@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/dist/module-catalog/types.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The shape of choudoufu's `live/module-compat.json` (choudoufu#2292,
+ * `tools/modcompat/modcompat.go`), as far as the known-module catalog reads
+ * it. Only the static tier is typed here; see `./refresh-cli.ts`.
+ */
+/** One refusal on a static row: a choudoufu refusal ID and where it is documented. */
+export interface StaticRefusal {
+    id: string;
+    layer: string;
+    sites: number;
+    docs_ref: string;
+    docs_url: string;
+}
+/** One terraform-aws-modules example measured offline in the onboarded form. */
+export interface StaticRow {
+    tier: "static";
+    /** Registry address, `terraform-aws-modules/vpc/aws`. */
+    module: string;
+    /** The module repository's tag, `v6.6.1`. */
+    version: string;
+    /** The example directory inside the module repository. */
+    example: string;
+    date: string;
+    commit: string;
+    aws_provider: string;
+    verdict: "clear" | "refused" | "unmeasured";
+    /** Eligible data-source reads. These never refuse and are not refusals. */
+    reads: number;
+    refusals: StaticRefusal[];
+    reason?: string;
+    partial_schemas?: string[];
+}
+export interface StaticSource {
+    module: string;
+    repo: string;
+    version: string;
+    commit: string;
+    glob: string;
+    examples: number;
+}
+/** How the static tier was measured. */
+export interface StaticMeasurement {
+    date: string;
+    commit: string;
+    instrument: string;
+    form: string;
+    schemas: boolean;
+    second_pass: boolean;
+    aws_provider: string;
+    sources: StaticSource[];
+}
+/** The parts of the file the catalog reads. */
+export interface ModuleCompatFile {
+    schema: number;
+    static_measurement: StaticMeasurement;
+    static: StaticRow[];
+}
+/**
+ * Check a parsed `live/module-compat.json` against the shape above and return
+ * it. Throws on a schema other than 1, a row outside the static tier, or a
+ * row whose verdict disagrees with its refusals, so a refresh never vendors a
+ * table the catalog would misread.
+ */
+export declare function parseModuleCompat(raw: unknown): ModuleCompatFile;
+//# sourceMappingURL=types.d.ts.map

package/dist/module-catalog/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/module-catalog/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,sFAAsF;AACtF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,QAAQ,CAAC;IACf,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;IAC5C,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AAED,+CAA+C;AAC/C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,iBAAiB,CAAC;IACtC,MAAM,EAAE,SAAS,EAAE,CAAC;CACrB;AAID;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,gBAAgB,CAgBhE"}

package/dist/module-catalog/types.js

@@ -0,0 +1,33 @@
+/**
+ * The shape of choudoufu's `live/module-compat.json` (choudoufu#2292,
+ * `tools/modcompat/modcompat.go`), as far as the known-module catalog reads
+ * it. Only the static tier is typed here; see `./refresh-cli.ts`.
+ */
+const VERDICTS = new Set(["clear", "refused", "unmeasured"]);
+/**
+ * Check a parsed `live/module-compat.json` against the shape above and return
+ * it. Throws on a schema other than 1, a row outside the static tier, or a
+ * row whose verdict disagrees with its refusals, so a refresh never vendors a
+ * table the catalog would misread.
+ */
+export function parseModuleCompat(raw) {
+    const file = raw;
+    if (file?.schema !== 1)
+        throw new Error(`module-compat.json: schema ${String(file?.schema)}, expected 1`);
+    if (!file.static_measurement || !Array.isArray(file.static)) {
+        throw new Error("module-compat.json: missing static_measurement or static");
+    }
+    for (const row of file.static) {
+        const where = `${row.module} ${row.version} ${row.example}`;
+        if (row.tier !== "static")
+            throw new Error(`module-compat.json: ${where} is in the static array with tier ${row.tier}`);
+        if (!VERDICTS.has(row.verdict))
+            throw new Error(`module-compat.json: ${where} has verdict ${row.verdict}`);
+        if (!Array.isArray(row.refusals))
+            throw new Error(`module-compat.json: ${where} has no refusals list`);
+        if ((row.verdict === "refused") !== (row.refusals.length > 0)) {
+            throw new Error(`module-compat.json: ${where} is ${row.verdict} with ${row.refusals.length} refusals`);
+        }
+    }
+    return { schema: file.schema, static_measurement: file.static_measurement, static: file.static };
+}

package/dist/okf/index.md

@@ -26,7 +26,7 @@ okf_version: '0.2'
 * [TF020](/rules/TF020.md) - Declaration is never referenced in its module scope
 * [TF021](/rules/TF021.md) - count builds instance identities from count.index where for_each is safer
 * [TF022](/rules/TF022.md) - Credential-named resource attribute holds a plaintext literal
-* [TF024](/rules/TF024.md) - Live root declares a backend or cloud block, which choudoufu refuses
+* [TF024](/rules/TF024.md) - Live root declares a backend or cloud block, which choudoufu ignores
 * [TF025](/rules/TF025.md) - Live root references a non-default terraform.workspace, which choudoufu refuses
 * [TF026](/rules/TF026.md) - Live root declares delete: "never" but its policy leaves undeclared_tagged at "delete"
 * [TF027](/rules/TF027.md) - Live root's policy block sets undeclared_untagged = "delete", which deletes resources chant does not own
@@ -48,4 +48,6 @@ okf_version: '0.2'
 * [TF043](/rules/TF043.md) - Terragrunt terraform.source names no version (git ref, tfr version or oci tag)
 * [TF044](/rules/TF044.md) - Terragrunt config keeps state in a local backend
 * [TF045](/rules/TF045.md) - No Terragrunt config sets terragrunt_version_constraint
+* [TF046](/rules/TF046.md) - Live root resolves to the local record store in a CI run
+* [TF047](/rules/TF047.md) - Live root pins a module version the known-module catalog has no row for, or one with refusals
 * [TF101](/rules/TF101.md) - terraformApply's planFile must reference a preceding terraformPlan step.

package/dist/okf/rules/TF024.md

@@ -1,11 +1,11 @@
 ---
 type: post-synth-check
 title: TF024
-description: Live root declares a backend or cloud block, which choudoufu refuses
+description: Live root declares a backend or cloud block, which choudoufu ignores
 id: TF024
 severity: error
 category: post-synth
 lexicon: terraform
 docs: https://intentius.io/chant/lexicons/terraform/rules/
 ---
-Live root declares a backend or cloud block, which choudoufu refuses
+Live root declares a backend or cloud block, which choudoufu ignores

package/dist/okf/rules/TF046.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF046
+description: Live root resolves to the local record store in a CI run
+id: TF046
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root resolves to the local record store in a CI run

package/dist/okf/rules/TF047.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: TF047
+description: Live root pins a module version the known-module catalog has no row for, or one with refusals
+id: TF047
+severity: error
+category: post-synth
+lexicon: terraform
+docs: https://intentius.io/chant/lexicons/terraform/rules/
+---
+Live root pins a module version the known-module catalog has no row for, or one with refusals

package/dist/op/activities/index.d.ts

@@ -16,6 +16,10 @@
  *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
  *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
  *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
+ *   - choudoufuPlanSet: `live-plan-set -json` over one live root, as a
+ *     one-root set (#3459). Its `changeSet` is the root's part, so an Op can
+ *     plan several clouds' roots and hand the parts to `composeChangeSet`
+ *     (#4483).
  *   - terraformPinRollout: one run of a pin-bump rollout, opening at most one
  *     wave's pull request (#3189). It loads the HCL parser on first call.
  *
@@ -25,8 +29,8 @@
  * run time. The pure command and environment builders are exported alongside
  * the activities because they are what the tests assert on.
  */
-export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
-export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformApprovalRefusal, TerraformShowResult, ChoudoufuLivePlanResult, ChoudoufuLiveLsResult, ChoudoufuLiveCheckResult, ChoudoufuAdoptResult, AdoptionRefusal, PlanChangeCounts, LivePlanUnownedCounts, } from "./terraform.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, choudoufuPlanSet, choudoufuPlanSetCommand, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, MIN_CHOUDOUFU_ESTATES_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
+export type { TerraformRootArgs, TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs, TerraformInitResult, TerraformPlanResult, TerraformApplyResult, TerraformApprovalRefusal, TerraformShowResult, ChoudoufuLivePlanResult, ChoudoufuLiveLsResult, ChoudoufuLiveCheckResult, ChoudoufuAdoptResult, ChoudoufuPlanSet, ChoudoufuPlanSetResult, AdoptionRefusal, PlanChangeCounts, LivePlanUnownedCounts, } from "./terraform.js";
 export { detectLiveEstate } from "./live-detect.js";
 export { terraformPinRollout } from "./pin-rollout.js";
 export type { TerraformPinRolloutArgs, TerraformPinRolloutResult } from "./pin-rollout.js";

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,EACrB,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,qBAAqB,EACrB,QAAQ,EACR,iBAAiB,EACjB,wBAAwB,EACxB,+BAA+B,EAC/B,qBAAqB,EACrB,6BAA6B,EAC7B,uBAAuB,EACvB,+BAA+B,EAC/B,4BAA4B,EAC5B,mCAAmC,EACnC,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC"}

package/dist/op/activities/index.js

@@ -16,6 +16,10 @@
  *   - choudoufuLiveLs: `live-ls -estate=<estate> -json [-consistent]` (#2103).
  *   - choudoufuLiveCheck: `live-check -json`, no cloud calls (#2103).
  *   - choudoufuAdopt: the tag writes that claim an adoption ledger's matches (#2105).
+ *   - choudoufuPlanSet: `live-plan-set -json` over one live root, as a
+ *     one-root set (#3459). Its `changeSet` is the root's part, so an Op can
+ *     plan several clouds' roots and hand the parts to `composeChangeSet`
+ *     (#4483).
  *   - terraformPinRollout: one run of a pin-bump rollout, opening at most one
  *     wave's pull request (#3189). It loads the HCL parser on first call.
  *
@@ -25,6 +29,6 @@
  * run time. The pure command and environment builders are exported alongside
  * the activities because they are what the tests assert on.
  */
-export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
+export { terraformInit, terraformPlan, terraformApply, terraformShow, choudoufuLivePlan, choudoufuLiveLs, choudoufuLiveCheck, choudoufuAdopt, choudoufuPlanSet, choudoufuPlanSetCommand, terraformInitCommand, terraformPlanCommand, terraformApplyCommand, terraformShowCommand, choudoufuLivePlanCommand, choudoufuLiveLsCommand, choudoufuLiveCheckCommand, terraformEnvironment, terraformBinary, countPlanChanges, countLivePlanUnowned, isOlderVersion, parseChoudoufuVersion, quoteArg, DEFAULT_PLAN_FILE, DEFAULT_TERRAFORM_BINARY, DEFAULT_LIVE_PLAN_DOCUMENT_FILE, MIN_CHOUDOUFU_VERSION, MIN_CHOUDOUFU_ESTATES_VERSION, classifyApprovalRefusal, CHOUDOUFU_LIVE_PLAN_OUT_REFUSAL, CHOUDOUFU_APPROVAL_EXIT_CODE, CHOUDOUFU_APPROVAL_MISMATCH_REFUSAL, CHOUDOUFU_WRONG_ESTATE_REFUSAL, } from "./terraform.js";
 export { detectLiveEstate } from "./live-detect.js";
 export { terraformPinRollout } from "./pin-rollout.js";

package/dist/op/activities/live-detect.d.ts

@@ -1,7 +1,8 @@
 /**
  * A fast, regex-based read of whether a root module directory declares a
  * live estate: an `estate.chdf.hcl` sidecar, or a `live { ... }` block nested
- * inside a `terraform { ... }` block of some `.tf` file (#2103).
+ * inside a `terraform { ... }` block of some configuration file (#2103), the
+ * `terraform` object of a `.tf.json` file included (chant#4504).
  *
  * Deliberately separate from `../../hcl/parse.ts`'s AST-accurate detection
  * (`blocksToEntities`'s `liveBlocksIn`), which the build and lint paths use.
@@ -25,7 +26,7 @@
  * no sidecar (or one this function cannot read) yields `undefined` rather
  * than throwing, since this is a best-effort check, not the authoritative parse.
  */
-export declare function detectLiveEstate(dir: string): string | undefined;
+export declare function detectLiveEstate(dir: string, binary?: string): string | undefined;
 /**
  * The `undeclared_tagged`/`undeclared_untagged` verbs a live root's `policy {
  * }` block assigns, or `undefined` when the directory declares no `policy`
@@ -47,5 +48,5 @@ export interface LivePolicyVerbs {
     /** The `undeclared_untagged` quadrant's verb, verbatim, or `undefined` when the attribute is absent. */
     undeclaredUntagged?: string;
 }
-export declare function detectLivePolicyVerbs(dir: string): LivePolicyVerbs | undefined;
+export declare function detectLivePolicyVerbs(dir: string, binary?: string): LivePolicyVerbs | undefined;
 //# sourceMappingURL=live-detect.d.ts.map

package/dist/op/activities/live-detect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"live-detect.d.ts","sourceRoot":"","sources":["../../../src/op/activities/live-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA6CH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoChE;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,+HAA+H;IAC/H,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CA8B9E"}
+{"version":3,"file":"live-detect.d.ts","sourceRoot":"","sources":["../../../src/op/activities/live-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA2EH;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAc,GAAG,MAAM,GAAG,SAAS,CAgCtF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,+HAA+H;IAC/H,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wGAAwG;IACxG,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAc,GAAG,eAAe,GAAG,SAAS,CAgCpG"}

package/dist/op/activities/live-detect.js

@@ -1,7 +1,8 @@
 /**
  * A fast, regex-based read of whether a root module directory declares a
  * live estate: an `estate.chdf.hcl` sidecar, or a `live { ... }` block nested
- * inside a `terraform { ... }` block of some `.tf` file (#2103).
+ * inside a `terraform { ... }` block of some configuration file (#2103), the
+ * `terraform` object of a `.tf.json` file included (chant#4504).
  *
  * Deliberately separate from `../../hcl/parse.ts`'s AST-accurate detection
  * (`blocksToEntities`'s `liveBlocksIn`), which the build and lint paths use.
@@ -16,8 +17,37 @@
  * in `../../hcl/parse.ts` by hand rather than by importing it, for the same
  * reason.
  */
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { isJsonConfigFile, jsonLiveBlocks, listConfigFiles } from "../../hcl/files.js";
+/**
+ * The configuration files of `dir` a live check reads, in filename order.
+ * A `live` block takes effect only under choudoufu, so the set is the one
+ * choudoufu reads (`.tf`, `.tf.json`, `.tofu` and `.tofu.json`, `x.tofu`
+ * over `x.tf`) from the lexicon's one lister (chant#4457), which reads the
+ * directory and nothing else.
+ */
+function liveFiles(dir, binary) {
+    return listConfigFiles(dir, binary);
+}
+/**
+ * The `live` block bodies of one file: a JSON-syntax file's from its
+ * `terraform` blocks (chant#4504), an HCL file's first one by brace counting.
+ * HCL bodies come back as text and JSON ones as objects.
+ */
+function liveBlocksOf(name, source) {
+    if (isJsonConfigFile(name))
+        return jsonLiveBlocks(source);
+    const terraformBlock = extractBalancedBlock(source, "terraform");
+    if (terraformBlock === undefined)
+        return [];
+    const liveBlock = extractBalancedBlock(terraformBlock, "live");
+    return liveBlock === undefined ? [] : [liveBlock];
+}
+/** A non-empty string, or undefined. */
+function nonEmpty(v) {
+    return typeof v === "string" && v !== "" ? v : undefined;
+}
 /** Kept in sync with `LIVE_SIDECAR_FILENAME` in `../../hcl/parse.ts`. */
 const LIVE_SIDECAR_FILENAME = "estate.chdf.hcl";
 /**
@@ -66,7 +96,7 @@ function extractQuotedAttr(body, key) {
  * no sidecar (or one this function cannot read) yields `undefined` rather
  * than throwing, since this is a best-effort check, not the authoritative parse.
  */
-export function detectLiveEstate(dir) {
+export function detectLiveEstate(dir, binary = "choudoufu") {
     const sidecarPath = join(dir, LIVE_SIDECAR_FILENAME);
     if (existsSync(sidecarPath)) {
         try {
@@ -80,9 +110,7 @@ export function detectLiveEstate(dir) {
     }
     let names;
     try {
-        names = readdirSync(dir)
-            .filter((f) => f.endsWith(".tf"))
-            .sort();
+        names = liveFiles(dir, binary);
     }
     catch {
         return undefined;
@@ -95,24 +123,18 @@ export function detectLiveEstate(dir) {
         catch {
             continue;
         }
-        const terraformBlock = extractBalancedBlock(source, "terraform");
-        if (terraformBlock === undefined)
-            continue;
-        const liveBlock = extractBalancedBlock(terraformBlock, "live");
-        if (liveBlock === undefined)
-            continue;
-        const estate = extractEstateAttr(liveBlock);
-        if (estate)
-            return estate;
+        for (const liveBlock of liveBlocksOf(name, source)) {
+            const estate = typeof liveBlock === "string" ? extractEstateAttr(liveBlock) : nonEmpty(liveBlock.estate);
+            if (estate)
+                return estate;
+        }
     }
     return undefined;
 }
-export function detectLivePolicyVerbs(dir) {
+export function detectLivePolicyVerbs(dir, binary = "choudoufu") {
     let names;
     try {
-        names = readdirSync(dir)
-            .filter((f) => f.endsWith(".tf"))
-            .sort();
+        names = liveFiles(dir, binary);
     }
     catch {
         return undefined;
@@ -125,19 +147,22 @@ export function detectLivePolicyVerbs(dir) {
         catch {
             continue;
         }
-        const terraformBlock = extractBalancedBlock(source, "terraform");
-        if (terraformBlock === undefined)
-            continue;
-        const liveBlock = extractBalancedBlock(terraformBlock, "live");
-        if (liveBlock === undefined)
-            continue;
-        const policyBlock = extractBalancedBlock(liveBlock, "policy");
-        if (policyBlock === undefined)
-            continue;
-        return {
-            undeclaredTagged: extractQuotedAttr(policyBlock, "undeclared_tagged"),
-            undeclaredUntagged: extractQuotedAttr(policyBlock, "undeclared_untagged"),
-        };
+        for (const liveBlock of liveBlocksOf(name, source)) {
+            if (typeof liveBlock === "string") {
+                const policyBlock = extractBalancedBlock(liveBlock, "policy");
+                if (policyBlock === undefined)
+                    continue;
+                return {
+                    undeclaredTagged: extractQuotedAttr(policyBlock, "undeclared_tagged"),
+                    undeclaredUntagged: extractQuotedAttr(policyBlock, "undeclared_untagged"),
+                };
+            }
+            // JSON syntax writes the nested `policy` block as one object or an array of them.
+            const policy = [liveBlock.policy].flat().find((p) => typeof p === "object" && p !== null && !Array.isArray(p));
+            if (!policy)
+                continue;
+            return { undeclaredTagged: nonEmpty(policy.undeclared_tagged), undeclaredUntagged: nonEmpty(policy.undeclared_untagged) };
+        }
     }
     return undefined;
 }

package/dist/op/activities/pin-rollout.d.ts

@@ -37,6 +37,8 @@ export interface TerraformPinRolloutArgs {
     appliedCheck?: string;
     /** A directory in the repository. Default: the working directory. */
     cwd?: string;
+    /** The binary the roots run, which says whether their `.tofu` files are read (chant#4457). Default `terraform`. */
+    binary?: string;
 }
 export type TerraformPinRolloutResult = PinRolloutResult;
 /** Run one step of a pin-bump rollout. Throws when the rollout has stopped. */

package/dist/op/activities/pin-rollout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pin-rollout.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pin-rollout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE3E,MAAM,WAAW,uBAAuB;IACtC,sGAAsG;IACtG,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,qGAAqG;IACrG,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gHAAgH;IAChH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sHAAsH;IACtH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAEzD,+EAA+E;AAC/E,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAI3G;AAED,+GAA+G;AAC/G,wBAAsB,cAAc,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAqBtG"}
+{"version":3,"file":"pin-rollout.d.ts","sourceRoot":"","sources":["../../../src/op/activities/pin-rollout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE3E,MAAM,WAAW,uBAAuB;IACtC,sGAAsG;IACtG,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAC;IACX,qGAAqG;IACrG,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,gHAAgH;IAChH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uGAAuG;IACvG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sHAAsH;IACtH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mHAAmH;IACnH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,yBAAyB,GAAG,gBAAgB,CAAC;AAEzD,+EAA+E;AAC/E,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAI3G;AAED,+GAA+G;AAC/G,wBAAsB,cAAc,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAsBtG"}

package/dist/op/activities/pin-rollout.js

@@ -41,5 +41,6 @@ export async function readPinRollout(args) {
         ...(args.base ? { base: args.base } : {}),
         ...(args.remote ? { remote: args.remote } : {}),
         ...(args.appliedCheck ? { appliedCheck: args.appliedCheck } : {}),
+        ...(args.binary ? { binary: args.binary } : {}),
     });
 }