID === "string" ? v.ID : "";
+    }
+    catch {
+        return "";
+    }
+}
+const JSON_TYPE = "application/json";
+/** The S3 state, locked by the lock file `use_lockfile` takes. */
+function s3Store(o, fetchFn) {
+    const client = new S3Client(o.target, fetchFn);
+    const lockKey = `${o.key}.tflock`;
+    return {
+        backend: "s3",
+        location: `s3://${o.bucket}/${o.key}`,
+        lockLocation: `s3://${o.bucket}/${lockKey}`,
+        heldLock: async () => {
+            const text = await client.get(lockKey);
+            return text === undefined ? undefined : { id: lockId(text), info: text };
+        },
+        lock: (info) => client.putIfAbsent(lockKey, info, JSON_TYPE),
+        unlock: () => client.remove(lockKey),
+        readBeside: (suffix) => client.get(`${o.key}${suffix}`),
+        writeBeside: (suffix, body) => client.put(`${o.key}${suffix}`, body, JSON_TYPE),
+        removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
+        besideLocation: (suffix) => `s3://${o.bucket}/${o.key}${suffix}`,
+        adopt: () => { },
+    };
+}
+/** The GCS state, locked by `<prefix>/<workspace>.tflock`, whose generation is the lock's ID. */
+function gcsStore(o, fetchFn) {
+    const client = new GcsClient(o.target, fetchFn);
+    return {
+        backend: "gcs",
+        location: `gs://${o.bucket}/${o.key}`,
+        lockLocation: `gs://${o.bucket}/${o.lock}`,
+        heldLock: async () => {
+            const head = await client.head(o.lock);
+            const info = head.exists ? await client.get(o.lock) : undefined;
+            if (!head.exists || info === undefined)
+                return undefined;
+            return { id: head.generation ?? lockId(info), info };
+        },
+        lock: (info) => client.putIfAbsent(o.lock, info, JSON_TYPE),
+        unlock: () => client.remove(o.lock),
+        readBeside: (suffix) => client.get(`${o.key}${suffix}`),
+        writeBeside: (suffix, body) => client.put(`${o.key}${suffix}`, body, JSON_TYPE),
+        removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
+        besideLocation: (suffix) => `gs://${o.bucket}/${o.key}${suffix}`,
+        adopt: () => { },
+    };
+}
+/** The metadata an azurerm backend keeps a lock's info in, base64 JSON, on the leased blob. */
+export const LOCK_METADATA = "terraformlockid";
+/** The azurerm state blob, locked by a lease on it with the lock info in its metadata. */
+function azureStore(o, fetchFn) {
+    const client = new AzureBlobClient({ account: o.account, container: o.container, endpoint: o.endpoint, ...o.auth }, fetchFn);
+    let leaseId;
+    const at = `az://${o.account}/${o.container}/${o.key}`;
+    return {
+        backend: "azurerm",
+        location: at,
+        lockLocation: at,
+        heldLock: async () => {
+            const head = await client.head(o.key);
+            if (!head.exists || head.leaseState !== "leased")
+                return undefined;
+            const meta = head.metadata[LOCK_METADATA];
+            const info = meta ? Buffer.from(meta, "base64").toString("utf-8") : "";
+            return { id: lockId(info), info };
+        },
+        lock: async (info) => {
+            const id = lockId(info);
+            // The backend leases a blob that is there: a state with none yet gets an empty one first, as the backend makes it.
+            if (!(await client.head(o.key)).exists)
+                await client.putBlob(o.key, "", JSON_TYPE, { ifNoneMatch: true });
+            if (!(await client.lease(o.key, "acquire", id)))
+                return false;
+            leaseId = id;
+            await client.setMetadata(o.key, { [LOCK_METADATA]: Buffer.from(info).toString("base64") }, id);
+            return true;
+        },
+        unlock: async () => {
+            if (!leaseId)
+                return;
+            const id = leaseId;
+            await client.setMetadata(o.key, {}, id);
+            await client.lease(o.key, "release", id);
+            leaseId = undefined;
+        },
+        write: async (body) => {
+            if (!leaseId)
+                throw new StoreError(`${at} is written under its lease, and none is held`);
+            // As the backend writes it: a snapshot first when it takes snapshots, and the lock info kept on the blob.
+            if (o.snapshot && (await client.head(o.key)).exists)
+                await client.snapshot(o.key);
+            const meta = (await client.head(o.key)).metadata;
+            await client.putBlob(o.key, body, JSON_TYPE, { leaseId, metadata: meta });
+        },
+        readBeside: (suffix) => client.get(`${o.key}${suffix}`),
+        writeBeside: async (suffix, body) => void (await client.putBlob(`${o.key}${suffix}`, body, JSON_TYPE)),
+        removeBeside: (suffix) => client.remove(`${o.key}${suffix}`),
+        besideLocation: (suffix) => `${at}${suffix}`,
+        adopt: (held) => {
+            leaseId = held.id;
+        },
+    };
+}
+/** A local state, locked by `<path>.tflock` created only when absent. `dir` is the root the path is relative to. */
+function localStore(o, dir) {
+    const file = isAbsolute(o.path) ? o.path : join(dir, o.path);
+    const lockFile = `${file}.tflock`;
+    const read = (f) => (existsSync(f) ? readFileSync(f, "utf-8") : undefined);
+    return {
+        backend: "local",
+        location: file,
+        lockLocation: lockFile,
+        heldLock: async () => {
+            const text = read(lockFile);
+            return text === undefined ? undefined : { id: lockId(text), info: text };
+        },
+        lock: async (info) => {
+            mkdirSync(dirname(lockFile), { recursive: true });
+            try {
+                writeFileSync(lockFile, info, { flag: "wx" });
+                return true;
+            }
+            catch (e) {
+                if (e.code === "EEXIST")
+                    return false;
+                throw e;
+            }
+        },
+        unlock: async () => rmSync(lockFile, { force: true }),
+        readBeside: async (suffix) => read(`${file}${suffix}`),
+        writeBeside: async (suffix, body) => {
+            mkdirSync(dirname(file), { recursive: true });
+            writeFileSync(`${file}${suffix}`, body);
+        },
+        removeBeside: async (suffix) => rmSync(`${file}${suffix}`, { force: true }),
+        besideLocation: (suffix) => `${file}${suffix}`,
+        adopt: () => { },
+    };
+}
+/** The store a state is in, opened with the credentials stateObject chose. `dir` is the root a local path is relative to. */
+export function stateStore(o, dir, fetchFn) {
+    if (o.backend === "s3")
+        return s3Store(o, fetchFn);
+    if (o.backend === "gcs")
+        return gcsStore(o, fetchFn);
+    if (o.backend === "azurerm")
+        return azureStore(o, fetchFn);
+    return localStore(o, dir);
+}

package/dist/terragrunt/affected.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"affected.d.ts","sourceRoot":"","sources":["../../src/terragrunt/affected.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAAqE,KAAK,qBAAqB,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7I,OAAO,EAAmE,KAAK,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAGnH,8BAA8B;AAC9B,MAAM,MAAM,sBAAsB;AAChC,2CAA2C;AACzC,YAAY;AACd,uHAAuH;GACrH,SAAS;AACX,uFAAuF;GACrF,aAAa;AACf,mEAAmE;GACjE,aAAa;AACf,0EAA0E;GACxE,gBAAgB,CAAC;AAErB,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,8HAA8H;IAC9H,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4GAA4G;IAC5G,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,8IAA8I;IAC9I,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,mEAAmE;IACnE,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,mHAAmH;IACnH,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAQD,8GAA8G;AAC9G,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,GAAG,MAAM,EAAE,CAYrH;AAED,6FAA6F;AAC7F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAE7F;AAED,mJAAmJ;AACnJ,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAOnE;AAED,oGAAoG;AACpG,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAoB5G;AAmCD,4FAA4F;AAC5F,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB9D;AAQD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CA6ErF;AAED,sDAAsD;AACtD,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAczF;AAED,MAAM,WAAW,6BAA8B,SAAQ,oBAAoB,EAAE,qBAAqB;IAChG,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qGAAqG;AACrG,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuBhH"}
+{"version":3,"file":"affected.d.ts","sourceRoot":"","sources":["../../src/terragrunt/affected.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAKH,OAAO,EAAqE,KAAK,qBAAqB,EAAE,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAC7I,OAAO,EAAmE,KAAK,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAGnH,8BAA8B;AAC9B,MAAM,MAAM,sBAAsB;AAChC,2CAA2C;AACzC,YAAY;AACd,uHAAuH;GACrH,SAAS;AACX,uFAAuF;GACrF,aAAa;AACf,mEAAmE;GACjE,aAAa;AACf,0EAA0E;GACxE,gBAAgB,CAAC;AAErB,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,sBAAsB,CAAC;IAC7B,8HAA8H;IAC9H,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4GAA4G;IAC5G,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,sBAAsB;IACrC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,sGAAsG;IACtG,OAAO,EAAE,wBAAwB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,0CAA0C;IAC1C,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,8IAA8I;IAC9I,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACtC,iGAAiG;IACjG,GAAG,EAAE,MAAM,CAAC;IACZ,0EAA0E;IAC1E,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IACjC,mEAAmE;IACnE,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,mHAAmH;IACnH,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;CACjC;AAQD,8GAA8G;AAC9G,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,qBAAqB,GAAG,MAAM,EAAE,CAYrH;AAED,6FAA6F;AAC7F,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAE7F;AAED,mJAAmJ;AACnJ,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM,EAAE,CAOnE;AAED,oGAAoG;AACpG,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,oBAAoB,EAAE,CAoB5G;AAmCD,4FAA4F;AAC5F,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAiB9D;AAQD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,kBAAkB,CA8ErF;AAED,sDAAsD;AACtD,wBAAgB,gCAAgC,CAAC,MAAM,EAAE,wBAAwB,GAAG,MAAM,CAczF;AAED,MAAM,WAAW,6BAA8B,SAAQ,oBAAoB,EAAE,qBAAqB;IAChG,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qGAAqG;IACrG,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IAClC,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,qGAAqG;AACrG,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAuBhH"}

package/dist/terragrunt/affected.js

@@ -190,7 +190,8 @@ export function terragruntAffected(input) {
         const moduleDirs = terragruntModuleDirs(unit);
         const called = new Map();
         for (const m of moduleDirs) {
-            for (const d of rootWatchPaths(input.dir, { dir: m }))
+            // Terragrunt runs tofu when it is installed, so a module's `.tofu` files count (chant#4457).
+            for (const d of rootWatchPaths(input.dir, { dir: m }, "tofu"))
                 if (!moduleDirs.includes(d) && !called.has(d))
                     called.set(d, m);
         }

package/package.json

@@ -1,11 +1,10 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.124.52",
+  "version": "0.124.54",
   "type": "module",
   "files": [
     "src/",
     "dist/",
-    "schemas/",
     "workspace-kinds.json"
   ],
   "exports": {
@@ -40,6 +39,11 @@
       "types": "./dist/terragrunt/index.d.ts",
       "default": "./dist/terragrunt/index.js"
     },
+    "./state": {
+      "development": "./src/state/index.ts",
+      "types": "./dist/state/index.d.ts",
+      "default": "./dist/state/index.js"
+    },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
@@ -68,7 +72,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.52",
+    "@intentius/chant": "^0.124.54",
     "zod": "^4.3.6"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/__fixtures__/ACCEPTANCE.md

@@ -1,14 +1,17 @@
 # What the gated acceptance suites have actually run against
 
-Eight `describe` blocks across five files run this lexicon against a real
+Eleven `describe` blocks across eight files run this lexicon against a real
 binary rather than a fixture, and every one of them skips rather than fails
 when its dependency is absent. A skip is silent by design, so without this
 file nothing in the tree says which of them has ever passed, against what, or
 when. The evidence had been living in PR prose (`#2157` for the live apply
 pair), which no reader of the suite can see.
 
-One row per gated block below: what it proves, what gates it, the command,
-and the last binary and emulator it is known to have passed against.
+Ten sections below cover the eleven blocks, one section per block except
+section 6, where `plan-read.acceptance.test.ts`'s per-binary loop makes two
+blocks of one body. Each section says what the block proves, what gates it,
+the command, and the last binary and emulator it is known to have passed
+against, or "not recorded" when no run has been written down yet.
 
 `live-estate/README.md` next door is the sibling record for the two recorded
 documents (`../live-plan.json`, `../live-ls.json`) rather than for a suite,
@@ -31,7 +34,7 @@ same recipe one tag back
 `live/smoke/docker-compose.yml` and exported as
 `CHOUDOUFU_EMULATOR_ENDPOINT=http://localhost:<mapped port>`.
 
-## The four blocks
+## The eleven blocks
 
 ### 1. `TerraformApplyOp applies a real root`
 
@@ -52,7 +55,7 @@ npx vitest run lexicons/terraform/src/composites/terraform-apply-op.acceptance.t
 Last passed: 2026-09-08, `Terraform v1.15.8` on `darwin_arm64`, with
 `hashicorp/null` resolved from the public registry for the fixture's `~> 3.2`
 constraint. No emulator is involved. Re-run by chant #2241 alongside every
-other block in this file, so all four rows come from one run; #2168 had run it
+other block this file held then, so those four rows come from one run; #2168 had run it
 on 2026-09-07 the same way.
 
 ### 2. `TerraformApplyOp applies a live root against choudoufu's emulator`
@@ -172,7 +175,7 @@ path, which is the only thing it exists to prove.
 
 ### 5. `TerraformAdoptOp reaches its gate on a checkout that has never run init`
 
-Same file, third block (#2302). One test: build `TerraformAdoptOp` and drive
+Same file, second block (#2302). One test: build `TerraformAdoptOp` and drive
 it through `runOpLocally`, exactly as the apply Op's own acceptance suite
 does, over a project this test creates fresh and never initializes by hand —
 no `terraformInit` call anywhere in the block. The Op's own Init phase is what
@@ -215,7 +218,8 @@ With the Init phase back, the same run reaches its gate:
 
 `../plan-read.acceptance.test.ts`, one block per binary, three tests each, over
 the `plan-read/` fixture (built-in `terraform_data`, `local` backend, so no
-registry, no network and no credentials). The first reads the plan depth
+registry, no network and no credentials). Four tests each now; the run recorded
+below had three, before #4372 added the planned-create test. The first reads the plan depth
 through `describeResources` and checks the IR attributes, `sources` reading
 `"plan"`, no secret in the result, nothing new or changed in the root, and no
 `chant-terraform-plan-*` directory left in the temp dir. The second holds the
@@ -263,6 +267,64 @@ by chant #4371. Proved red the same day: with `plan-observation.ts`'s
 redaction put back to flagging each side by its own marks, the old secret
 came through as `tags.token`'s `before`.
 
+### 8. `Terragrunt units against a real terragrunt`
+
+`terragrunt/terragrunt.acceptance.test.ts` (#3414), four tests over the
+`terragrunt/five-units/` fixture (implicit stacks, `terraform_data` only,
+local state under the copied fixture, so no provider download and no cloud).
+It checks that `terragrunt` is 1.1 or later, that `discoverTerragruntUnits`
+lists what `terragrunt find` lists less the catalog template, that each of the
+three waves plans and applies exactly its own units and that the run report's
+per-unit results reach the change set with no input carrying a mock, and that
+a wave keeps to its units when a `.terragrunt-filters` file selects more.
+
+Gated on `terragrunt` and `tofu` on PATH.
+
+```
+npx vitest run lexicons/terraform/src/terragrunt/terragrunt.acceptance.test.ts
+```
+
+Last passed: not recorded. No run of this block has been written down; the
+maintainer records the first one here (maintainer run).
+
+### 9. `mock outputs in Terragrunt waves against a real terragrunt`
+
+`terragrunt/mocks.acceptance.test.ts` (#3416), one test over the same
+`five-units/` fixture. Wave 2 is refused until wave 1 has applied, naming each
+upstream and planning nothing. A provisional plan of wave 2 made before that
+reads the mocks, is marked provisional, matches Terragrunt's own mock warning,
+and is refused at apply. Once wave 1 applies, wave 2 plans on the real
+upstream values and applies.
+
+Gated on `terragrunt` and `tofu` on PATH.
+
+```
+npx vitest run lexicons/terraform/src/terragrunt/mocks.acceptance.test.ts
+```
+
+Last passed: not recorded. No run of this block has been written down; the
+maintainer records the first one here (maintainer run).
+
+### 10. `affected Terragrunt units against a real terragrunt`
+
+`terragrunt/affected.acceptance.test.ts` (#3415), over a git copy of the
+`terragrunt/affected/` fixture. One test checks discovery against
+`recorded/affected-find.json`; then one test per case in
+`__fixtures__/terragrunt/affected-cases.ts`, each made as a commit, checks that
+Terragrunt's own `[HEAD~1...HEAD]` filter selects exactly the case's
+`terragrunt` column (nothing, for the three supplements) and that
+`findTerragruntAffected` returns the case's expected units and reasons. Nothing
+is planned.
+
+Gated on `terragrunt` and `git` on PATH. It does not need `tofu`.
+
+```
+npx vitest run lexicons/terraform/src/terragrunt/affected.acceptance.test.ts
+```
+
+Last passed: not recorded. No run of this block has been written down; the
+maintainer records the first one here (maintainer run).
+
 ## Running everything that can run on a machine with no choudoufu
 
 ```

package/src/__fixtures__/compose/apply-failed-in-app.jsonl

@@ -0,0 +1,12 @@
+{"@level":"info","@message":"Terraform 1.10.5","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.101000Z","terraform":"1.10.5","type":"version","ui":"1.2"}
+{"@level":"info","@message":"module.net.terraform_data.vpc: Plan to update","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412000Z","change":{"resource":{"addr":"module.net.terraform_data.vpc","module":"module.net","resource":"terraform_data.vpc","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"vpc","resource_key":null},"action":"update"},"type":"planned_change"}
+{"@level":"info","@message":"module.app.terraform_data.service: Plan to create","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412100Z","change":{"resource":{"addr":"module.app.terraform_data.service","module":"module.app","resource":"terraform_data.service","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"service","resource_key":null},"action":"create"},"type":"planned_change"}
+{"@level":"info","@message":"module.app.module.logs.terraform_data.group: Plan to create","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412200Z","change":{"resource":{"addr":"module.app.module.logs.terraform_data.group","module":"module.app.module.logs","resource":"terraform_data.group","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"group","resource_key":null},"action":"create"},"type":"planned_change"}
+{"@level":"info","@message":"module.edge.terraform_data.dns: Plan to update","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412300Z","change":{"resource":{"addr":"module.edge.terraform_data.dns","module":"module.edge","resource":"terraform_data.dns","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"dns","resource_key":null},"action":"update"},"type":"planned_change"}
+{"@level":"info","@message":"Plan: 2 to add, 2 to change, 0 to destroy.","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412400Z","changes":{"add":2,"change":2,"import":0,"remove":0,"operation":"apply"},"type":"change_summary"}
+{"@level":"info","@message":"module.net.terraform_data.vpc: Modifying... [id=6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01]","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.520000Z","hook":{"resource":{"addr":"module.net.terraform_data.vpc","module":"module.net","resource":"terraform_data.vpc","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"vpc","resource_key":null},"action":"update","id_key":"id","id_value":"6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01"},"type":"apply_start"}
+{"@level":"info","@message":"module.net.terraform_data.vpc: Modifications complete after 0s [id=6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01]","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.530000Z","hook":{"resource":{"addr":"module.net.terraform_data.vpc","module":"module.net","resource":"terraform_data.vpc","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"vpc","resource_key":null},"action":"update","id_key":"id","id_value":"6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01","elapsed_seconds":0},"type":"apply_complete"}
+{"@level":"info","@message":"module.app.terraform_data.service: Creating...","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.540000Z","hook":{"resource":{"addr":"module.app.terraform_data.service","module":"module.app","resource":"terraform_data.service","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"service","resource_key":null},"action":"create"},"type":"apply_start"}
+{"@level":"error","@message":"module.app.terraform_data.service: Creation errored after 0s","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.550000Z","hook":{"resource":{"addr":"module.app.terraform_data.service","module":"module.app","resource":"terraform_data.service","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"service","resource_key":null},"action":"create","elapsed_seconds":0},"type":"apply_errored"}
+{"@level":"error","@message":"Error: Invalid input","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.551000Z","diagnostic":{"severity":"error","summary":"Invalid input","detail":"The service input is not a VPC id.\nCheck the vpc_id variable.","address":"module.app.terraform_data.service","range":{"filename":"../../roots/app/main.tf","start":{"line":1,"column":1,"byte":0},"end":{"line":1,"column":36,"byte":35}}},"type":"diagnostic"}
+{"@level":"error","@message":"Error: Provider produced inconsistent final plan","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.552000Z","diagnostic":{"severity":"error","summary":"Provider produced inconsistent final plan","detail":"This is a bug in the provider."},"type":"diagnostic"}

package/src/__fixtures__/compose/state-app.json

@@ -0,0 +1,66 @@
+{
+  "version": 4,
+  "terraform_version": "1.10.5",
+  "serial": 3,
+  "lineage": "8d4e2f1a-3b5c-4d6e-9f7a-1c2b3d4e5f60",
+  "outputs": {
+    "service_id": {
+      "value": "0b7e4a2c-93d1-4f6e-a5b8-2c1d9e3f4a77",
+      "type": "string"
+    }
+  },
+  "resources": [
+    {
+      "module": "module.logs",
+      "mode": "managed",
+      "type": "terraform_data",
+      "name": "group",
+      "provider": "provider[\"terraform.io/builtin/terraform\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "a3c5e7f9-1b2d-4c6e-8a0b-3d5f7a9c1e2f",
+            "input": {
+              "value": "app-logs",
+              "type": "string"
+            },
+            "output": {
+              "value": "app-logs",
+              "type": "string"
+            },
+            "triggers_replace": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "terraform_data",
+      "name": "service",
+      "provider": "provider[\"terraform.io/builtin/terraform\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "0b7e4a2c-93d1-4f6e-a5b8-2c1d9e3f4a77",
+            "input": {
+              "value": "6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01",
+              "type": "string"
+            },
+            "output": {
+              "value": "6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01",
+              "type": "string"
+            },
+            "triggers_replace": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}

package/src/__fixtures__/compose/state-edge.json

@@ -0,0 +1,40 @@
+{
+  "version": 4,
+  "terraform_version": "1.10.5",
+  "serial": 12,
+  "lineage": "c0ffee00-1234-4abc-8def-0123456789ab",
+  "outputs": {
+    "name": {
+      "value": "www",
+      "type": "string"
+    }
+  },
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "terraform_data",
+      "name": "dns",
+      "provider": "provider[\"terraform.io/builtin/terraform\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "1d9a0c55-77e2-4c1b-8f3a-5b6e2d4c7a10",
+            "input": {
+              "value": "www",
+              "type": "string"
+            },
+            "output": {
+              "value": "www",
+              "type": "string"
+            },
+            "triggers_replace": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}

package/src/__fixtures__/compose/state-net.json

@@ -0,0 +1,58 @@
+{
+  "version": 4,
+  "terraform_version": "1.10.5",
+  "serial": 7,
+  "lineage": "2b1f6c0a-6a1e-4c55-9f3d-7e0a1b2c3d4e",
+  "outputs": {
+    "vpc_id": {
+      "value": "6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01",
+      "type": "string"
+    }
+  },
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "terraform_data",
+      "name": "vpc",
+      "provider": "provider[\"terraform.io/builtin/terraform\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01",
+            "input": {
+              "value": {
+                "cidr": "10.0.0.0/16",
+                "name": "core"
+              },
+              "type": [
+                "object",
+                {
+                  "cidr": "string",
+                  "name": "string"
+                }
+              ]
+            },
+            "output": {
+              "value": {
+                "cidr": "10.0.0.0/16",
+                "name": "core"
+              },
+              "type": [
+                "object",
+                {
+                  "cidr": "string",
+                  "name": "string"
+                }
+              ]
+            },
+            "triggers_replace": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}