@intentius/chant-lexicon-terraform 0.124.52 → 0.124.54

package/src/__fixtures__/three-cloud-azure.graph.json

@@ -0,0 +1,290 @@
+{
+  "$comment": "The azure member (a choudoufu estate) of behold origin/integration/consolidation-graph example-three-cloud, read with chant on integration/consolidation-graph (#4535): chant workspace graph --member azure, the read behold composes. The source attribute (the file text) dropped.",
+  "nodes": [
+    {
+      "id": "azure/azure/azurerm_container_app_environment.site",
+      "kind": "Terraform::Resource",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "azurerm_container_app_environment.site",
+        "type": "azurerm_container_app_environment",
+        "name": "site",
+        "file": "site.tf",
+        "root": "azure",
+        "line": 51,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/azurerm_container_app.web",
+      "kind": "Terraform::Resource",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "azurerm_container_app.web",
+        "type": "azurerm_container_app",
+        "name": "web",
+        "file": "site.tf",
+        "root": "azure",
+        "line": 65,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/azurerm_log_analytics_workspace.logs",
+      "kind": "Terraform::Resource",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "azurerm_log_analytics_workspace.logs",
+        "type": "azurerm_log_analytics_workspace",
+        "name": "logs",
+        "file": "site.tf",
+        "root": "azure",
+        "line": 37,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/azurerm_resource_group.site",
+      "kind": "Terraform::Resource",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "azurerm_resource_group.site",
+        "type": "azurerm_resource_group",
+        "name": "site",
+        "file": "site.tf",
+        "root": "azure",
+        "line": 7,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/azurerm_subnet.apps",
+      "kind": "Terraform::Resource",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "azurerm_subnet.apps",
+        "type": "azurerm_subnet",
+        "name": "apps",
+        "file": "site.tf",
+        "root": "azure",
+        "line": 20,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/azurerm_user_assigned_identity.web",
+      "kind": "Terraform::Resource",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "azurerm_user_assigned_identity.web",
+        "type": "azurerm_user_assigned_identity",
+        "name": "web",
+        "file": "site.tf",
+        "root": "azure",
+        "line": 45,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/azurerm_virtual_network.network",
+      "kind": "Terraform::Resource",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "azurerm_virtual_network.network",
+        "type": "azurerm_virtual_network",
+        "name": "network",
+        "file": "site.tf",
+        "root": "azure",
+        "line": 13,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/live",
+      "kind": "Terraform::Live",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "live",
+        "file": "main.tf",
+        "root": "azure",
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/output.azureEndpoint",
+      "kind": "Terraform::Output",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "output.azureEndpoint",
+        "file": "site.tf",
+        "root": "azure",
+        "line": 102,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/provider.azurerm",
+      "kind": "Terraform::Provider",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "provider.azurerm",
+        "file": "main.tf",
+        "root": "azure",
+        "line": 35,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/terraform",
+      "kind": "Terraform::Terraform",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "terraform",
+        "file": "main.tf",
+        "root": "azure",
+        "line": 13,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    },
+    {
+      "id": "azure/azure/var.floci_az_host",
+      "kind": "Terraform::Variable",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "var.floci_az_host",
+        "file": "main.tf",
+        "root": "azure",
+        "line": 25,
+        "mode": "live",
+        "estate": "three-cloud-azure",
+        "lockFile": false
+      }
+    }
+  ],
+  "edges": [
+    {
+      "from": "azure/azure/azurerm_container_app_environment.site",
+      "to": "azure/azure/azurerm_log_analytics_workspace.logs",
+      "kind": "ref",
+      "viaAttr": "log_analytics_workspace_id"
+    },
+    {
+      "from": "azure/azure/azurerm_container_app_environment.site",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "location"
+    },
+    {
+      "from": "azure/azure/azurerm_container_app_environment.site",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "resource_group_name"
+    },
+    {
+      "from": "azure/azure/azurerm_container_app_environment.site",
+      "to": "azure/azure/azurerm_subnet.apps",
+      "kind": "ref",
+      "viaAttr": "infrastructure_subnet_id"
+    },
+    {
+      "from": "azure/azure/azurerm_container_app.web",
+      "to": "azure/azure/azurerm_container_app_environment.site",
+      "kind": "ref",
+      "viaAttr": "container_app_environment_id"
+    },
+    {
+      "from": "azure/azure/azurerm_container_app.web",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "resource_group_name"
+    },
+    {
+      "from": "azure/azure/azurerm_container_app.web",
+      "to": "azure/azure/azurerm_user_assigned_identity.web",
+      "kind": "ref",
+      "viaAttr": "identity"
+    },
+    {
+      "from": "azure/azure/azurerm_log_analytics_workspace.logs",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "location"
+    },
+    {
+      "from": "azure/azure/azurerm_log_analytics_workspace.logs",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "resource_group_name"
+    },
+    {
+      "from": "azure/azure/azurerm_subnet.apps",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "resource_group_name"
+    },
+    {
+      "from": "azure/azure/azurerm_subnet.apps",
+      "to": "azure/azure/azurerm_virtual_network.network",
+      "kind": "ref",
+      "viaAttr": "virtual_network_name"
+    },
+    {
+      "from": "azure/azure/azurerm_user_assigned_identity.web",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "location"
+    },
+    {
+      "from": "azure/azure/azurerm_user_assigned_identity.web",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "resource_group_name"
+    },
+    {
+      "from": "azure/azure/azurerm_virtual_network.network",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "location"
+    },
+    {
+      "from": "azure/azure/azurerm_virtual_network.network",
+      "to": "azure/azure/azurerm_resource_group.site",
+      "kind": "ref",
+      "viaAttr": "resource_group_name"
+    },
+    {
+      "from": "azure/azure/output.azureEndpoint",
+      "to": "azure/azure/azurerm_container_app.web",
+      "kind": "ref",
+      "viaAttr": "value"
+    },
+    {
+      "from": "azure/azure/provider.azurerm",
+      "to": "azure/azure/var.floci_az_host",
+      "kind": "ref",
+      "viaAttr": "metadata_host"
+    }
+  ]
+}

package/src/applied-state.ts

@@ -0,0 +1,52 @@
+/**
+ * What applied, read from `show -json` of a plan made after the apply: its
+ * `prior_state` is the state the apply left (chant#4445). choudoufu refuses a
+ * bare `show` under a `live` block, since there is no state file to show, so
+ * a post-apply plan is the one place its applied values can be read.
+ *
+ * `chant terraform report` (`./report.ts`) and the composed estate run
+ * (`./compose/estate.ts`) both read through {@link priorStateValues}.
+ */
+
+type Json = Record<string, unknown>;
+
+const isObject = (v: unknown): v is Json => v !== null && typeof v === "object" && !Array.isArray(v);
+
+/**
+ * The `values` of the state a `show -json` holds: a plan's `prior_state`, or
+ * a state's own `values` when it is a `show -json` of state. Undefined when
+ * it holds neither.
+ */
+export function priorStateValues(show: unknown): Json | undefined {
+  const root = isObject(show) ? show : {};
+  const state = isObject(root.prior_state) ? root.prior_state : root;
+  return isObject(state.values) ? state.values : undefined;
+}
+
+/** One resource of a state: its values and its sensitivity map. */
+export interface StateResourceValues {
+  values: Json;
+  sensitive: Json;
+}
+
+/** Every resource of the state a `show -json` holds, by address. A deposed object is left out. */
+export function stateResources(show: unknown): Map<string, StateResourceValues> {
+  const out = new Map<string, StateResourceValues>();
+  const walk = (mod: unknown): void => {
+    if (!isObject(mod)) return;
+    for (const r of Array.isArray(mod.resources) ? mod.resources : []) {
+      if (!isObject(r) || typeof r.address !== "string" || r.deposed_key !== undefined) continue;
+      out.set(r.address, { values: isObject(r.values) ? r.values : {}, sensitive: isObject(r.sensitive_values) ? r.sensitive_values : {} });
+    }
+    for (const c of Array.isArray(mod.child_modules) ? mod.child_modules : []) walk(c);
+  };
+  walk(priorStateValues(show)?.root_module);
+  return out;
+}
+
+/** The outputs of the state a `show -json` holds, by name, each its value. */
+export function stateOutputs(show: unknown): Record<string, unknown> {
+  const outputs = priorStateValues(show)?.outputs;
+  if (!isObject(outputs)) return {};
+  return Object.fromEntries(Object.entries(outputs).map(([k, v]) => [k, isObject(v) && "value" in v ? v.value : v]));
+}

package/src/backend-config.test.ts

@@ -0,0 +1,105 @@
+/**
+ * A root can name backend-config files (chant#4459): the config key, the
+ * flags init gets, where a relative path resolves, and the keys the
+ * composition reads from a file before init.
+ */
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterAll, describe, expect, test } from "vitest";
+import { terraformRootSchema } from "./config";
+import { ROOT_ENTRY_KEYS } from "./lsp/option-keys";
+import { backendConfigArgs, backendConfigFileKeys, backendConfigFilePath, readBackendConfigFile } from "./backend-config";
+import type { DriverComponent } from "@intentius/chant/components/driver";
+import { compositionFor } from "./compose";
+import { rootState } from "./compose/hcl";
+import { declaredBackend, lockRefusal, readBackend } from "./state/backend";
+
+const made: string[] = [];
+afterAll(() => {
+  for (const d of made) rmSync(d, { recursive: true, force: true });
+});
+
+function tree(files: Record<string, string>): string {
+  const dir = mkdtempSync(join(tmpdir(), "chant-4459-"));
+  made.push(dir);
+  for (const [path, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(dir, path)), { recursive: true });
+    writeFileSync(join(dir, path), text);
+  }
+  return dir;
+}
+
+const S3_NO_LOCK = 'terraform {\n  backend "s3" {\n    bucket = "b"\n  }\n}\n';
+
+describe("terraform.roots.<name>.backendConfigFiles", () => {
+  test("the config schema takes a list of paths beside backendConfig, and refuses anything else", () => {
+    expect(terraformRootSchema.safeParse({ dir: ".", backendConfigFiles: ["backend.hcl"], backendConfig: { key: "k" } }).success).toBe(true);
+    expect(terraformRootSchema.safeParse({ dir: ".", backendConfigFiles: "backend.hcl" }).success).toBe(false);
+    expect(terraformRootSchema.safeParse({ dir: ".", backendConfigFiles: [1] }).success).toBe(false);
+  });
+
+  test("the LSP offers the key on a root entry", () => {
+    expect(ROOT_ENTRY_KEYS.map((k) => k.key)).toContain("backendConfigFiles");
+  });
+
+  test("init's flags: files in order, then the pairs", () => {
+    expect(backendConfigArgs({ backendConfigFiles: ["a.hcl", "b.hcl"], backendConfig: { key: "k" } })).toEqual(["-backend-config=a.hcl", "-backend-config=b.hcl", "-backend-config=key=k"]);
+    expect(backendConfigArgs({})).toEqual([]);
+  });
+});
+
+describe("a backend-config file's keys", () => {
+  test("a relative path resolves against the root's directory, as varFiles does; an absolute one stays", () => {
+    expect(backendConfigFilePath("/repo/roots/app", "backend.hcl")).toBe("/repo/roots/app/backend.hcl");
+    expect(backendConfigFilePath("/repo/roots/app", "../shared/backend.hcl")).toBe("/repo/roots/shared/backend.hcl");
+    expect(backendConfigFilePath("/repo/roots/app", "/etc/backend.hcl")).toBe("/etc/backend.hcl");
+  });
+
+  test("a file's key = value lines, typed, comments and interpolations left out", () => {
+    const dir = tree({ "backend.hcl": '# shared\nbucket = "acme-state" // the bucket\nuse_lockfile = true\nmax_retries = 5\nkey = "${var.no}"\n' });
+    expect(readBackendConfigFile(join(dir, "backend.hcl"))).toEqual({ bucket: "acme-state", use_lockfile: true, max_retries: 5 });
+  });
+
+  test("later files over earlier ones, read from the root's directory, and a missing file named", () => {
+    const dir = tree({ "roots/app/one.hcl": 'bucket = "one"\nkey = "k"\n', "roots/shared/two.hcl": 'bucket = "two"\n' });
+    expect(backendConfigFileKeys(join(dir, "roots/app"), ["one.hcl", "../shared/two.hcl", "gone.hcl"])).toEqual({ config: { bucket: "two", key: "k" }, unread: ["gone.hcl"] });
+  });
+});
+
+describe("the composition reads the file's keys before init (ruled: yes)", () => {
+  test("an s3 root whose use_lockfile = true is only in the file is lockable", () => {
+    const dir = tree({ "main.tf": S3_NO_LOCK, "backend.hcl": 'key = "app.tfstate"\nuse_lockfile = true\n' });
+    expect(lockRefusal(readBackend(dir, { recorded: null }))).toMatchObject({ refused: "no-lockfile" });
+    expect(lockRefusal(readBackend(dir, { recorded: null, backendConfigFiles: ["backend.hcl"] }))).toBeUndefined();
+  });
+
+  test("a pair overrides the file, and the file overrides the code", () => {
+    const dir = tree({ "main.tf": 'terraform {\n  backend "s3" {\n    bucket = "code"\n    key = "code"\n  }\n}\n', "backend.hcl": 'bucket = "file"\nkey = "file"\n' });
+    expect(declaredBackend(dir, { backendConfigFiles: ["backend.hcl"], backendConfig: { key: "pair" } })).toEqual({ type: "s3", config: { bucket: "file", key: "pair" } });
+  });
+
+  test("a -backend-config file in TF_CLI_ARGS_init is read too", () => {
+    const dir = tree({ "main.tf": S3_NO_LOCK, "ci.hcl": "use_lockfile = true\n" });
+    expect(lockRefusal(readBackend(dir, { recorded: null, env: { TF_CLI_ARGS_init: "-backend-config=ci.hcl" } }))).toBeUndefined();
+  });
+
+  test("rootState finds the state's address from a key only the file gives", () => {
+    const dir = tree({ "main.tf": S3_NO_LOCK });
+    expect(rootState(dir, "app", { env: {}, recorded: null, backendConfig: { key: "from-file.tfstate" } }).own).toMatchObject({ key: "from-file.tfstate" });
+  });
+
+  test("a composition lines a read up with a member whose state key is only in its file", () => {
+    const tf = (name: string): DriverComponent => ({ name, dependsOn: [], deploy: [{ phase: "Apply", steps: [{ kind: "terraform-apply", root: name }] }] });
+    const reader = 'data "terraform_remote_state" "a" {\n  backend = "s3"\n  config = {\n    bucket = "b"\n    key    = "a.tfstate"\n  }\n}\n\nresource "terraform_data" "x" {\n  input = data.terraform_remote_state.a.outputs.id\n}\n';
+    const lockedS3 = (key?: string): string => `terraform {\n  backend "s3" {\n    bucket = "b"\n${key ? `    key = "${key}"\n` : ""}    use_lockfile = true\n  }\n}\n`;
+    const dir = tree({ "roots/a/main.tf": lockedS3(), "roots/a/backend.hcl": 'key = "a.tfstate"\n', "roots/b/main.tf": lockedS3("b.tfstate") + reader });
+    const c = compositionFor({
+      projectRoot: dir,
+      env: {},
+      components: [tf("a"), tf("b")],
+      terraform: { roots: { a: { dir: "roots/a", backendConfigFiles: ["backend.hcl"] }, b: { dir: "roots/b" } }, compose: { enabled: true } },
+    });
+    expect(c.reads.get("b")).toEqual([{ via: "remote-state", upstream: "a", name: "a" }]);
+  });
+});

package/src/backend-config.ts

@@ -0,0 +1,133 @@
+/**
+ * A root's `-backend-config` (chant#4459): the files it names in
+ * `terraform.roots.<name>.backendConfigFiles` and the pairs in
+ * `backendConfig`, as the flags every init the lexicon runs passes, and the
+ * keys a file holds, as the readers that find a root's state before init see
+ * them.
+ *
+ * Files go first and pairs after, because init applies later flags over
+ * earlier ones and a pair is the more specific of the two. A file's path is
+ * passed as written: init runs in the root's directory, so a relative path
+ * resolves against it, as `varFiles` does. A reader of the file resolves it
+ * the same way.
+ *
+ * Plain node: `op/activities/terraform.ts` imports this, and it stays out of
+ * the HCL parser's dependency graph.
+ */
+
+import { readFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+
+/** The two keys of a root that say what init's `-backend-config` flags are. */
+export interface BackendConfigFlags {
+  backendConfigFiles?: readonly string[];
+  backendConfig?: Readonly<Record<string, string>>;
+}
+
+/** The `-backend-config` values in the order init takes them: each file's path, then each `key=value` pair. Unquoted, one per flag. */
+export function backendConfigValues(root: BackendConfigFlags): string[] {
+  return [...(root.backendConfigFiles ?? []), ...Object.entries(root.backendConfig ?? {}).map(([k, v]) => `${k}=${v}`)];
+}
+
+/** {@link backendConfigValues} as argv: `-backend-config=<value>` each. */
+export function backendConfigArgs(root: BackendConfigFlags): string[] {
+  return backendConfigValues(root).map((v) => `-backend-config=${v}`);
+}
+
+/** A backend-config file's path as init in `dir` reads it: an absolute path as it is, a relative one against `dir`. */
+export function backendConfigFilePath(dir: string, file: string): string {
+  return isAbsolute(file) ? file : resolve(dir, file);
+}
+
+/**
+ * The text of `body` with everything nested deeper than `level` braces
+ * blanked, newlines kept, so only the attributes at that level are left to
+ * read. Strings are read through, so a brace in one does not count.
+ */
+export function blankBelow(body: string, level: number): string {
+  const out = body.split("");
+  let depth = 0;
+  let inString = false;
+  for (let i = 0; i < body.length; i++) {
+    const c = body[i]!;
+    if (depth > level && c !== "\n") out[i] = " ";
+    if (inString) {
+      if (c === "\\") {
+        if (depth > level && body[i + 1] !== undefined && body[i + 1] !== "\n") out[i + 1] = " ";
+        i++;
+      } else if (c === '"') inString = false;
+      continue;
+    }
+    if (c === '"') inString = true;
+    else if (c === "{") depth++;
+    else if (c === "}") depth--;
+  }
+  return out.join("");
+}
+
+/**
+ * The literal attributes of HCL text at brace depth `level` (0 for a file of
+ * bare attributes, 1 for the body of a block given with its header): plain
+ * strings, booleans and numbers, typed as init records them. A string with an
+ * interpolation, and anything that is not one line of `name = literal`, is
+ * left out. Comments are left to the caller to blank.
+ */
+export function literalAttributes(text: string, level: number): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const m of blankBelow(text, level).matchAll(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*("(?:[^"\\]|\\.)*"|true|false|-?\d+(?:\.\d+)?)\s*$/gm)) {
+    const raw = m[2]!;
+    if (raw.startsWith('"')) {
+      const s = raw.slice(1, -1);
+      if (/\$\{|%\{/.test(s)) continue;
+      out[m[1]!] = s.replace(/\\(.)/g, "$1");
+    } else out[m[1]!] = raw === "true" ? true : raw === "false" ? false : Number(raw);
+  }
+  return out;
+}
+
+/** HCL text with its `#`, `//` and `/* *\/` comments blanked, strings read through. */
+function withoutComments(text: string): string {
+  const out = text.split("");
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i]!;
+    if (inString) {
+      if (c === "\\") i++;
+      else if (c === '"') inString = false;
+      continue;
+    }
+    if (c === '"') inString = true;
+    else if (c === "#" || (c === "/" && text[i + 1] === "/")) {
+      for (; i < text.length && text[i] !== "\n"; i++) out[i] = " ";
+    } else if (c === "/" && text[i + 1] === "*") {
+      const end = text.indexOf("*/", i + 2);
+      const stop = end < 0 ? text.length : end + 2;
+      for (; i < stop; i++) if (text[i] !== "\n") out[i] = " ";
+      i--;
+    }
+  }
+  return out.join("");
+}
+
+/** The keys one backend-config file sets: its top-level `key = "value"` lines. Throws when the file cannot be read. */
+export function readBackendConfigFile(path: string): Record<string, unknown> {
+  return literalAttributes(withoutComments(readFileSync(path, "utf-8")), 0);
+}
+
+/**
+ * The keys a root's backend-config files set, later files over earlier ones,
+ * each path resolved against `dir`; and the files that could not be read,
+ * which init itself will refuse.
+ */
+export function backendConfigFileKeys(dir: string, files: readonly string[] = []): { config: Record<string, unknown>; unread: string[] } {
+  const config: Record<string, unknown> = {};
+  const unread: string[] = [];
+  for (const f of files) {
+    try {
+      Object.assign(config, readBackendConfigFile(backendConfigFilePath(dir, f)));
+    } catch {
+      unread.push(f);
+    }
+  }
+  return { config, unread };
+}

package/src/behaviour/kinds.ts

@@ -138,6 +138,10 @@ const BLOCKS: Readonly<Record<string, string>> = {
   "Terraform::Module": "a call to a child module; the blocks the call expands to are entities of their own and carry the figures",
   "Terraform::Data": "a read of something that exists outside this root; whatever it reads is priced where it is declared",
   "Terraform::Live": "choudoufu's estate declaration, which names the ownership marker every resource of the root carries and holds nothing itself",
+  "Terraform::Moved": "an instruction to rename an address in state; the resource it names carries the figures",
+  "Terraform::Import": "an instruction to adopt an existing object into state; the resource it names carries the figures",
+  "Terraform::Removed": "an instruction to drop an address from state; nothing is created by it",
+  "Terraform::Check": "an assertion terraform evaluates after a plan or apply, which holds nothing in any account",
 };
 
 /**

package/src/behaviour/predict.ts

@@ -163,10 +163,13 @@ export const readTerraformDeclaration: TerraformDeclarationReader = async (cwd)
   const { config, configPath } = await loadChantConfigUpward(start);
   const namespace = (config as { terraform?: TerraformConfig }).terraform;
   const entities = new Map<string, TerraformBehaviourEntity>();
-  if (!namespace?.roots || Object.keys(namespace.roots).length === 0) return entities;
+  // A `signalOnly` root (#4484) builds nothing, as in `buildRoots`.
+  if (!namespace) return entities;
+  const roots = Object.fromEntries(Object.entries(namespace.roots ?? {}).filter(([, r]) => r.signalOnly !== true));
+  if (Object.keys(roots).length === 0) return entities;
   const rendered = await renderTerraformRoots({
     projectRoot: configPath ? dirname(configPath) : start,
-    roots: namespace.roots,
+    roots,
     binary: namespace.binary,
     callModuleType: namespace.callModuleType,
     moduleRoot: namespace.moduleRoot,

package/src/behaviour/reference-catalog.plugin.test.ts

@@ -0,0 +1,65 @@
+/**
+ * #4535: terraform's catalog is on the plugin, and what it reads there.
+ *
+ * A reader that asks each lexicon of a graph for its catalog (behold#1030)
+ * now finds terraform's. On a `chant graph` node (`Terraform::Resource`, no
+ * arguments in its attrs) no rule applies, so a declared terraform graph
+ * keeps exactly the edges its HCL references give it: on example-three-cloud's
+ * azure member that is also what behold's matcher added (nothing). On a node
+ * whose kind is the provider type and whose attrs are the block's arguments,
+ * each rule draws its edge.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import type { IRNode } from "@intentius/chant/graph-ir";
+import { reconstructIndexedEdges, refRuleId } from "@intentius/chant/graph-refs";
+import { TERRAFORM_REFERENCE_CATALOG } from "./reference-catalog";
+import { terraformPlugin } from "../plugin";
+
+const LEXICON = "terraform";
+
+function atPath(path: string, value: string): Record<string, unknown> {
+  const parts = path.split(".");
+  const build = (i: number): unknown => {
+    if (i === parts.length) return value;
+    const part = parts[i];
+    const isArr = part.endsWith("[]");
+    const inner = build(i + 1);
+    return { [isArr ? part.slice(0, -2) : part]: isArr ? [inner] : inner };
+  };
+  return build(0) as Record<string, unknown>;
+}
+
+describe("terraform reference catalog on the plugin", () => {
+  it("is the plugin's referenceCatalog", () => {
+    expect(terraformPlugin.referenceCatalog).toBe(TERRAFORM_REFERENCE_CATALOG);
+  });
+
+  describe("each targeted rule draws its edge on provider-typed nodes", () => {
+    for (const [i, rule] of TERRAFORM_REFERENCE_CATALOG.refs.entries()) {
+      if (!rule.targetKind) continue;
+      it(`${rule.from} ${rule.path} -> ${rule.targetKind}`, () => {
+        const value = `id-${i}`;
+        const nodes: IRNode[] = [
+          { id: `holder-${i}`, kind: rule.from, lexicon: LEXICON, attrs: atPath(rule.path, value) },
+          { id: `target-${i}`, kind: rule.targetKind!, lexicon: LEXICON, attrs: {}, physicalId: value },
+        ];
+        const out = reconstructIndexedEdges(nodes, [{ lexicon: LEXICON, catalog: TERRAFORM_REFERENCE_CATALOG }], () => ({ account: "declared" }));
+        expect(out.edges.find((e) => e.from === `holder-${i}` && e.to === `target-${i}`)?.rule).toBe(refRuleId(LEXICON, rule.from, rule.path));
+      });
+    }
+  });
+
+  describe("example-three-cloud's azure member (parity with behold's matcher)", () => {
+    const graph = JSON.parse(readFileSync(join(import.meta.dirname, "..", "__fixtures__", "three-cloud-azure.graph.json"), "utf-8")) as { nodes: IRNode[] };
+    const out = reconstructIndexedEdges(graph.nodes, [{ lexicon: LEXICON, catalog: TERRAFORM_REFERENCE_CATALOG }], () => ({ account: "declared" }));
+
+    it("adds no edge to a declared block graph, as the matcher added none", () => {
+      expect(graph.nodes.some((n) => n.kind === "Terraform::Resource")).toBe(true);
+      expect(out.edges).toEqual([]);
+      expect(out.ambiguous).toEqual([]);
+      expect(out.dangling).toEqual([]);
+    });
+  });
+});