@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/dist/lint/post-synth/tf047.js

@@ -0,0 +1,94 @@
+/**
+ * TF047: a live root pins a registry module version the known-module catalog
+ * has no row for, or one whose row carries refusals.
+ *
+ * The catalog is choudoufu's module compatibility table, vendored in
+ * `../../module-catalog/` (chant#4560, choudoufu#2292). It has one static
+ * row per terraform-aws-modules example at one tag, measured offline in the
+ * onboarded form. A module call on a root whose binary is choudoufu (the
+ * root's `mode` is `live`) with an exact `version` is looked up there:
+ *
+ * - no row for the module, or none at the pinned version: `info`, naming the
+ *   versions the static tier did measure;
+ * - at least one example at that version refused: `warning`, with each
+ *   refusal ID, its site count, the examples that carry it and its
+ *   `live/LIMITATIONS.md` link;
+ * - every example clear: quiet.
+ *
+ * Every message names the tier. The catalog holds the static tier only, and
+ * no figure here counts a gauntlet run (choudoufu#2292 ruling: two tiers,
+ * never mixed).
+ *
+ * A stock root (`mode: "state"`) is skipped: the table measures choudoufu.
+ * A range is TF039's finding and a missing `version` TF004's, so both are
+ * skipped here. A `//subdir` source is looked up by its module repository.
+ *
+ * Off by default: `report-only` in the audit catalog, as TF039 is.
+ * terragucci turns it on and holds the product wording (terragucci#1286).
+ *
+ * Scope: root and child modules of a live root alike.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE } from "../../hcl/parse.js";
+import { classifyModuleSource, isExactVersionConstraint } from "./module-source.js";
+import { MODULE_CATALOG_SOURCE, MODULE_COMPATIBILITY_PAGE, moduleCompatibility, } from "../../module-catalog/index.js";
+const tierNote = () => `static tier of choudoufu's module table, measured ${MODULE_CATALOG_SOURCE.date} with hashicorp/aws ${MODULE_CATALOG_SOURCE.awsProvider}`;
+/** The TF047 message for one module call, or undefined when the call is clear. */
+export function catalogMessage(address, c) {
+    const pin = `${c.module} ${c.version}`;
+    switch (c.status) {
+        case "clear":
+            return undefined;
+        case "unknown-module":
+            return (`Module "${address}" pins ${pin}, and the ${tierNote()} has no row for this module. ` +
+                `Run \`choudoufu live-check\` on the root to see whether it plans. The table: ${MODULE_COMPATIBILITY_PAGE}`);
+        case "unknown-version":
+            return (`Module "${address}" pins ${pin}, and the ${tierNote()} has no row at this version. ` +
+                `It measured ${c.measuredVersions.join(", ")}. ` +
+                `Run \`choudoufu live-check\` on the root, or pin a measured version. The table: ${MODULE_COMPATIBILITY_PAGE}`);
+        case "refused": {
+            const ids = c.refusals
+                .map((r) => `${r.id} (${r.sites} site${r.sites === 1 ? "" : "s"} in ${r.examples.join(", ")}; ${r.docsUrl})`)
+                .join("; ");
+            return (`Module "${address}" pins ${pin}. In the ${tierNote()}, ${c.refusedExamples} of ${c.examples} ` +
+                `examples at this version are refused: ${ids}. ` +
+                "A call that uses the same features is refused the same way; `choudoufu live-check` names each site in this root.");
+        }
+    }
+}
+export const tf047 = {
+    id: "TF047",
+    description: "Live root pins a module version the known-module catalog has no row for, or one with refusals",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [key, entity] of ctx.entities) {
+            if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            if (props.mode !== "live")
+                continue;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const source = typeof body.source === "string" ? body.source : undefined;
+            if (source === undefined || classifyModuleSource(source).kind !== "registry")
+                continue;
+            const version = body.version;
+            if (typeof version !== "string" || !isExactVersionConstraint(version))
+                continue;
+            const compat = moduleCompatibility(source, version);
+            if (compat === undefined)
+                continue;
+            const address = typeof props.address === "string" ? props.address : key;
+            const message = catalogMessage(address, compat);
+            if (message === undefined)
+                continue;
+            diagnostics.push({
+                checkId: "TF047",
+                severity: compat.status === "refused" ? "warning" : "info",
+                message,
+                entity: key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/live-plan-reasons.d.ts

@@ -0,0 +1,21 @@
+/**
+ * choudoufu's live-plan omission codes, in chant's vocabulary.
+ *
+ * Its own module so the observation reader (`./describe-resources.ts`) and
+ * the drift adapters (`./drift-record.ts`) read one table, and the drift
+ * adapters bundle without the reader's process and file-system imports.
+ */
+import type { UnobservedReason } from "@intentius/chant/observation";
+/**
+ * choudoufu's omission reason codes, mapped onto chant's total vocabulary
+ * (`internal/live/projection/result.go`). `"absent"` is not an
+ * {@link UnobservedReason}: it is the tri-state's OBSERVED-ABSENT, the one
+ * omission that is a claim of knowledge rather than of ignorance.
+ *
+ * A code this table does not know maps to `read-failed`, which is the safe
+ * direction: no NOT-OBSERVED verdict ever becomes a create or a delete.
+ */
+export declare const LIVE_PLAN_OMISSION_REASONS: Readonly<Record<string, UnobservedReason | "absent">>;
+/** Does this text name a credentials or authorization failure rather than any other error? */
+export declare function readsAsCredentials(text: string): boolean;
+//# sourceMappingURL=live-plan-reasons.d.ts.map

package/dist/live-plan-reasons.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-plan-reasons.d.ts","sourceRoot":"","sources":["../src/live-plan-reasons.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAErE;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,QAAQ,CAAC,CA0B5F,CAAC;AAEF,8FAA8F;AAC9F,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIxD"}

package/dist/live-plan-reasons.js

@@ -0,0 +1,47 @@
+/**
+ * choudoufu's live-plan omission codes, in chant's vocabulary.
+ *
+ * Its own module so the observation reader (`./describe-resources.ts`) and
+ * the drift adapters (`./drift-record.ts`) read one table, and the drift
+ * adapters bundle without the reader's process and file-system imports.
+ */
+/**
+ * choudoufu's omission reason codes, mapped onto chant's total vocabulary
+ * (`internal/live/projection/result.go`). `"absent"` is not an
+ * {@link UnobservedReason}: it is the tri-state's OBSERVED-ABSENT, the one
+ * omission that is a claim of knowledge rather than of ignorance.
+ *
+ * A code this table does not know maps to `read-failed`, which is the safe
+ * direction: no NOT-OBSERVED verdict ever becomes a create or a delete.
+ */
+export const LIVE_PLAN_OMISSION_REASONS = {
+    // The provider was asked and reported, normally, that nothing is there.
+    ABSENT: "absent",
+    // The provider errored, or could not be reached in a usable order.
+    FAILED: "read-failed",
+    PARENT_UNAVAILABLE: "read-failed",
+    CYCLE: "read-failed",
+    INCOMPLETE_BLOCK: "read-failed",
+    LISTED_NOT_IMPORTABLE: "read-failed",
+    // Something exists at the identity and does not carry this estate's marker.
+    // Normally answered by the `unowned[]` section before this table is read;
+    // this entry is what happens if a document ever carries the omission alone.
+    UNOWNED: "read-failed",
+    // The mode cannot name, list or tag this instance at all: a server-assigned
+    // identity with no marker to find it by, a resource with no cloud object to
+    // read, or an address another declared instance has taken over.
+    NEEDS_DISCOVERY: "unsupported-kind",
+    UNREADABLE: "unsupported-kind",
+    SUPERSEDED: "unsupported-kind",
+    // The run's own tag index saw an object at the identity and the import
+    // read could not confirm it (choudoufu #1043). The read failed; the
+    // object is not proposed for creation.
+    VERIFIED_NOT_IMPORTABLE: "read-failed",
+    // -target or -exclude left the block out of the plan graph (choudoufu
+    // #1176): nothing was read because the caller asked for it not to be.
+    OUT_OF_SCOPE: "filtered",
+};
+/** Does this text name a credentials or authorization failure rather than any other error? */
+export function readsAsCredentials(text) {
+    return /\b(no valid credential|credentials?|not authorized|unauthorized|accessdenied|access denied|expiredtoken|invalidclienttokenid|signature)\b/i.test(text);
+}

package/dist/lock-rows.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The terraform lexicon's lock grain (#4552) and the rows a choudoufu apply
+ * holds on the resource grain, in terragucci's format (`planRows` in
+ * terragucci's `apply-rows.ts` at 18f6431), unchanged:
+ *
+ * - `estate <estate> <address>` for every resource instance the apply acts
+ *   on (a create, update, delete, replace or forget), or `root <root>
+ *   <address>` when the root has no estate;
+ * - the same for `previous_address` on a moved instance;
+ * - `object <id>` for anything but a create, from the object's id before,
+ *   so two estates that meet on one object meet on its row.
+ *
+ * Data reads and no-ops hold nothing.
+ *
+ * The grain: `resource` for choudoufu, which keeps one record per resource,
+ * writes each conditionally and refuses a plan one of whose changes moved;
+ * `target` (the root, or the Terragrunt unit) for Terraform, tofu and
+ * Terragrunt, whose state is one file the backend's lock keeps whole. Those
+ * three refuse `resource` by name, since nothing in their state is per
+ * resource.
+ */
+import type { ChangeSetPart, ChangeSetPlanner } from "@intentius/chant/change-set";
+import { type LockGrain, type LockRow } from "@intentius/chant/lifecycle/lock-rows";
+/** The rows a plan's changes key, from `show -json`'s `resource_changes` (terragucci's `planRows`). */
+export declare function terraformLockRows(root: string, estate: string | undefined, plan: unknown): LockRow[];
+/**
+ * The rows from a member's change-set part, when the plan document is not
+ * at hand: the same keys, less the previous address of a moved instance,
+ * which the part does not carry. The part's `scope` is the estate.
+ */
+export declare function terraformLockRowsFromPart(root: string, part: ChangeSetPart): LockRow[];
+/** The grain a root takes by default: `resource` under choudoufu, `target` under every other binary. */
+export declare function terraformDefaultLockGrain(planner: ChangeSetPlanner | undefined): LockGrain;
+/** Why a root cannot take `grain`, by engine name, or undefined when it can. */
+export declare function terraformLockGrainRefusal(grain: LockGrain, planner: ChangeSetPlanner | undefined, binary?: string): string | undefined;
+//# sourceMappingURL=lock-rows.d.ts.map

package/dist/lock-rows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-rows.d.ts","sourceRoot":"","sources":["../src/lock-rows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAgC,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,sCAAsC,CAAC;AASlH,uGAAuG;AACvG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,CAgBpG;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,EAAE,CAStF;AAOD,wGAAwG;AACxG,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,CAE1F;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItI"}

package/dist/lock-rows.js

@@ -0,0 +1,60 @@
+import { objectRowKey, sortedLockRows } from "@intentius/chant/lifecycle/lock-rows";
+const CHANGING = new Set(["create", "update", "delete", "forget"]);
+/** The scope a root's rows are keyed in: its estate, else its path. */
+function rowScope(root, estate) {
+    return estate ? `estate ${estate}` : `root ${root}`;
+}
+/** The rows a plan's changes key, from `show -json`'s `resource_changes` (terragucci's `planRows`). */
+export function terraformLockRows(root, estate, plan) {
+    const scope = rowScope(root, estate);
+    const rows = [];
+    const changes = plan?.resource_changes ?? [];
+    for (const c of changes) {
+        if (c?.mode === "data" || typeof c?.address !== "string")
+            continue;
+        const actions = Array.isArray(c.change?.actions) ? c.change.actions : [];
+        if (!actions.some((a) => CHANGING.has(a)))
+            continue;
+        const address = c.address;
+        rows.push({ key: `${scope} ${address}`, target: root, address });
+        if (typeof c.previous_address === "string" && c.previous_address !== address)
+            rows.push({ key: `${scope} ${c.previous_address}`, target: root, address });
+        // The live object an update or a delete acts on: two estates that meet on one object meet here.
+        const id = c.change?.before?.id;
+        if (actions.some((a) => a !== "create") && (typeof id === "string" || typeof id === "number") && String(id) !== "")
+            rows.push({ key: objectRowKey(String(id)), target: root, address });
+    }
+    return sortedLockRows(rows);
+}
+/**
+ * The rows from a member's change-set part, when the plan document is not
+ * at hand: the same keys, less the previous address of a moved instance,
+ * which the part does not carry. The part's `scope` is the estate.
+ */
+export function terraformLockRowsFromPart(root, part) {
+    const scope = rowScope(root, part.member.planner === "choudoufu" ? part.member.scope : undefined);
+    const rows = [];
+    for (const e of part.entries) {
+        if (e.action === "no-op" || e.action === "read")
+            continue;
+        rows.push({ key: `${scope} ${e.address}`, target: root, address: e.address });
+        if (e.action !== "create" && e.id)
+            rows.push({ key: objectRowKey(e.id), target: root, address: e.address });
+    }
+    return sortedLockRows(rows);
+}
+/** Whether a binary's name is Terragrunt's. */
+function isTerragrunt(binary) {
+    return /^terragrunt(\.exe)?$/.test((binary ?? "").split(/[\\/]/).pop() ?? "");
+}
+/** The grain a root takes by default: `resource` under choudoufu, `target` under every other binary. */
+export function terraformDefaultLockGrain(planner) {
+    return planner === "choudoufu" ? "resource" : "target";
+}
+/** Why a root cannot take `grain`, by engine name, or undefined when it can. */
+export function terraformLockGrainRefusal(grain, planner, binary) {
+    if (grain !== "resource" || planner === "choudoufu")
+        return undefined;
+    const engine = isTerragrunt(binary) ? "Terragrunt" : planner === "tofu" ? "tofu" : "Terraform";
+    return `${engine} keeps a root's state in one file that its backend's lock keeps whole, so nothing in it is per resource; the resource grain needs choudoufu (ci.lockGrain: target)`;
+}

package/dist/lock-timeout.d.ts

@@ -0,0 +1,22 @@
+/**
+ * State-lock waits for a plan or an apply (#4545): how long `plan` and
+ * `apply` wait for another run's state lock before failing. Taken from
+ * terragucci's waves, where two jobs of one pipeline can reach the same
+ * backend a moment apart and a failed lock fails the wave for nothing.
+ *
+ * A job that already sets `-lock-timeout` through `TF_CLI_ARGS` or
+ * `TF_CLI_ARGS_<command>` keeps its own: the flag is added only when neither
+ * names one. Terragrunt waves pass the same flag after `--`
+ * (`./terragrunt/wave.ts`, `extra`).
+ */
+/** How long a plan or an apply waits for a state lock unless the job set a `-lock-timeout` of its own. */
+export declare const DEFAULT_LOCK_TIMEOUT = "5m";
+/** Whether `value` is a `-lock-timeout` duration. */
+export declare function isLockTimeout(value: unknown): value is string;
+/**
+ * The `-lock-timeout` flag a `command` takes: `-lock-timeout=<timeout>`, or
+ * nothing when `TF_CLI_ARGS` or `TF_CLI_ARGS_<command>` in `env` already
+ * names one, or `timeout` is `false`. Throws on a duration terraform refuses.
+ */
+export declare function lockTimeoutArgs(command: "plan" | "apply", timeout?: string | false, env?: Record<string, string | undefined>): string[];
+//# sourceMappingURL=lock-timeout.d.ts.map

package/dist/lock-timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-timeout.d.ts","sourceRoot":"","sources":["../src/lock-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,0GAA0G;AAC1G,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAKzC,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,OAAO,GAAE,MAAM,GAAG,KAA4B,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,EAAE,CAK1K"}

package/dist/lock-timeout.js

@@ -0,0 +1,32 @@
+/**
+ * State-lock waits for a plan or an apply (#4545): how long `plan` and
+ * `apply` wait for another run's state lock before failing. Taken from
+ * terragucci's waves, where two jobs of one pipeline can reach the same
+ * backend a moment apart and a failed lock fails the wave for nothing.
+ *
+ * A job that already sets `-lock-timeout` through `TF_CLI_ARGS` or
+ * `TF_CLI_ARGS_<command>` keeps its own: the flag is added only when neither
+ * names one. Terragrunt waves pass the same flag after `--`
+ * (`./terragrunt/wave.ts`, `extra`).
+ */
+/** How long a plan or an apply waits for a state lock unless the job set a `-lock-timeout` of its own. */
+export const DEFAULT_LOCK_TIMEOUT = "5m";
+/** A duration terraform's `-lock-timeout` takes: `0s`, `30s`, `5m`, `1h30m`. */
+const DURATION = /^(\d+(ms|s|m|h))+$/;
+/** Whether `value` is a `-lock-timeout` duration. */
+export function isLockTimeout(value) {
+    return typeof value === "string" && DURATION.test(value);
+}
+/**
+ * The `-lock-timeout` flag a `command` takes: `-lock-timeout=<timeout>`, or
+ * nothing when `TF_CLI_ARGS` or `TF_CLI_ARGS_<command>` in `env` already
+ * names one, or `timeout` is `false`. Throws on a duration terraform refuses.
+ */
+export function lockTimeoutArgs(command, timeout = DEFAULT_LOCK_TIMEOUT, env = process.env) {
+    if (timeout === false)
+        return [];
+    if (!isLockTimeout(timeout))
+        throw new Error(`lockTimeout "${timeout}" is not a duration terraform takes, such as "5m" or "30s"`);
+    const set = `${env.TF_CLI_ARGS ?? ""} ${env[`TF_CLI_ARGS_${command}`] ?? ""}`;
+    return /(^|\s)-{1,2}lock-timeout[=\s]/.test(set) ? [] : [`-lock-timeout=${timeout}`];
+}

package/dist/lsp/option-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAMtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAYpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAStC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}
+{"version":3,"file":"option-keys.d.ts","sourceRoot":"","sources":["../../src/lsp/option-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EAAE,SAAS,EAG5C,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,eAAe,EAAE,SAAS,EAQtC,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,SAAS,EAYpC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,eAAe,EAAE,SAAS,EAEtC,CAAC;AAQF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAKrC,CAAC;AAEF,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,SAAS,EAStC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,cAAc,EAAE,SAAS,EAIrC,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,CAK5D,CAAC;AAEF,iPAAiP;AACjP,eAAO,MAAM,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAW/C,CAAC"}

package/dist/lsp/option-keys.js

@@ -18,7 +18,9 @@ export const ROOT_ENTRY_KEYS = [
     { key: "workspace", detail: "Terraform workspace to select for this root. Omitted means `default`." },
     { key: "varFiles", detail: "`-var-file` arguments, in order, relative to `dir`." },
     { key: "backendConfig", detail: "`-backend-config` key/value pairs handed to `init`." },
+    { key: "backendConfigFiles", detail: "Backend-config files handed to `init` as `-backend-config=<path>`, before the pairs, relative to `dir`." },
     { key: "delete", detail: '"never" | "owned-only" | "gated" — this root\'s delete mode, mapped onto choudoufu\'s policy block on a live root.' },
+    { key: "signalOnly", detail: "`true` when the root is declared only so a change to it brings this project into the change. The build and live reads skip it." },
 ];
 /** `TerraformApplyOpConfig`'s keys (`TerraformApplyOp({ <here> })`). */
 export const APPLY_OP_KEYS = [

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.124.52",
+  "version": "0.124.55",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/module-catalog/index.d.ts

@@ -0,0 +1,69 @@
+import type { StaticRow } from "./types.js";
+export type { StaticRefusal, StaticRow, StaticMeasurement, StaticSource } from "./types.js";
+/** Where the vendored rows came from. */
+export declare const MODULE_CATALOG_SOURCE: {
+    readonly repo: "INTENTIUS/choudoufu";
+    readonly path: "live/module-compat.json";
+    readonly commit: "39a143679a6f5ffeae7dc186190049e8b55f7149";
+    /** The static tier's measurement date. */
+    readonly date: string;
+    /** The choudoufu commit the static tier was measured at. */
+    readonly measuredAt: string;
+    /** The hashicorp/aws provider version the static tier was measured with. */
+    readonly awsProvider: string;
+};
+/** choudoufu's site page that renders both tiers. */
+export declare const MODULE_COMPATIBILITY_PAGE = "https://intentius.io/choudoufu/aws/compatibility/#modules";
+/** The tiers this catalog holds. */
+export type ModuleCatalogTier = "static";
+/** Every static row, as vendored. */
+export declare const staticRows: readonly StaticRow[];
+/** One refusal ID across the examples of a module version that carry it. */
+export interface ModuleRefusalSummary {
+    id: string;
+    /** Sites summed across the examples that carry it. */
+    sites: number;
+    docsUrl: string;
+    /** Example directories that carry it, sorted. */
+    examples: string[];
+}
+/**
+ * What the catalog says about one pinned module version.
+ *
+ * - `unknown-module`: no static row for this module at any version.
+ * - `unknown-version`: rows for the module, none measured at this version
+ *   (`measuredVersions` lists the ones there are).
+ * - `refused`: at least one example at this version is refused.
+ * - `clear`: every measured example at this version is clear.
+ */
+export interface ModuleCompatibility {
+    module: string;
+    /** The pinned version, without a leading `v` or `=`. */
+    version: string;
+    tier: ModuleCatalogTier;
+    status: "unknown-module" | "unknown-version" | "clear" | "refused";
+    /** Static rows measured at this version (an `unmeasured` row is left out). */
+    examples: number;
+    clearExamples: number;
+    refusedExamples: number;
+    /** Refusal IDs at this version, most refused examples first, then by ID. */
+    refusals: ModuleRefusalSummary[];
+    /** Versions the static tier measured for this module, without a leading `v`. */
+    measuredVersions: string[];
+}
+/**
+ * The registry address of a module source, without a registry host, a
+ * `//subdir` or a query, lowercased: `registry.terraform.io/terraform-aws-modules/iam/aws//modules/iam-role`
+ * gives `terraform-aws-modules/iam/aws`. Undefined when the source is not a
+ * three-part registry address.
+ */
+export declare function registryModuleAddress(source: string): string | undefined;
+/** `= 1.4.0`, `v1.4.0` and `1.4.0` all give `1.4.0`; a range gives undefined. */
+export declare function exactModuleVersion(version: string): string | undefined;
+/**
+ * The catalog's answer for a module `source` pinned at `version`, or
+ * undefined when the source is not a registry address or the version is not
+ * exact (a range is TF039's finding, and the catalog has no row for one).
+ */
+export declare function moduleCompatibility(source: string, version: string): ModuleCompatibility | undefined;
+//# sourceMappingURL=index.d.ts.map

package/dist/module-catalog/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/module-catalog/index.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzF,yCAAyC;AACzC,eAAO,MAAM,qBAAqB;aAChC,IAAI,EAAE,qBAAqB;aAC3B,IAAI;aACJ,MAAM;IACN,0CAA0C;aAC1C,IAAI;IACJ,4DAA4D;aAC5D,UAAU;IACV,4EAA4E;aAC5E,WAAW;CACH,CAAC;AAEX,qDAAqD;AACrD,eAAO,MAAM,yBAAyB,8DAA8D,CAAC;AAErG,oCAAoC;AACpC,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEzC,qCAAqC;AACrC,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAAgB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,OAAO,GAAG,SAAS,CAAC;IACnE,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQxE;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtE;AAiBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAoCpG"}

package/dist/module-catalog/index.js

@@ -0,0 +1,110 @@
+/**
+ * The known-module catalog (chant#4560): choudoufu's module compatibility
+ * table (choudoufu#2292, `live/module-compat.json`), vendored in
+ * `./static-tier.ts` and read by TF047 and by terragucci's tip and estate
+ * column (terragucci#1286).
+ *
+ * The catalog holds the static tier only. A static row is one
+ * terraform-aws-modules example at one tag, measured offline by choudoufu's
+ * refusal probe in the onboarded form: `clear` means `choudoufu live-check`
+ * plans it, `refused` lists choudoufu refusal IDs with site counts. The
+ * gauntlet tier (end-to-end runs against an emulator) is a separate table in
+ * choudoufu, has no rows until choudoufu#2291's run, and is never folded into
+ * these numbers: every result here carries `tier: "static"`, and a figure in
+ * it counts static rows only.
+ *
+ * This subpath, `@intentius/chant-lexicon-terraform/module-catalog`, imports
+ * nothing but its own data, so a consumer can load it on its own.
+ */
+import { SOURCE_COMMIT, SOURCE_PATH, STATIC_MEASUREMENT, STATIC_ROWS } from "./static-tier.js";
+/** Where the vendored rows came from. */
+export const MODULE_CATALOG_SOURCE = {
+    repo: "INTENTIUS/choudoufu",
+    path: SOURCE_PATH,
+    commit: SOURCE_COMMIT,
+    /** The static tier's measurement date. */
+    date: STATIC_MEASUREMENT.date,
+    /** The choudoufu commit the static tier was measured at. */
+    measuredAt: STATIC_MEASUREMENT.commit,
+    /** The hashicorp/aws provider version the static tier was measured with. */
+    awsProvider: STATIC_MEASUREMENT.aws_provider,
+};
+/** choudoufu's site page that renders both tiers. */
+export const MODULE_COMPATIBILITY_PAGE = "https://intentius.io/choudoufu/aws/compatibility/#modules";
+/** Every static row, as vendored. */
+export const staticRows = STATIC_ROWS;
+/**
+ * The registry address of a module source, without a registry host, a
+ * `//subdir` or a query, lowercased: `registry.terraform.io/terraform-aws-modules/iam/aws//modules/iam-role`
+ * gives `terraform-aws-modules/iam/aws`. Undefined when the source is not a
+ * three-part registry address.
+ */
+export function registryModuleAddress(source) {
+    let s = source.trim().split("?")[0];
+    const sub = s.indexOf("//");
+    if (sub >= 0)
+        s = s.slice(0, sub);
+    const parts = s.split("/");
+    if (parts.length === 4 && parts[0].includes("."))
+        parts.shift();
+    if (parts.length !== 3 || parts.some((p) => !/^[A-Za-z0-9][A-Za-z0-9_.-]*$/.test(p)))
+        return undefined;
+    return parts.join("/").toLowerCase();
+}
+/** `= 1.4.0`, `v1.4.0` and `1.4.0` all give `1.4.0`; a range gives undefined. */
+export function exactModuleVersion(version) {
+    const v = version.trim().replace(/^=\s*/, "").replace(/^v/, "");
+    return /^\d+(?:\.\d+){0,2}(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(v) ? v : undefined;
+}
+const bare = (version) => version.replace(/^v/, "");
+function byModule() {
+    const out = new Map();
+    for (const row of STATIC_ROWS) {
+        const key = row.module.toLowerCase();
+        const list = out.get(key) ?? [];
+        list.push(row);
+        out.set(key, list);
+    }
+    return out;
+}
+let index;
+/**
+ * The catalog's answer for a module `source` pinned at `version`, or
+ * undefined when the source is not a registry address or the version is not
+ * exact (a range is TF039's finding, and the catalog has no row for one).
+ */
+export function moduleCompatibility(source, version) {
+    const module = registryModuleAddress(source);
+    const pinned = exactModuleVersion(version);
+    if (module === undefined || pinned === undefined)
+        return undefined;
+    index ?? (index = byModule());
+    const rows = index.get(module) ?? [];
+    const measuredVersions = [...new Set(rows.map((r) => bare(r.version)))].sort();
+    const at = rows.filter((r) => bare(r.version) === pinned && r.verdict !== "unmeasured");
+    const refusedRows = at.filter((r) => r.verdict === "refused");
+    const refusals = new Map();
+    for (const row of refusedRows) {
+        for (const r of row.refusals) {
+            const s = refusals.get(r.id) ?? { id: r.id, sites: 0, docsUrl: r.docs_url, examples: [] };
+            s.sites += r.sites;
+            if (!s.examples.includes(row.example))
+                s.examples.push(row.example);
+            refusals.set(r.id, s);
+        }
+    }
+    for (const s of refusals.values())
+        s.examples.sort();
+    const status = rows.length === 0 ? "unknown-module" : at.length === 0 ? "unknown-version" : refusedRows.length > 0 ? "refused" : "clear";
+    return {
+        module,
+        version: pinned,
+        tier: "static",
+        status,
+        examples: at.length,
+        clearExamples: at.filter((r) => r.verdict === "clear").length,
+        refusedExamples: refusedRows.length,
+        refusals: [...refusals.values()].sort((a, b) => b.examples.length - a.examples.length || a.id.localeCompare(b.id)),
+        measuredVersions,
+    };
+}

package/dist/module-catalog/refresh-cli.d.ts

@@ -0,0 +1,4 @@
+import { type StaticMeasurement, type StaticRow } from "./types.js";
+/** The TypeScript source of `static-tier.ts` for one snapshot. */
+export declare function renderStaticTier(commit: string, measurement: StaticMeasurement, rows: readonly StaticRow[]): string;
+//# sourceMappingURL=refresh-cli.d.ts.map

package/dist/module-catalog/refresh-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-cli.d.ts","sourceRoot":"","sources":["../../src/module-catalog/refresh-cli.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAqB,KAAK,iBAAiB,EAAE,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AASpF,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAiBnH"}

package/dist/module-catalog/refresh-cli.js

@@ -0,0 +1,64 @@
+/**
+ * Refresh the vendored known-module catalog (chant#4560) from choudoufu's
+ * module compatibility table.
+ *
+ *   npm run --prefix lexicons/terraform module-catalog:refresh -- <choudoufu checkout> [ref]
+ *
+ * It reads `live/module-compat.json` at `ref` (default `origin/main`) with
+ * `git show`, so the checkout's working tree is never read and a local edit
+ * cannot leak into the snapshot. The header of the written file names the
+ * source path and the choudoufu commit that last changed the table at that
+ * ref, so a reader can check the snapshot against its source with
+ * `git -C <choudoufu> show <commit>:live/module-compat.json`.
+ *
+ * Only the static tier is vendored. choudoufu keeps the gauntlet tier in a
+ * separate array and the two tiers share no figure (choudoufu#2292 ruling);
+ * the gauntlet array stays out until it has rows (choudoufu#2291), and then
+ * comes in as its own export, never folded into the static rows.
+ */
+import { execFileSync } from "node:child_process";
+import { writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseModuleCompat } from "./types.js";
+const SOURCE_PATH = "live/module-compat.json";
+const OUT = join(dirname(fileURLToPath(import.meta.url)), "static-tier.ts");
+function git(dir, ...args) {
+    return execFileSync("git", ["-C", dir, ...args], { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 });
+}
+/** The TypeScript source of `static-tier.ts` for one snapshot. */
+export function renderStaticTier(commit, measurement, rows) {
+    return [
+        "// Code generated by src/module-catalog/refresh-cli.ts. DO NOT EDIT.",
+        "//",
+        `// Vendored from INTENTIUS/choudoufu ${SOURCE_PATH} at commit`,
+        `// ${commit}, static tier only (chant#4560).`,
+        "// The gauntlet tier is a separate array in that file and is not vendored here.",
+        "import type { StaticMeasurement, StaticRow } from \"./types\";",
+        "",
+        `export const SOURCE_PATH = ${JSON.stringify(SOURCE_PATH)};`,
+        `export const SOURCE_COMMIT = ${JSON.stringify(commit)};`,
+        "",
+        `export const STATIC_MEASUREMENT: StaticMeasurement = ${JSON.stringify(measurement, null, 2)};`,
+        "",
+        `export const STATIC_ROWS: readonly StaticRow[] = ${JSON.stringify(rows, null, 2)};`,
+        "",
+    ].join("\n");
+}
+function main(argv) {
+    const [dir, ref = "origin/main"] = argv;
+    if (!dir) {
+        console.error("usage: refresh-cli.ts <choudoufu checkout> [ref]");
+        process.exit(2);
+    }
+    const commit = git(dir, "log", "-1", "--format=%H", ref, "--", SOURCE_PATH).trim();
+    if (!/^[0-9a-f]{40}$/.test(commit)) {
+        console.error(`${SOURCE_PATH} has no history at ${ref} in ${dir}`);
+        process.exit(1);
+    }
+    const file = parseModuleCompat(JSON.parse(git(dir, "show", `${commit}:${SOURCE_PATH}`)));
+    writeFileSync(OUT, renderStaticTier(commit, file.static_measurement, file.static));
+    console.log(`module catalog: ${file.static.length} static rows from ${SOURCE_PATH} at ${commit}`);
+}
+if (process.argv[1] && fileURLToPath(import.meta.url) === process.argv[1])
+    main(process.argv.slice(2));

package/dist/module-catalog/static-tier.d.ts

@@ -0,0 +1,6 @@
+import type { StaticMeasurement, StaticRow } from "./types.js";
+export declare const SOURCE_PATH = "live/module-compat.json";
+export declare const SOURCE_COMMIT = "39a143679a6f5ffeae7dc186190049e8b55f7149";
+export declare const STATIC_MEASUREMENT: StaticMeasurement;
+export declare const STATIC_ROWS: readonly StaticRow[];
+//# sourceMappingURL=static-tier.d.ts.map

package/dist/module-catalog/static-tier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"static-tier.d.ts","sourceRoot":"","sources":["../../src/module-catalog/static-tier.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAE5D,eAAO,MAAM,WAAW,4BAA4B,CAAC;AACrD,eAAO,MAAM,aAAa,6CAA6C,CAAC;AAExE,eAAO,MAAM,kBAAkB,EAAE,iBAkHhC,CAAC;AAEF,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EA4/C3C,CAAC"}