@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/dist/used-sources.js

@@ -0,0 +1,157 @@
+/**
+ * Every module source and provider address a root uses (chant#3924), read
+ * from its files before `init` downloads anything, so a product can check
+ * them against an allow list (terragucci's `sources:`) or a proxy map
+ * (chant#4606) in a check job.
+ *
+ * For a root and, with `followLocal`, each local module it calls (`./` and
+ * `../`, followed down to the modules they call), it reads each `module`
+ * block's `source`, each `required_providers` entry, and the providers a
+ * module uses with no entry: a `provider` block, or a resource, data or
+ * ephemeral block's `provider` argument or type prefix, which `init` installs
+ * as `hashicorp/<name>`. In the root itself it also reads a Terragrunt unit's
+ * `terraform { source }`. Files are `.tf`, `.tofu` and their `.json` forms;
+ * `binary` narrows them to the set that binary reads, with OpenTofu's rule
+ * that `x.tofu` hides `x.tf`.
+ *
+ * Each source carries its file and its block path from the root
+ * (`module.a > module.b > required_providers.x`) and its normal form
+ * (./registry/source-forms.ts). A local call that cannot be followed
+ * (outside the project, or missing) is named in `unread`, since what it
+ * uses cannot be read.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, posix, relative, sep } from "node:path";
+import { loadHcl2json } from "@intentius/chant/terraform/hcl2json";
+import { isJsonConfigFile, jsonConfigTree, selectConfigFiles } from "./hcl/files.js";
+import { impliedProvider, normalizeModuleSource, providerAddress, withoutQuery } from "./registry/source-forms.js";
+/** A block list as hcl2json writes it (an array) or a JSON file may (one object). */
+const bodies = (v) => (Array.isArray(v) ? v : v && typeof v === "object" ? [v] : []);
+const ALL_SUFFIXES = [".tf", ".tofu", ".tf.json", ".tofu.json"];
+/** The configuration files of one module directory, plus terragrunt.hcl when `terragrunt`. */
+function moduleFiles(dir, terragrunt, binary) {
+    if (!existsSync(dir) || !statSync(dir).isDirectory())
+        return [];
+    const names = readdirSync(dir).filter((n) => {
+        try {
+            return statSync(join(dir, n)).isFile();
+        }
+        catch {
+            return false;
+        }
+    });
+    const config = binary ? selectConfigFiles(names, binary) : names.filter((n) => ALL_SUFFIXES.some((s) => n.endsWith(s))).sort();
+    return terragrunt && names.includes("terragrunt.hcl") ? [...config, "terragrunt.hcl"] : config;
+}
+/** The local name of the provider a resource, data or ephemeral block uses: its `provider` argument's, else its type's prefix. */
+function providerOf(type, body) {
+    const ref = typeof body.provider === "string" ? /^(?:\$\{)?([A-Za-z][A-Za-z0-9_-]*)/.exec(body.provider) : null;
+    return ref ? ref[1] : type.split("_")[0];
+}
+const isLocal = (source) => /^\.\.?\//.test(source);
+async function readDir(abs, shown, prefix, top, o) {
+    const providers = [];
+    const calls = [];
+    const declared = new Set();
+    const implied = new Map();
+    const provider = (file, block, source, what) => ({
+        kind: "provider",
+        file,
+        block,
+        source,
+        normal: providerAddress(source, { binary: o.binary, proxies: o.proxies }) ?? source.trim().toLowerCase(),
+        ...(what ? { implied: what } : {}),
+    });
+    for (const name of moduleFiles(abs, top, o.binary)) {
+        const file = shown === "." ? name : posix.join(shown, name);
+        const text = readFileSync(join(abs, name), "utf-8");
+        let tree;
+        try {
+            tree = (isJsonConfigFile(name) ? jsonConfigTree(text) : await o.parser.parse(file, text));
+        }
+        catch (e) {
+            throw new Error(`${file} could not be read (${e.message.split("\n")[0]}), so its module and provider sources are unknown`);
+        }
+        if (name === "terragrunt.hcl") {
+            for (const b of bodies(tree.terraform))
+                if (typeof b.source === "string")
+                    calls.push({ file, block: `${prefix}terraform`, source: b.source });
+            continue;
+        }
+        for (const [call, list] of Object.entries(tree.module ?? {})) {
+            for (const b of bodies(list))
+                if (typeof b.source === "string")
+                    calls.push({ file, block: `${prefix}module.${call}`, source: b.source });
+        }
+        for (const t of bodies(tree.terraform)) {
+            for (const req of bodies(t.required_providers)) {
+                for (const [local, v] of Object.entries(req)) {
+                    declared.add(local);
+                    const source = v && typeof v === "object" && typeof v.source === "string" ? v.source : `hashicorp/${local}`;
+                    providers.push(provider(file, `${prefix}required_providers.${local}`, source));
+                }
+            }
+        }
+        for (const local of Object.keys(tree.provider ?? {}))
+            if (!implied.has(local))
+                implied.set(local, { file, what: `provider "${local}"` });
+        for (const kind of ["resource", "data", "ephemeral"]) {
+            for (const [type, named] of Object.entries(tree[kind] ?? {})) {
+                for (const [name, list] of Object.entries(named ?? {})) {
+                    for (const b of bodies(list)) {
+                        const local = providerOf(type, b);
+                        if (!implied.has(local))
+                            implied.set(local, { file, what: `${kind} "${type}" "${name}"` });
+                    }
+                }
+            }
+        }
+    }
+    for (const [local, at] of implied) {
+        const source = declared.has(local) ? undefined : impliedProvider(local);
+        if (source)
+            providers.push(provider(at.file, `${prefix}provider.${local}`, source, at.what));
+    }
+    return { providers, calls };
+}
+/**
+ * Every module source and provider address the root at `dir` uses, and each
+ * local call that could not be followed. Throws, naming the file, when a
+ * file cannot be parsed, so a check fails loudly instead of checking less.
+ */
+export async function usedSources(dir, options = {}) {
+    const project = options.project ?? dir;
+    const o = { ...options, parser: options.parser ?? (await loadHcl2json()) };
+    const follow = options.followLocal !== false;
+    const used = [];
+    const unread = [];
+    const shownOf = (abs) => relative(project, abs).split(sep).join("/") || ".";
+    const walk = async (rel, prefix, chain, top) => {
+        const { providers, calls } = await readDir(join(project, rel), rel, prefix, top, o);
+        used.push(...providers);
+        for (const c of calls) {
+            used.push({ kind: "module", file: c.file, block: c.block, source: c.source, normal: isLocal(c.source) ? withoutQuery(c.source) : normalizeModuleSource(withoutQuery(c.source), { binary: o.binary, proxies: o.proxies }) });
+            if (!follow || !isLocal(c.source))
+                continue;
+            // A Terragrunt source's `//` marks the directory it copies; the module is the path with it read as one `/`.
+            const path = withoutQuery(c.source).replace(/\/\/+/g, "/");
+            const next = posix.normalize(posix.join(rel, path)).replace(/\/+$/, "") || ".";
+            if (next === ".." || next.startsWith("../")) {
+                unread.push({ file: c.file, block: c.block, source: c.source, why: "it is outside the project, so the sources it uses cannot be read" });
+                continue;
+            }
+            if (!existsSync(join(project, next))) {
+                unread.push({ file: c.file, block: c.block, source: c.source, why: `${next} does not exist, so the sources it uses cannot be read` });
+                continue;
+            }
+            if (chain.includes(next) || moduleFiles(join(project, next), false, o.binary).length === 0)
+                continue;
+            await walk(next, `${c.block} > `, [...chain, next], false);
+        }
+    };
+    const start = shownOf(dir);
+    if (start === ".." || start.startsWith("../"))
+        throw new Error(`${dir} is outside the project ${project}`);
+    await walk(start, "", [start], true);
+    return { used, unread };
+}

package/package.json

@@ -1,11 +1,10 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.124.52",
+  "version": "0.124.55",
   "type": "module",
   "files": [
     "src/",
     "dist/",
-    "schemas/",
     "workspace-kinds.json"
   ],
   "exports": {
@@ -35,11 +34,31 @@
       "types": "./dist/pin/index.d.ts",
       "default": "./dist/pin/index.js"
     },
+    "./module-catalog": {
+      "development": "./src/module-catalog/index.ts",
+      "types": "./dist/module-catalog/index.d.ts",
+      "default": "./dist/module-catalog/index.js"
+    },
     "./terragrunt": {
       "development": "./src/terragrunt/index.ts",
       "types": "./dist/terragrunt/index.d.ts",
       "default": "./dist/terragrunt/index.js"
     },
+    "./state": {
+      "development": "./src/state/index.ts",
+      "types": "./dist/state/index.d.ts",
+      "default": "./dist/state/index.js"
+    },
+    "./registry": {
+      "development": "./src/registry/index.ts",
+      "types": "./dist/registry/index.d.ts",
+      "default": "./dist/registry/index.js"
+    },
+    "./registry/edge": {
+      "development": "./src/registry/edge/index.ts",
+      "types": "./dist/registry/edge/index.d.ts",
+      "default": "./dist/registry/edge/index.js"
+    },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
@@ -55,7 +74,8 @@
     "docs": "npx tsx src/codegen/docs-cli.ts",
     "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "bundle": "tsx src/package-cli.ts"
+    "bundle": "tsx src/package-cli.ts",
+    "module-catalog:refresh": "npx tsx src/module-catalog/refresh-cli.ts"
   },
   "devDependencies": {
     "@cdktn/hcl2json": "^0.24.0",
@@ -68,7 +88,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.52",
+    "@intentius/chant": "^0.124.55",
     "zod": "^4.3.6"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/__fixtures__/ACCEPTANCE.md

@@ -1,14 +1,17 @@
 # What the gated acceptance suites have actually run against
 
-Eight `describe` blocks across five files run this lexicon against a real
+Eleven `describe` blocks across eight files run this lexicon against a real
 binary rather than a fixture, and every one of them skips rather than fails
 when its dependency is absent. A skip is silent by design, so without this
 file nothing in the tree says which of them has ever passed, against what, or
 when. The evidence had been living in PR prose (`#2157` for the live apply
 pair), which no reader of the suite can see.
 
-One row per gated block below: what it proves, what gates it, the command,
-and the last binary and emulator it is known to have passed against.
+Ten sections below cover the eleven blocks, one section per block except
+section 6, where `plan-read.acceptance.test.ts`'s per-binary loop makes two
+blocks of one body. Each section says what the block proves, what gates it,
+the command, and the last binary and emulator it is known to have passed
+against, or "not recorded" when no run has been written down yet.
 
 `live-estate/README.md` next door is the sibling record for the two recorded
 documents (`../live-plan.json`, `../live-ls.json`) rather than for a suite,
@@ -31,7 +34,7 @@ same recipe one tag back
 `live/smoke/docker-compose.yml` and exported as
 `CHOUDOUFU_EMULATOR_ENDPOINT=http://localhost:<mapped port>`.
 
-## The four blocks
+## The eleven blocks
 
 ### 1. `TerraformApplyOp applies a real root`
 
@@ -52,7 +55,7 @@ npx vitest run lexicons/terraform/src/composites/terraform-apply-op.acceptance.t
 Last passed: 2026-09-08, `Terraform v1.15.8` on `darwin_arm64`, with
 `hashicorp/null` resolved from the public registry for the fixture's `~> 3.2`
 constraint. No emulator is involved. Re-run by chant #2241 alongside every
-other block in this file, so all four rows come from one run; #2168 had run it
+other block this file held then, so those four rows come from one run; #2168 had run it
 on 2026-09-07 the same way.
 
 ### 2. `TerraformApplyOp applies a live root against choudoufu's emulator`
@@ -172,7 +175,7 @@ path, which is the only thing it exists to prove.
 
 ### 5. `TerraformAdoptOp reaches its gate on a checkout that has never run init`
 
-Same file, third block (#2302). One test: build `TerraformAdoptOp` and drive
+Same file, second block (#2302). One test: build `TerraformAdoptOp` and drive
 it through `runOpLocally`, exactly as the apply Op's own acceptance suite
 does, over a project this test creates fresh and never initializes by hand —
 no `terraformInit` call anywhere in the block. The Op's own Init phase is what
@@ -215,7 +218,8 @@ With the Init phase back, the same run reaches its gate:
 
 `../plan-read.acceptance.test.ts`, one block per binary, three tests each, over
 the `plan-read/` fixture (built-in `terraform_data`, `local` backend, so no
-registry, no network and no credentials). The first reads the plan depth
+registry, no network and no credentials). Four tests each now; the run recorded
+below had three, before #4372 added the planned-create test. The first reads the plan depth
 through `describeResources` and checks the IR attributes, `sources` reading
 `"plan"`, no secret in the result, nothing new or changed in the root, and no
 `chant-terraform-plan-*` directory left in the temp dir. The second holds the
@@ -263,6 +267,64 @@ by chant #4371. Proved red the same day: with `plan-observation.ts`'s
 redaction put back to flagging each side by its own marks, the old secret
 came through as `tags.token`'s `before`.
 
+### 8. `Terragrunt units against a real terragrunt`
+
+`terragrunt/terragrunt.acceptance.test.ts` (#3414), four tests over the
+`terragrunt/five-units/` fixture (implicit stacks, `terraform_data` only,
+local state under the copied fixture, so no provider download and no cloud).
+It checks that `terragrunt` is 1.1 or later, that `discoverTerragruntUnits`
+lists what `terragrunt find` lists less the catalog template, that each of the
+three waves plans and applies exactly its own units and that the run report's
+per-unit results reach the change set with no input carrying a mock, and that
+a wave keeps to its units when a `.terragrunt-filters` file selects more.
+
+Gated on `terragrunt` and `tofu` on PATH.
+
+```
+npx vitest run lexicons/terraform/src/terragrunt/terragrunt.acceptance.test.ts
+```
+
+Last passed: not recorded. No run of this block has been written down; the
+maintainer records the first one here (maintainer run).
+
+### 9. `mock outputs in Terragrunt waves against a real terragrunt`
+
+`terragrunt/mocks.acceptance.test.ts` (#3416), one test over the same
+`five-units/` fixture. Wave 2 is refused until wave 1 has applied, naming each
+upstream and planning nothing. A provisional plan of wave 2 made before that
+reads the mocks, is marked provisional, matches Terragrunt's own mock warning,
+and is refused at apply. Once wave 1 applies, wave 2 plans on the real
+upstream values and applies.
+
+Gated on `terragrunt` and `tofu` on PATH.
+
+```
+npx vitest run lexicons/terraform/src/terragrunt/mocks.acceptance.test.ts
+```
+
+Last passed: not recorded. No run of this block has been written down; the
+maintainer records the first one here (maintainer run).
+
+### 10. `affected Terragrunt units against a real terragrunt`
+
+`terragrunt/affected.acceptance.test.ts` (#3415), over a git copy of the
+`terragrunt/affected/` fixture. One test checks discovery against
+`recorded/affected-find.json`; then one test per case in
+`__fixtures__/terragrunt/affected-cases.ts`, each made as a commit, checks that
+Terragrunt's own `[HEAD~1...HEAD]` filter selects exactly the case's
+`terragrunt` column (nothing, for the three supplements) and that
+`findTerragruntAffected` returns the case's expected units and reasons. Nothing
+is planned.
+
+Gated on `terragrunt` and `git` on PATH. It does not need `tofu`.
+
+```
+npx vitest run lexicons/terraform/src/terragrunt/affected.acceptance.test.ts
+```
+
+Last passed: not recorded. No run of this block has been written down; the
+maintainer records the first one here (maintainer run).
+
 ## Running everything that can run on a machine with no choudoufu
 
 ```

package/src/__fixtures__/compose/apply-failed-in-app.jsonl

@@ -0,0 +1,12 @@
+{"@level":"info","@message":"Terraform 1.10.5","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.101000Z","terraform":"1.10.5","type":"version","ui":"1.2"}
+{"@level":"info","@message":"module.net.terraform_data.vpc: Plan to update","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412000Z","change":{"resource":{"addr":"module.net.terraform_data.vpc","module":"module.net","resource":"terraform_data.vpc","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"vpc","resource_key":null},"action":"update"},"type":"planned_change"}
+{"@level":"info","@message":"module.app.terraform_data.service: Plan to create","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412100Z","change":{"resource":{"addr":"module.app.terraform_data.service","module":"module.app","resource":"terraform_data.service","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"service","resource_key":null},"action":"create"},"type":"planned_change"}
+{"@level":"info","@message":"module.app.module.logs.terraform_data.group: Plan to create","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412200Z","change":{"resource":{"addr":"module.app.module.logs.terraform_data.group","module":"module.app.module.logs","resource":"terraform_data.group","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"group","resource_key":null},"action":"create"},"type":"planned_change"}
+{"@level":"info","@message":"module.edge.terraform_data.dns: Plan to update","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412300Z","change":{"resource":{"addr":"module.edge.terraform_data.dns","module":"module.edge","resource":"terraform_data.dns","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"dns","resource_key":null},"action":"update"},"type":"planned_change"}
+{"@level":"info","@message":"Plan: 2 to add, 2 to change, 0 to destroy.","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.412400Z","changes":{"add":2,"change":2,"import":0,"remove":0,"operation":"apply"},"type":"change_summary"}
+{"@level":"info","@message":"module.net.terraform_data.vpc: Modifying... [id=6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01]","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.520000Z","hook":{"resource":{"addr":"module.net.terraform_data.vpc","module":"module.net","resource":"terraform_data.vpc","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"vpc","resource_key":null},"action":"update","id_key":"id","id_value":"6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01"},"type":"apply_start"}
+{"@level":"info","@message":"module.net.terraform_data.vpc: Modifications complete after 0s [id=6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01]","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.530000Z","hook":{"resource":{"addr":"module.net.terraform_data.vpc","module":"module.net","resource":"terraform_data.vpc","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"vpc","resource_key":null},"action":"update","id_key":"id","id_value":"6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01","elapsed_seconds":0},"type":"apply_complete"}
+{"@level":"info","@message":"module.app.terraform_data.service: Creating...","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.540000Z","hook":{"resource":{"addr":"module.app.terraform_data.service","module":"module.app","resource":"terraform_data.service","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"service","resource_key":null},"action":"create"},"type":"apply_start"}
+{"@level":"error","@message":"module.app.terraform_data.service: Creation errored after 0s","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.550000Z","hook":{"resource":{"addr":"module.app.terraform_data.service","module":"module.app","resource":"terraform_data.service","implied_provider":"terraform","resource_type":"terraform_data","resource_name":"service","resource_key":null},"action":"create","elapsed_seconds":0},"type":"apply_errored"}
+{"@level":"error","@message":"Error: Invalid input","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.551000Z","diagnostic":{"severity":"error","summary":"Invalid input","detail":"The service input is not a VPC id.\nCheck the vpc_id variable.","address":"module.app.terraform_data.service","range":{"filename":"../../roots/app/main.tf","start":{"line":1,"column":1,"byte":0},"end":{"line":1,"column":36,"byte":35}}},"type":"diagnostic"}
+{"@level":"error","@message":"Error: Provider produced inconsistent final plan","@module":"terraform.ui","@timestamp":"2026-10-25T12:05:00.552000Z","diagnostic":{"severity":"error","summary":"Provider produced inconsistent final plan","detail":"This is a bug in the provider."},"type":"diagnostic"}

package/src/__fixtures__/compose/state-app.json

@@ -0,0 +1,66 @@
+{
+  "version": 4,
+  "terraform_version": "1.10.5",
+  "serial": 3,
+  "lineage": "8d4e2f1a-3b5c-4d6e-9f7a-1c2b3d4e5f60",
+  "outputs": {
+    "service_id": {
+      "value": "0b7e4a2c-93d1-4f6e-a5b8-2c1d9e3f4a77",
+      "type": "string"
+    }
+  },
+  "resources": [
+    {
+      "module": "module.logs",
+      "mode": "managed",
+      "type": "terraform_data",
+      "name": "group",
+      "provider": "provider[\"terraform.io/builtin/terraform\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "a3c5e7f9-1b2d-4c6e-8a0b-3d5f7a9c1e2f",
+            "input": {
+              "value": "app-logs",
+              "type": "string"
+            },
+            "output": {
+              "value": "app-logs",
+              "type": "string"
+            },
+            "triggers_replace": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0
+        }
+      ]
+    },
+    {
+      "mode": "managed",
+      "type": "terraform_data",
+      "name": "service",
+      "provider": "provider[\"terraform.io/builtin/terraform\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "0b7e4a2c-93d1-4f6e-a5b8-2c1d9e3f4a77",
+            "input": {
+              "value": "6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01",
+              "type": "string"
+            },
+            "output": {
+              "value": "6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01",
+              "type": "string"
+            },
+            "triggers_replace": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}

package/src/__fixtures__/compose/state-edge.json

@@ -0,0 +1,40 @@
+{
+  "version": 4,
+  "terraform_version": "1.10.5",
+  "serial": 12,
+  "lineage": "c0ffee00-1234-4abc-8def-0123456789ab",
+  "outputs": {
+    "name": {
+      "value": "www",
+      "type": "string"
+    }
+  },
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "terraform_data",
+      "name": "dns",
+      "provider": "provider[\"terraform.io/builtin/terraform\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "1d9a0c55-77e2-4c1b-8f3a-5b6e2d4c7a10",
+            "input": {
+              "value": "www",
+              "type": "string"
+            },
+            "output": {
+              "value": "www",
+              "type": "string"
+            },
+            "triggers_replace": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}

package/src/__fixtures__/compose/state-net.json

@@ -0,0 +1,58 @@
+{
+  "version": 4,
+  "terraform_version": "1.10.5",
+  "serial": 7,
+  "lineage": "2b1f6c0a-6a1e-4c55-9f3d-7e0a1b2c3d4e",
+  "outputs": {
+    "vpc_id": {
+      "value": "6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01",
+      "type": "string"
+    }
+  },
+  "resources": [
+    {
+      "mode": "managed",
+      "type": "terraform_data",
+      "name": "vpc",
+      "provider": "provider[\"terraform.io/builtin/terraform\"]",
+      "instances": [
+        {
+          "schema_version": 0,
+          "attributes": {
+            "id": "6f2b6c1e-0c55-4f0b-9d4e-3a1c2b7d9e01",
+            "input": {
+              "value": {
+                "cidr": "10.0.0.0/16",
+                "name": "core"
+              },
+              "type": [
+                "object",
+                {
+                  "cidr": "string",
+                  "name": "string"
+                }
+              ]
+            },
+            "output": {
+              "value": {
+                "cidr": "10.0.0.0/16",
+                "name": "core"
+              },
+              "type": [
+                "object",
+                {
+                  "cidr": "string",
+                  "name": "string"
+                }
+              ]
+            },
+            "triggers_replace": null
+          },
+          "sensitive_attributes": [],
+          "identity_schema_version": 0
+        }
+      ]
+    }
+  ],
+  "check_results": null
+}