@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/dist/hcl/parse.js

@@ -1,11 +1,13 @@
 /**
  * The one shared HCL parse for the terraform lexicon.
  *
- * Two entry points, one entity shape. `parseTerraformRootDir` reads the `.tf`
- * files of a directory (non-recursive, matching Terraform's own module
- * scoping) and is what `buildRoots()` calls. `parseTerraformRootContent` takes
- * the joined-file string `chant audit` hands a lexicon for a discovered root
- * module: every `.tf` in filename order behind a `# file: <name>` line comment.
+ * Two entry points, one entity shape. `parseTerraformRootDir` reads the
+ * configuration files of a directory (non-recursive, matching Terraform's own
+ * module scoping; `.tf` and `.tf.json`, plus `.tofu` and `.tofu.json` for a
+ * tofu or choudoufu root, see `./files.ts`) and is what `buildRoots()` calls.
+ * `parseTerraformRootContent` takes the joined-file string `chant audit` hands
+ * a lexicon for a discovered root module: every configuration file in filename
+ * order behind a `# file: <name>` line comment, narrowed to the same set.
  * Both funnel through `blocksToEntities`, so an entity the audit path sees is
  * the entity the build path sees.
  *
@@ -17,12 +19,14 @@
  * core's exports map already carries (`"./*"` to `./src/*.ts`), so nothing
  * changed in `packages/core/package.json` for this.
  */
-import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { loadHcl2json } from "@intentius/chant/terraform/hcl2json";
 import { DECLARABLE_MARKER } from "@intentius/chant/declarable";
 import { redactSensitiveBody, redactSensitiveSource } from "./redact.js";
 import { scanSuppressions, directivesFor } from "./suppressions.js";
+import { isJsonConfigFile, jsonConfigTree, listConfigFiles, selectConfigFiles } from "./files.js";
+export { TERRAFORM_SUFFIXES, TOFU_SUFFIXES, isConfigFileFor, isJsonConfigFile, isTofuConfigFile, jsonConfigTree, listConfigFiles, listConfigFilesSafe, readsTofuFiles, selectConfigFiles, } from "./files.js";
 /** `entityType` per block kind. */
 export const TERRAFORM_TYPE = "Terraform::Terraform";
 export const PROVIDER_TYPE = "Terraform::Provider";
@@ -34,6 +38,23 @@ export const OUTPUT_TYPE = "Terraform::Output";
 export const LOCALS_TYPE = "Terraform::Locals";
 /** A `live { estate = "..." }` block, or an `estate.chdf.hcl` sidecar's content (#2103). */
 export const LIVE_TYPE = "Terraform::Live";
+/**
+ * The four configuration blocks that change how a plan treats addresses
+ * rather than declaring anything (#4458): `moved`, `import`, `removed` and
+ * `check`. The first three carry no label and key as `moved`, `import`,
+ * `removed` (numbered `~2`, `~3` when a root holds several, as `locals` is);
+ * a `check` keys as `check.<name>`. Their references are edges like any other
+ * block's: a `moved` block's `from` and `to`, an `import` block's `to`, a
+ * `removed` block's `from`, and everything a `check` block's assertions and
+ * scoped `data` blocks read. A `from` usually names an address that is no
+ * longer declared, which resolves to no entity and so draws no edge, and
+ * that is all that happens: an unresolved reference is dropped, never
+ * reported (`./edges.ts`).
+ */
+export const MOVED_TYPE = "Terraform::Moved";
+export const IMPORT_TYPE = "Terraform::Import";
+export const REMOVED_TYPE = "Terraform::Removed";
+export const CHECK_TYPE = "Terraform::Check";
 /**
  * Terragrunt config entities (#3417). A `terragrunt.hcl` or `root.hcl` is not
  * a Terraform module, so its blocks are read into these types and never into
@@ -61,6 +82,58 @@ function expansionOf(body) {
         return "for_each";
     return undefined;
 }
+/** The most instance keys read off one literal; past it the block draws as the block alone. */
+const MAX_LITERAL_INSTANCES = 256;
+/**
+ * The instance keys a literal expansion gives (#4454), as Terraform prints
+ * them, or undefined when the expansion is not a literal a read of the
+ * source can count. `count` as a number (`count = 3`), `for_each` as a
+ * literal map (`{ a = 1 }`, keys in Terraform's lexical order) or
+ * `toset([...])` over string literals. Anything holding a reference is a
+ * plan-time answer.
+ */
+export function literalInstanceKeys(body) {
+    const keys = literalKeys(body);
+    if (keys === undefined || keys.length > MAX_LITERAL_INSTANCES)
+        return undefined;
+    return keys;
+}
+function literalKeys(body) {
+    if ("count" in body) {
+        const count = body.count;
+        const n = typeof count === "number" ? count
+            : typeof count === "string" && /^\$\{\s*\d+\s*\}$/.test(count.trim()) ? Number(count.trim().slice(2, -1))
+                : undefined;
+        if (n === undefined || !Number.isInteger(n) || n < 0)
+            return undefined;
+        return Array.from({ length: n }, (_, i) => `[${i}]`);
+    }
+    if ("for_each" in body) {
+        const each = body.for_each;
+        if (typeof each === "object" && each !== null && !Array.isArray(each)) {
+            const names = Object.keys(each);
+            if (names.some((k) => k.includes("${")))
+                return undefined;
+            return names.sort().map((k) => `[${JSON.stringify(k)}]`);
+        }
+        if (typeof each === "string") {
+            const m = /^\$\{\s*toset\(\s*(\[[\s\S]*\])\s*\)\s*\}$/.exec(each.trim());
+            if (!m)
+                return undefined;
+            let list;
+            try {
+                list = JSON.parse(m[1].replace(/,\s*\]$/, "]"));
+            }
+            catch {
+                return undefined;
+            }
+            if (!Array.isArray(list) || !list.every((v) => typeof v === "string"))
+                return undefined;
+            return [...new Set(list)].sort().map((k) => `[${JSON.stringify(k)}]`);
+        }
+    }
+    return undefined;
+}
 /**
  * Build one entity. Written out rather than run through `createResource`
  * from `@intentius/chant/runtime`: that factory is for generated resource
@@ -71,6 +144,7 @@ function expansionOf(body) {
  */
 export function terraformEntity(entityType, address, body, file, root, extra, source = "", line, suppressions) {
     const expansion = expansionOf(body);
+    const instanceKeys = expansion && (entityType === RESOURCE_TYPE || entityType === DATA_TYPE) ? literalInstanceKeys(body) : undefined;
     const labels = entityType === RESOURCE_TYPE ? blockLabels(address)
         : entityType === DATA_TYPE && address.startsWith("data.") ? blockLabels(address.slice("data.".length))
             : undefined;
@@ -80,6 +154,7 @@ export function terraformEntity(entityType, address, body, file, root, extra, so
         entityType,
         kind: "resource",
         stack: root,
+        ...(instanceKeys ? { instanceKeys } : {}),
         props: {
             address,
             ...(labels ?? {}),
@@ -130,11 +205,20 @@ export function splitBundleContent(content, fallbackName = "main.tf") {
     }
     return files.filter((f) => f.source.trim() !== "");
 }
-/** Every `.tf` directly under `dir`, in filename order. Non-recursive. */
-export function listTerraformFiles(dir) {
-    return readdirSync(dir)
-        .filter((f) => f.endsWith(".tf"))
-        .sort();
+/**
+ * Every configuration file directly under `dir` that a root run by `binary`
+ * reads, in filename order, non-recursive: `.tf` and `.tf.json`, plus `.tofu`
+ * and `.tofu.json` for a tofu or choudoufu root, with `x.tofu` shadowing
+ * `x.tf` (chant#4457). The shared lister is `./files.ts`'s `listConfigFiles`.
+ */
+export function listTerraformFiles(dir, binary) {
+    return listConfigFiles(dir, binary);
+}
+/** One file's tree in hcl2json's shape: hcl2json for HCL, {@link jsonConfigTree} for Terraform's JSON syntax. */
+export async function parseFileTree(parser, file) {
+    if (isJsonConfigFile(file.name))
+        return jsonConfigTree(file.source);
+    return (await parser.parse(file.name, file.source));
 }
 /** The Terragrunt config files directly under `dir` (`root.hcl`, `terragrunt.hcl`), in filename order like the audit's bundle. */
 export function listTerragruntFiles(dir) {
@@ -241,7 +325,7 @@ export async function blocksToEntities(files, root, hcl2json, modeOptions, sidec
         }
     };
     for (const file of files) {
-        const tree = (await parser.parse(file.name, file.source));
+        const tree = await parseFileTree(parser, file);
         const scan = scanSuppressions(file.name, file.source);
         if (isTerragruntFileName(file.name)) {
             terragruntBlocks(tree, file, scan, add);
@@ -257,6 +341,10 @@ export async function blocksToEntities(files, root, hcl2json, modeOptions, sidec
         oneLabel(tree, "output", OUTPUT_TYPE, (n) => `output.${n}`, file, scan);
         twoLabels(tree, "resource", RESOURCE_TYPE, (t, n) => `${t}.${n}`, file, scan);
         twoLabels(tree, "data", DATA_TYPE, (t, n) => `data.${t}.${n}`, file, scan);
+        unlabelled(tree, "moved", MOVED_TYPE, file, scan);
+        unlabelled(tree, "import", IMPORT_TYPE, file, scan);
+        unlabelled(tree, "removed", REMOVED_TYPE, file, scan);
+        oneLabel(tree, "check", CHECK_TYPE, (n) => `check.${n}`, file, scan);
     }
     if (sidecar) {
         const tree = (await parser.parse(sidecar.name, sidecar.source));
@@ -319,14 +407,15 @@ function terragruntBlocks(tree, file, scan, add) {
     }
 }
 /**
- * Parse a root module directory. Reads every `.tf` directly under `dir`, plus
- * the `estate.chdf.hcl` sidecar beside them when present. Throws whatever the
+ * Parse a root module directory. Reads the configuration files directly under
+ * `dir` that `modeOptions.binary` reads ({@link listTerraformFiles}), plus the
+ * `estate.chdf.hcl` sidecar beside them when present. Throws whatever the
  * parser throws for malformed HCL; `buildRoots()` is where that becomes a
  * warning.
  */
 export async function parseTerraformRootDir(dir, root, hcl2json, modeOptions, callers = []) {
     // A child module is a Terraform module, never a Terragrunt unit (#3417).
-    const names = [...listTerraformFiles(dir), ...(callers.length === 0 ? listTerragruntFiles(dir) : [])];
+    const names = [...listTerraformFiles(dir, modeOptions?.binary), ...(callers.length === 0 ? listTerragruntFiles(dir) : [])];
     const files = names.map((name) => ({
         name,
         source: readFileSync(join(dir, name), "utf-8"),
@@ -349,7 +438,16 @@ export async function parseTerraformRootDir(dir, root, hcl2json, modeOptions, ca
  * the same way `parseTerraformRootDir`'s callers exercise it against files.
  */
 export async function parseTerraformRootContent(content, root, hcl2json, modeOptions) {
-    return blocksToEntities(splitBundleContent(content), root, hcl2json, modeOptions);
+    return blocksToEntities(bundleFilesFor(splitBundleContent(content), modeOptions?.binary), root, hcl2json, modeOptions);
+}
+/**
+ * The files of a joined bundle a root run by `binary` reads: the same set
+ * {@link listTerraformFiles} gives for a directory holding them, plus the
+ * Terragrunt files, in bundle order (chant#4457).
+ */
+export function bundleFilesFor(files, binary) {
+    const keep = new Set(selectConfigFiles(files.map((f) => f.name), binary));
+    return files.filter((f) => keep.has(f.name) || isTerragruntFileName(f.name));
 }
 /** The root name an audit of the audited directory itself parses under. */
 export const AUDIT_ROOT_NAME = "audit-root";

package/dist/hcl/roots.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roots.d.ts","sourceRoot":"","sources":["../../src/hcl/roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAyC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAGvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAiE/B"}
+{"version":3,"file":"roots.d.ts","sourceRoot":"","sources":["../../src/hcl/roots.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAwB,KAAK,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EAAyC,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAIvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACrD;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mFAAmF;IACnF,QAAQ,CAAC,EAAE,QAAQ,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAsE/B"}

package/dist/hcl/roots.js

@@ -31,6 +31,7 @@ import { isResourceDeclarable } from "@intentius/chant/declarable";
 import { LIVE_TYPE, parseTerraformRootDir } from "./parse.js";
 import { descendModules, resolveCallModuleType } from "./descend.js";
 import { resolveEntityReferences } from "./edges.js";
+import { resolveInstanceNodes } from "./instances.js";
 /**
  * Parse each configured root into entities keyed `<root>/<address>`, plus its
  * local child modules, keyed `<root>/module.<name>/<address>` (#2112). Roots
@@ -71,6 +72,10 @@ export async function renderTerraformRoots(opts) {
             for (const [key, entity] of descended.entities)
                 entities.set(key, entity);
             warnings.push(...descended.warnings);
+            // Instance nodes the root's variables let the declared graph count,
+            // and those under expanded module calls (#4486). Needs the root and
+            // every child scope parsed, so it runs once the descent has.
+            await resolveInstanceNodes(entities, name, { dir, ...(root.varFiles ? { varFiles: root.varFiles } : {}), hcl2json: opts.hcl2json });
             // A `live` block or `estate.chdf.hcl` sidecar only takes effect under
             // choudoufu; under any other binary it parses fine but is inert, which
             // is worth a warning rather than silence (#2103).

package/dist/hcl/suppressions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/hcl/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAkB,MAAM,oCAAoC,CAAC;AAgF/F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAClD,kHAAkH;IAClH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CA8D3E;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,oBAAoB,EAAE,CAAA;CAAE,CAKvH"}
+{"version":3,"file":"suppressions.d.ts","sourceRoot":"","sources":["../../src/hcl/suppressions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAkB,MAAM,oCAAoC,CAAC;AAsF/F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,mFAAmF;IACnF,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACvC,+GAA+G;IAC/G,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAClD,kHAAkH;IAClH,aAAa,CAAC,EAAE,oBAAoB,CAAC;CACtC;AAQD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CA8D3E;AAED,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhF;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,oBAAoB,EAAE,CAAA;CAAE,CAKvH"}

package/dist/hcl/suppressions.js

@@ -24,9 +24,9 @@
  * queue slot in file order, same as they're numbered `~2`/`~3` in file order.
  */
 /** A block header keyword with zero labels (`terraform {`, `locals {`). */
-const BARE_RE = /^\s*(terraform|locals|remote_state)\s*\{/;
+const BARE_RE = /^\s*(terraform|locals|remote_state|moved|import|removed)\s*\{/;
 /** One label (`provider "aws" {`, `module "vpc" {`, `variable "x" {`, `output "x" {`). */
-const ONE_LABEL_RE = /^\s*(provider|module|variable|output|dependency|generate)\s+"([^"]*)"\s*\{/;
+const ONE_LABEL_RE = /^\s*(provider|module|variable|output|check|dependency|generate)\s+"([^"]*)"\s*\{/;
 /** Two labels (`resource "aws_s3_bucket" "assets" {`, `data "aws_ami" "x" {`). */
 const TWO_LABEL_RE = /^\s*(resource|data)\s+"([^"]*)"\s+"([^"]*)"\s*\{/;
 /** A `#`/`//` comment naming one of the three suppression forms. */
@@ -40,6 +40,12 @@ function addressFor(keyword, labels) {
             return "locals";
         case "remote_state":
             return "remote_state";
+        case "moved":
+        case "import":
+        case "removed":
+            return keyword;
+        case "check":
+            return `check.${labels[0]}`;
         case "dependency":
             return `dependency.${labels[0]}`;
         case "generate":

package/dist/index.d.ts

@@ -1,10 +1,20 @@
 export { terraformPlugin } from "./plugin.js";
-export { terraformCapabilityPlugin, terraformApplyCapability, TerraformPlanMovedError, TERRAFORM_VERB_FAMILIES, type TerraformApplyStepInput, type TerraformApplyStepOutput, } from "./components/capability-plugin.js";
+export { terraformCapabilityPlugin, terraformApplyCapability, TerraformPlanMovedError, TERRAFORM_VERB_FAMILIES, choudoufuOutputSource, choudoufuMemberPlannedOutputs, type TerraformApplyStepInput, type TerraformApplyStepOutput, } from "./components/capability-plugin.js";
+export { mergeStates, splitState, splitStates, derivedLineage, COMPOSE_LINEAGE, type SplitState } from "./compose/state-merge.js";
+export { slicePlan as sliceComposedPlan, sliceText, planCounts, composedReads, composedMemberPlans, type PlanCounts, type ComposedMemberRead, type ComposedMemberPlan, type ComposedMemberPlansOptions, } from "./compose/slice.js";
+export { readApplyEvents, memberApply, composedApplyOutcomes, type ApplyEvents, type MemberApply, type MemberApplyOutcome } from "./compose/apply-events.js";
+export { topModule, stripModule, stripChange, moduleChanges } from "./compose/module-address.js";
+export { EstateRun, estateVersionFallback, estateOutcomes, readEstateApplyText, type ComposedRunner, type ComposedRunPlan, type ComposedRunApply, type ComposedMemberOutcome, type EstateRunOptions, } from "./compose/estate.js";
+export { priorStateValues, stateResources, stateOutputs, type StateResourceValues } from "./applied-state.js";
+export { ComposedRun, composedPlanDigest, changesSomething, type ComposedRunOptions, type ComposedRunStage, type StateRunPlan, type StateRunApply, type StateMemberOutcome, type ComposedStateWrite, type ComposeHook, type ComposeHookMoment, } from "./compose/run.js";
+export { terraformPlanShape, type TerraformPlanShapeOptions } from "./plan-shape.js";
+export { terraformLockRows, terraformLockRowsFromPart, terraformDefaultLockGrain, terraformLockGrainRefusal } from "./lock-rows.js";
+export { compositionFor, compositionIfEnabled, composeOff, composeSet, readOrder, moduleNames, fallbackLine, withPlanFailed, identityKey, DEFAULT_COMPOSE_MAX, COMPOSE_STEP_KIND, type Composition, type CompositionInput, type ComposedRead, type ComposeFallback, type ComposeFallbackKind, type ExpectedBinary, } from "./compose.js";
 export { terraformSerializer } from "./serializer.js";
 export { terraformConfigSchema, terraformRootSchema, type TerraformConfig, type TerraformRootConfig, type TerraformConfigNamespace, } from "./config.js";
 export { blocksToEntities, parseTerraformRootContent, parseTerraformRootDir, readLiveSidecarFile, splitBundleContent, terraformEntity, DATA_TYPE, LIVE_SIDECAR_FILENAME, LIVE_TYPE, LOCALS_TYPE, MODULE_TYPE, OUTPUT_TYPE, PROVIDER_TYPE, RESOURCE_TYPE, TERRAFORM_TYPE, VARIABLE_TYPE, type BlockBody, type TerraformEntity, type TerraformFile, type TerraformRootMode, type TerraformRootModeOptions, } from "./hcl/parse.js";
 export { renderTerraformRoots, type TerraformRootsResult } from "./hcl/roots.js";
-export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformPinRollout, } from "./op/builders.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, choudoufuPlanSet, terraformPinRollout, } from "./op/builders.js";
 export { parseAdoptionCommands, readAdoptionLedger, renderAdoptionLedger, type AdoptionCandidate, type AdoptionLedger, type AdoptionMatch, } from "./op/adoption.js";
 export { TerraformApplyOp } from "./composites/terraform-apply-op.js";
 export type { TerraformApplyOpConfig, TerraformApplyOpResources, TerraformGateMode, } from "./composites/terraform-apply-op.js";
@@ -16,4 +26,5 @@ export { TerraformPinRolloutOp } from "./composites/terraform-pin-rollout-op.js"
 export type { TerraformPinRolloutOpConfig, TerraformPinRolloutOpResources } from "./composites/terraform-pin-rollout-op.js";
 export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
 export { predictTerraformBehaviour, terraformBehaviourRequest, terraformPredictOptionsFrom, TERRAFORM_REFERENCE_CATALOG, type TerraformBehaviourDeps, type TerraformBehaviourEntity, type TerraformBehaviourRequest, type TerraformBehaviourRequestOptions, type TerraformLiveRead, type TerraformPredictOptions, } from "./behaviour/index.js";
+export { terraformExitOf, terraformPlanMoved, type TerraformExitSource } from "./exit-codes.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAM3C,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,gCAAgC,CAAC;AAGxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAIzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,YAAY,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAKzH,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAQnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAM3C,OAAO,EACL,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACvB,uBAAuB,EAEvB,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,GAC9B,MAAM,gCAAgC,CAAC;AAIxC,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC/H,OAAO,EACL,SAAS,IAAI,iBAAiB,EAC9B,SAAS,EACT,UAAU,EACV,aAAa,EACb,mBAAmB,EACnB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,WAAW,EAAE,KAAK,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC1J,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAG9F,OAAO,EACL,SAAS,EACT,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAI3G,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,kBAAkB,EAAE,KAAK,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAIjI,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,cAAc,EACd,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAIzG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,YAAY,EAAE,2BAA2B,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AAKzH,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAQnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,KAAK,mBAAmB,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -4,7 +4,27 @@ export { terraformPlugin } from "./plugin.js";
 // capability-plugin seam. Core loads `terraformCapabilityPlugin` when a
 // project's chant.config lists this lexicon, so a component can deploy a root
 // and a fan-out can run many of them in gated waves.
-export { terraformCapabilityPlugin, terraformApplyCapability, TerraformPlanMovedError, TERRAFORM_VERB_FAMILIES, } from "./components/capability-plugin.js";
+export { terraformCapabilityPlugin, terraformApplyCapability, TerraformPlanMovedError, TERRAFORM_VERB_FAMILIES, 
+// #4455: a choudoufu member's outputs, read for core's `member-outputs`.
+choudoufuOutputSource, choudoufuMemberPlannedOutputs, } from "./components/capability-plugin.js";
+// Composed runs (#4442): the working state merged and split, the composed
+// plan cut into one plan per member, and each member's apply outcome.
+export { mergeStates, splitState, splitStates, derivedLineage, COMPOSE_LINEAGE } from "./compose/state-merge.js";
+export { slicePlan as sliceComposedPlan, sliceText, planCounts, composedReads, composedMemberPlans, } from "./compose/slice.js";
+export { readApplyEvents, memberApply, composedApplyOutcomes } from "./compose/apply-events.js";
+export { topModule, stripModule, stripChange, moduleChanges } from "./compose/module-address.js";
+// Composed runs of choudoufu estates (#4445): one plan and one apply, values read from a post-apply plan.
+export { EstateRun, estateVersionFallback, estateOutcomes, readEstateApplyText, } from "./compose/estate.js";
+export { priorStateValues, stateResources, stateOutputs } from "./applied-state.js";
+// Composed runs over roots with state (#4444): one plan and one apply, each
+// state written back whatever happened. Implements `ComposedRunner` (#4445).
+export { ComposedRun, composedPlanDigest, changesSomething, } from "./compose/run.js";
+// The plan shape of a `show -json` plan (#4436), for core's `coveredRound`.
+export { terraformPlanShape } from "./plan-shape.js";
+export { terraformLockRows, terraformLockRowsFromPart, terraformDefaultLockGrain, terraformLockGrainRefusal } from "./lock-rows.js";
+// Composed runs (#4419, #4438): which roots compose, in what order, and why
+// the others fall back. Off unless `terraform.compose.enabled` is set.
+export { compositionFor, compositionIfEnabled, composeOff, composeSet, readOrder, moduleNames, fallbackLine, withPlanFailed, identityKey, DEFAULT_COMPOSE_MAX, COMPOSE_STEP_KIND, } from "./compose.js";
 // Serializer
 export { terraformSerializer } from "./serializer.js";
 // The `terraform` config namespace. Importing this package is what brings the
@@ -18,7 +38,7 @@ export { renderTerraformRoots } from "./hcl/roots.js";
 // Typed Op step builders (#2086). Same names as the activities they wrap, and
 // like k3s's they are opt-in from the lexicon root — the activities themselves
 // are reached by the registry through `./op/activities`, never from here.
-export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformPinRollout, } from "./op/builders.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, choudoufuPlanSet, terraformPinRollout, } from "./op/builders.js";
 // The adoption ledger over `live-plan -json`'s document (#2105). Pure, and
 // exported because the ledger's shape is what a project reading an Op's own
 // result is reading.
@@ -44,3 +64,5 @@ export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
 // engine is injected, and defaults to core's front (#2495): this lexicon
 // dials none.
 export { predictTerraformBehaviour, terraformBehaviourRequest, terraformPredictOptionsFrom, TERRAFORM_REFERENCE_CATALOG, } from "./behaviour/index.js";
+// terraform, tofu and choudoufu exit statuses on chant's exit-code table (#4553).
+export { terraformExitOf, terraformPlanMoved } from "./exit-codes.js";

package/dist/integrity.json

@@ -1,16 +1,17 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "2b3f8b18903d43627d811f5ccfb418ddbcf2ce8aecde7fe38eafd28a6a593559",
+    "manifest.json": "af9cf95e7eeffef70272429ce0affe71750ff95b7413c9cedb6f6e7fffb8a7d3",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "7c10245b2c3335253b48ee7d8b075d89f43116bde20313a5d1031b343fef1282",
     "rules/blocks.ts": "d69f65c13b44ff425ccd465644f41c160e07b4c221bd60698d3ec84bf5d9cef8",
     "rules/flat-attributes.ts": "135b4b118cb76ea7ef7a6f2851bb5c80d0907485b86a364c017f66388d0d4cb2",
     "rules/module-source.ts": "9e6e8f47725c3a01ee8b65b7acff6fe902bf5fc638820efdb5721f4c6ea9d95c",
+    "rules/record-store.ts": "644ef9785ea9500e8945a181160aff1c4133ad895451413b40d293abc9620066",
     "rules/scope.ts": "a6d327d821f219c98a9d4ae6e6eed6325f3d3edf6286f3622b41be591d190dc8",
     "rules/terragrunt.ts": "1973dbee0933db9593347aa662c71b86f02302c19a28f5ecba23a694ca96641b",
-    "rules/tf001.ts": "1f07f0f9172a7ddb9c726ba4be1bea08e54e25701fbe59cc54c3cf4401aca999",
+    "rules/tf001.ts": "d0c20e9e70403ec79515114cc00dff8c599c372b343ff96beb951bb7b0dbf9ba",
     "rules/tf002.ts": "6759fe5135c85ed9016adbddd90e77743cdf243b261a98deb38e907da83c6d25",
     "rules/tf003.ts": "7b705a08f03769f353910e524bb3f1b4cc844bcb620e240a9063288d0fd60802",
     "rules/tf004.ts": "59ef2108aa561cc6a40cd970fc54604be60872b51a035ed3bc3c53346a31d358",
@@ -32,7 +33,7 @@
     "rules/tf020.ts": "2210815c355e37459c34de0fe622f0b87b78010ee7c444135cf5abf7e048adf7",
     "rules/tf021.ts": "ad3cd813a289437d33da866927697077e7a5b20f3c05341325193d286b57bbd5",
     "rules/tf022.ts": "5466797cd88fd5489f6c5abd1e796d7c5d3d0e977d0e9e043d253f6ecf369cdc",
-    "rules/tf024.ts": "c0c101f913bd3d0fdb5403ee57888e80d8fc612e363f0eb43d7ae759ac1d5651",
+    "rules/tf024.ts": "e82bb9d29fb1645823899fb03fcb0381ca2df11039f02609acee861013278724",
     "rules/tf025.ts": "0c31be3885e940e2b3e9ac8e023067d8d6e2b42c04f628890405c9fc6db7d1ce",
     "rules/tf026.ts": "8cf1e61bc9563aa2d3c149f243ffa02ad4f183eebb672f861cd6c4e6fba1d310",
     "rules/tf027.ts": "0a6062a230cdaa707f82b2353be4b34dff81322d24075d46f732a47bcef15893",
@@ -54,7 +55,9 @@
     "rules/tf043.ts": "c8724a7c0734870101d73e411ed97240c03a01a1133adbf0b445a5083f40faee",
     "rules/tf044.ts": "4e9b17a6080074d2b2e02862a9f1c9c2baf0ef32d4f3b48df1e62d9d8c362008",
     "rules/tf045.ts": "760b1f4f385fbe7a86897efe3078fdeac11bcc9bfb806285d63db50488174b7b",
-    "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
+    "rules/tf046.ts": "d3de9a40366847a832a5ad739aa8c4411249aab36815f7eeb245f9b2fdb91e42",
+    "rules/tf047.ts": "bfa86f85c4c5efff297280fc2f15104d6319fa96dfc444a31829fb7353224092",
+    "skills/chant-terraform.md": "53dd11c7b289652f92fdaf2c03766abda46d8964e31fe709e8b142ced4f19c50"
   },
-  "composite": "acd11f24f4546441f7084748e2617792a690dedbd9677aa19333461e23c47a0d"
+  "composite": "2eb9399e124a118b190f5c350cf23b746058b7b97ed3ef4a3e63e9ac59c9be8b"
 }

package/dist/lint/audit-catalog.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AA+D1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAge1D,CAAC"}
+{"version":3,"file":"audit-catalog.d.ts","sourceRoot":"","sources":["../../src/lint/audit-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AA+D1E,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CA0f1D,CAAC"}

package/dist/lint/audit-catalog.js

@@ -65,9 +65,10 @@ export const terraformAuditCatalog = {
         tier: "merge-worthy",
         fixKind: "guidance",
         category: "correctness",
-        title: "Live root declares a backend or cloud block, which choudoufu refuses",
-        remediation: "Remove the `backend`/`cloud` block from the live root's terraform block; a live root's prior " +
-            "state is a projection rebuilt from the live system every run, so there is no state to store.",
+        title: "Live root declares a backend or cloud block, which choudoufu ignores",
+        remediation: "Keep a `backend` block if other roots read this estate's outputs or the record store should be " +
+            "derived from its bucket; declare `record_store` to put records elsewhere. Remove a `cloud` block, " +
+            "which choudoufu drops entirely, or swap it for a `backend` block.",
         yamlBased: false,
     },
     TF025: {
@@ -495,6 +496,29 @@ export const terraformAuditCatalog = {
         remediation: 'Set `terragrunt_version_constraint = ">= 1.1.0"` in the root config. Off by default; judged only across the configs scanned.',
         yamlBased: false,
     },
+    TF046: {
+        id: "TF046",
+        tier: "report-only",
+        fixKind: "guidance",
+        category: "correctness",
+        title: "Live root resolves to the local record store in a CI run",
+        remediation: "Keep or add a `backend` block of type s3, gcs or azurerm with a literal bucket, so choudoufu " +
+            "derives the record store from it, or declare `record_store` in the live block or `estate.chdf.hcl`. " +
+            "The rule is off by default and terragucci turns it on for its users; an emulator or test lane " +
+            "that keeps the local store on purpose sets `CHANT_ALLOW_LOCAL_RECORD_STORE=1`.",
+        yamlBased: false,
+    },
+    TF047: {
+        id: "TF047",
+        tier: "report-only",
+        fixKind: "guidance",
+        category: "correctness",
+        title: "Live root pins a module version the known-module catalog has no row for, or one with refusals",
+        remediation: "Run `choudoufu live-check` on the root to see each refused site, or pin a version whose examples are clear in " +
+            "the static tier of choudoufu's module table (https://intentius.io/choudoufu/aws/compatibility/#modules). " +
+            "Off by default; terragucci turns it on for its users.",
+        yamlBased: false,
+    },
 };
 // Prior art credits, if any, live beside the rules in ./audit-lineage.ts (see
 // core audit/prior-art.ts).

package/dist/lint/audit-lineage.d.ts

@@ -76,8 +76,8 @@
  *
  * TF024 (#2103, live root declares a backend/cloud block) credits choudoufu's
  * own `RuleStateBackend`, `internal/live/lint/issue.go` of
- * github.com/INTENTIUS/choudoufu: the identical condition, checked the same
- * way this fork checks it at `init` before any command runs. TF025 (a live
+ * github.com/INTENTIUS/choudoufu: the same condition, which choudoufu has
+ * reported as a warning since its #2213 (the block is ignored, not refused). TF025 (a live
  * root's non-default `terraform.workspace`) has no entry: its workspace half
  * is refused at the CLI argument-parsing layer there
  * (`internal/command/live_mode.go`), not by a dedicated lint rule under
@@ -110,6 +110,18 @@
  * a root's mode, and no surveyed tool has an Op model to read: choudoufu lints
  * HCL, and every tflint ruleset, tfsec/trivy-checks and the Sentinel policies
  * do the same. There is nothing upstream to credit.
+ *
+ * TF046 (chant#4561, a live root on the local record store in a CI run) has
+ * no entry. choudoufu prints where records go on every run and reports a
+ * `record_store.note` in `live-check -json` (INTENTIUS/choudoufu#2293), but
+ * it has no `internal/live/lint` rule for the local store, and no surveyed
+ * tool knows about record stores. TF044 is the nearest neighbour, for a
+ * Terragrunt state backend.
+ *
+ * TF047 (chant#4560, a live root pins a module version the known-module
+ * catalog has no row for, or one with refusals) has no entry. Its data is
+ * choudoufu's own module table (choudoufu#2292), vendored; no surveyed tool
+ * checks a module pin against a measured compatibility table.
  */
 import type { Lineage } from "@intentius/chant/audit/catalog";
 export declare const terraformAuditLineage: Record<string, Lineage[]>;

package/dist/lint/audit-lineage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAob3D,CAAC"}
+{"version":3,"file":"audit-lineage.d.ts","sourceRoot":"","sources":["../../src/lint/audit-lineage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4HG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAob3D,CAAC"}

package/dist/lint/post-synth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AA8CvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA6C3C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAgDvE,eAAO,MAAM,eAAe,EAAE,cAAc,EA+C3C,CAAC"}

package/dist/lint/post-synth/index.js

@@ -42,6 +42,8 @@ import { tf042 } from "./tf042.js";
 import { tf043 } from "./tf043.js";
 import { tf044 } from "./tf044.js";
 import { tf045 } from "./tf045.js";
+import { tf046 } from "./tf046.js";
+import { tf047 } from "./tf047.js";
 export const postSynthChecks = [
     tf001,
     tf002,
@@ -87,4 +89,6 @@ export const postSynthChecks = [
     tf043,
     tf044,
     tf045,
+    tf046,
+    tf047,
 ];

package/dist/lint/post-synth/record-store.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The record store a live root resolves to, read from its HCL the way
+ * choudoufu resolves it (INTENTIUS/choudoufu#2293, `internal/configs/live_derive.go`
+ * at choudoufu 74ffde956bfd97f44b8ad444424584e23321adc2). Shared by TF024,
+ * which names where records go, and TF046, which guards a CI root that ends
+ * up on the local store, so the two never disagree.
+ *
+ * The order is choudoufu's:
+ *
+ * 1. A `record_store "<kind>"` block in the `live` block or the
+ *    `estate.chdf.hcl` sidecar always wins (`source: "record_store"`).
+ * 2. Otherwise the backend block choudoufu ignores under live gives the store,
+ *    s3 to s3, gcs to gcs, azurerm to azurerm (`source: "backend"`). s3 and gcs
+ *    need a literal `bucket`; azurerm needs literal `storage_account_name`,
+ *    `container_name` and `resource_group_name`. A value passed only with
+ *    `-backend-config` is not in the configuration, so choudoufu does not see
+ *    it either.
+ * 3. Otherwise the store is local (`source: "implied"`), with `note` saying
+ *    why a backend that was there was not used.
+ *
+ * This mirrors `record_store.source` and `record_store.note` in
+ * `choudoufu live-check -json`. A literal here is a string hcl2json hands back
+ * with no `${...}` in it, the same "not determined" reading the Terragrunt
+ * rules use (`./terragrunt.ts`).
+ */
+import type { BlockBody } from "../../hcl/parse.js";
+export type RecordStoreSource = "record_store" | "backend" | "implied";
+export interface ResolvedRecordStore {
+    /** `local`, `s3`, `gcs`, `azurerm` or `kubernetes`, or whatever label a `record_store` block carries. */
+    kind: string;
+    source: RecordStoreSource;
+    /** The backend type the store came from, or was not derived from, when there is a backend block. */
+    backend?: string;
+    /** Why a backend block that was present did not give a store. Set only with `source: "implied"`. */
+    note?: string;
+}
+/** Backend types choudoufu derives a record store from (INTENTIUS/choudoufu#2293). */
+export declare const DERIVABLE_BACKENDS: ReadonlySet<string>;
+/**
+ * The label of a `record_store "<kind>"` block in a live declaration body, or
+ * undefined when it declares none. hcl2json nests the label one level down,
+ * as it does for `backend` (see `backendTypes` in `./tf001.ts`).
+ */
+export declare function recordStoreKind(liveBody: BlockBody): string | undefined;
+/**
+ * Resolve one live root's record store.
+ *
+ * `terraformBodies` are the bodies of every `terraform` block in the root (a
+ * backend can sit in a separate `backend.tf`). `liveBodies` are the root's
+ * live declarations: its `live` block and its sidecar, if any. choudoufu
+ * refuses a root that has both, so the first `record_store` found is the one.
+ */
+export declare function resolveRecordStore(terraformBodies: readonly BlockBody[], liveBodies: readonly BlockBody[]): ResolvedRecordStore;
+//# sourceMappingURL=record-store.d.ts.map

package/dist/lint/post-synth/record-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-store.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/record-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAIjD,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,SAAS,GAAG,SAAS,CAAC;AAEvE,MAAM,WAAW,mBAAmB;IAClC,yGAAyG;IACzG,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,iBAAiB,CAAC;IAC1B,oGAAoG;IACpG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAqC,CAAC;AAOzF;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAMvE;AAmCD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAAE,SAAS,SAAS,EAAE,EACrC,UAAU,EAAE,SAAS,SAAS,EAAE,GAC/B,mBAAmB,CAcrB"}