@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/src/__fixtures__/live-module-keyed/live-graph.json

@@ -0,0 +1,259 @@
+{
+  "version": 1,
+  "meta": {
+    "engineGraph": {
+      "format": 1,
+      "engine": {
+        "name": "choudoufu"
+      },
+      "scope": {
+        "kind": "estate",
+        "estate": "module-keyed-estate"
+      },
+      "markerScheme": {
+        "ownerKey": "tofu-estate",
+        "addressKey": "tofu-address",
+        "continuationKeys": [
+          "tofu-address-2",
+          "tofu-address-3",
+          "tofu-address-4"
+        ],
+        "encoding": {
+          "tags": "escaped",
+          "labels": "escaped"
+        }
+      }
+    }
+  },
+  "nodes": [
+    {
+      "id": "module.app.aws_cloudwatch_log_group.logs",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app.aws_cloudwatch_log_group.logs"
+      },
+      "sourceLoc": {
+        "file": "modules/app/main.tf",
+        "line": 15
+      }
+    },
+    {
+      "id": "module.app.aws_eip.pool",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app.aws_eip.pool"
+      },
+      "sourceLoc": {
+        "file": "modules/app/main.tf",
+        "line": 8
+      }
+    },
+    {
+      "id": "module.app[0].aws_cloudwatch_log_group.logs",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[0].aws_cloudwatch_log_group.logs"
+      },
+      "physicalId": "/module-keyed-estate/app-0",
+      "instanceOf": "module.app.aws_cloudwatch_log_group.logs",
+      "instanceScope": "module.app[0]",
+      "facts": {
+        "ownership": "bound",
+        "ownedBy": "name",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "/module-keyed-estate/app-0"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.app[0].aws_eip.pool[0]",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[0].aws_eip.pool[0]"
+      },
+      "physicalId": "eipalloc-0a41c7d2e9b3f5061",
+      "instanceOf": "module.app.aws_eip.pool",
+      "instanceKey": "[0]",
+      "instanceScope": "module.app[0]",
+      "facts": {
+        "ownership": "bound",
+        "markers": {
+          "owner": "module-keyed-estate",
+          "address": "module.app:0.aws_eip.pool:0",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "ownedBy": "marker",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "eipalloc-0a41c7d2e9b3f5061"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.app[0].aws_eip.pool[1]",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[0].aws_eip.pool[1]"
+      },
+      "physicalId": "eipalloc-0b52d8e3fac4061f2",
+      "instanceOf": "module.app.aws_eip.pool",
+      "instanceKey": "[1]",
+      "instanceScope": "module.app[0]",
+      "facts": {
+        "ownership": "bound",
+        "markers": {
+          "owner": "module-keyed-estate",
+          "address": "module.app:0.aws_eip.pool:1",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "ownedBy": "marker",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "eipalloc-0b52d8e3fac4061f2"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.app[1].aws_cloudwatch_log_group.logs",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[1].aws_cloudwatch_log_group.logs"
+      },
+      "instanceOf": "module.app.aws_cloudwatch_log_group.logs",
+      "instanceScope": "module.app[1]",
+      "facts": {
+        "ownership": "pending"
+      }
+    },
+    {
+      "id": "module.app[1].aws_eip.pool[0]",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[1].aws_eip.pool[0]"
+      },
+      "physicalId": "eipalloc-0c63e9f40bd5172a3",
+      "instanceOf": "module.app.aws_eip.pool",
+      "instanceKey": "[0]",
+      "instanceScope": "module.app[1]",
+      "facts": {
+        "ownership": "bound",
+        "markers": {
+          "owner": "module-keyed-estate",
+          "address": "module.app:1.aws_eip.pool:0",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "ownedBy": "marker",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "eipalloc-0c63e9f40bd5172a3"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.app[1].aws_eip.pool[1]",
+      "kind": "aws_eip",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.app[1].aws_eip.pool[1]"
+      },
+      "physicalId": "eipalloc-0d74fa051ce6283b4",
+      "instanceOf": "module.app.aws_eip.pool",
+      "instanceKey": "[1]",
+      "instanceScope": "module.app[1]",
+      "facts": {
+        "ownership": "bound",
+        "markers": {
+          "owner": "module-keyed-estate",
+          "address": "module.app:1.aws_eip.pool:1",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "ownedBy": "marker",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "eipalloc-0d74fa051ce6283b4"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.edge.aws_cloudwatch_log_group.front",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.edge.aws_cloudwatch_log_group.front"
+      },
+      "sourceLoc": {
+        "file": "modules/edge/main.tf",
+        "line": 5
+      }
+    },
+    {
+      "id": "module.edge[\"east\"].aws_cloudwatch_log_group.front",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.edge[\"east\"].aws_cloudwatch_log_group.front"
+      },
+      "physicalId": "/module-keyed-estate/edge-east",
+      "instanceOf": "module.edge.aws_cloudwatch_log_group.front",
+      "instanceScope": "module.edge[\"east\"]",
+      "facts": {
+        "ownership": "unowned",
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "/module-keyed-estate/edge-east"
+          }
+        ]
+      }
+    },
+    {
+      "id": "module.edge[\"west\"].aws_cloudwatch_log_group.front",
+      "kind": "aws_cloudwatch_log_group",
+      "lexicon": "terraform",
+      "attrs": {
+        "address": "module.edge[\"west\"].aws_cloudwatch_log_group.front"
+      },
+      "physicalId": "/module-keyed-estate/edge-west",
+      "instanceOf": "module.edge.aws_cloudwatch_log_group.front",
+      "instanceScope": "module.edge[\"west\"]",
+      "facts": {
+        "ownership": "foreign",
+        "markers": {
+          "owner": "other-estate",
+          "encoding": "escaped",
+          "source": "live"
+        },
+        "cloudIds": [
+          {
+            "kind": "import-id",
+            "value": "/module-keyed-estate/edge-west"
+          }
+        ]
+      }
+    }
+  ],
+  "edges": [],
+  "groups": {}
+}

package/src/__fixtures__/live-module-keyed/live-plan.json

@@ -0,0 +1,87 @@
+{
+  "estate": "module-keyed-estate",
+  "choudoufu_version": "",
+  "upstream_version": "1.13.0",
+  "bound": [
+    {
+      "addr": "module.app[0].aws_cloudwatch_log_group.logs",
+      "type": "aws_cloudwatch_log_group",
+      "identity": "/module-keyed-estate/app-0",
+      "identity_values": {
+        "name": "/module-keyed-estate/app-0"
+      },
+      "source": "derived"
+    },
+    {
+      "addr": "module.app[0].aws_eip.pool[0]",
+      "type": "aws_eip",
+      "identity": "eipalloc-0a41c7d2e9b3f5061",
+      "source": "marker"
+    },
+    {
+      "addr": "module.app[0].aws_eip.pool[1]",
+      "type": "aws_eip",
+      "identity": "eipalloc-0b52d8e3fac4061f2",
+      "source": "marker"
+    },
+    {
+      "addr": "module.app[1].aws_eip.pool[0]",
+      "type": "aws_eip",
+      "identity": "eipalloc-0c63e9f40bd5172a3",
+      "source": "marker"
+    },
+    {
+      "addr": "module.app[1].aws_eip.pool[1]",
+      "type": "aws_eip",
+      "identity": "eipalloc-0d74fa051ce6283b4",
+      "source": "marker"
+    }
+  ],
+  "omissions": [
+    {
+      "addr": "module.app[1].aws_cloudwatch_log_group.logs",
+      "reason": "ABSENT",
+      "detail": "The provider reports no aws_cloudwatch_log_group exists with identity \"/module-keyed-estate/app-1\", so this resource has not been created yet. The plan will propose creating it."
+    },
+    {
+      "addr": "module.edge[\"east\"].aws_cloudwatch_log_group.front",
+      "reason": "UNOWNED",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/module-keyed-estate/edge-east\" and carries no tofu-estate marker, so this estate does not own it and the plan proposes creating the resource this configuration declares - which, for a type whose name must be unique, the cloud will refuse while the unowned one holds it. Adopt it by writing tofu-estate=\"module-keyed-estate\" and tofu-address=\"module.edge:east.aws_cloudwatch_log_group.front\" onto it, then re-run; or set policy { declared_untagged = \"adopt\" } in the live block to have this run adopt it for you; or point this resource at a name nobody is using."
+    },
+    {
+      "addr": "module.edge[\"west\"].aws_cloudwatch_log_group.front",
+      "reason": "UNOWNED",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/module-keyed-estate/edge-west\" and carries tofu-estate=\"other-estate\", so it belongs to another estate and nothing in this plan reads, changes or destroys it. Taking it over is something you do deliberately: `live-mv -from-estate=other-estate` rewrites the marker to this estate one address at a time, and `live-import -approve` stamps this estate's markers over the resources a state file lists. Or point this resource at a name nobody is using. See live/MARKERS.md, \"Ownership semantics\"."
+    }
+  ],
+  "unowned": [
+    {
+      "addr": "module.edge[\"east\"].aws_cloudwatch_log_group.front",
+      "type": "aws_cloudwatch_log_group",
+      "identity": "/module-keyed-estate/edge-east",
+      "adopt_tofu_estate": "module-keyed-estate",
+      "adopt_tofu_address": "module.edge:east.aws_cloudwatch_log_group.front"
+    },
+    {
+      "addr": "module.edge[\"west\"].aws_cloudwatch_log_group.front",
+      "type": "aws_cloudwatch_log_group",
+      "identity": "/module-keyed-estate/edge-west",
+      "tofu_estate": "other-estate"
+    }
+  ],
+  "foreign": null,
+  "adoptable": [],
+  "swept": [],
+  "diagnostics": [
+    {
+      "severity": "warning",
+      "summary": "Live resource outside this estate",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/module-keyed-estate/edge-east\" and carries no tofu-estate marker, so this estate does not own it and the plan proposes creating the resource this configuration declares - which, for a type whose name must be unique, the cloud will refuse while the unowned one holds it. Adopt it by writing tofu-estate=\"module-keyed-estate\" and tofu-address=\"module.edge:east.aws_cloudwatch_log_group.front\" onto it, then re-run; or set policy { declared_untagged = \"adopt\" } in the live block to have this run adopt it for you; or point this resource at a name nobody is using."
+    },
+    {
+      "severity": "warning",
+      "summary": "Live resource outside this estate",
+      "detail": "A live aws_cloudwatch_log_group already exists with identity \"/module-keyed-estate/edge-west\" and carries tofu-estate=\"other-estate\", so it belongs to another estate and nothing in this plan reads, changes or destroys it. Taking it over is something you do deliberately: `live-mv -from-estate=other-estate` rewrites the marker to this estate one address at a time, and `live-import -approve` stamps this estate's markers over the resources a state file lists. Or point this resource at a name nobody is using. See live/MARKERS.md, \"Ownership semantics\"."
+    }
+  ]
+}

package/src/__fixtures__/live-module-keyed/root/estate.chdf.hcl

@@ -0,0 +1 @@
+estate = "module-keyed-estate"

package/src/__fixtures__/live-module-keyed/root/main.tf

@@ -0,0 +1,21 @@
+# Two expanded module calls, one per expansion form, so every address the
+# live-plan and state documents beside this directory carry is module-keyed
+# (chant #4513): `module.app[0].aws_eip.pool[1]`, `module.edge["east"]...`.
+#
+# The instance key reaches the child only through a variable, which is the
+# form choudoufu's identity resolver reads for a module call's count and
+# for_each (internal/live/identity/moduleforeachvar_test.go,
+# TestModuleCallCountVar and TestModuleCallForEachVar, testdata
+# module-count-var/ and module-foreach-var/).
+
+module "app" {
+  source = "./modules/app"
+  count  = 2
+  index  = count.index
+}
+
+module "edge" {
+  source   = "./modules/edge"
+  for_each = toset(["east", "west"])
+  zone     = each.key
+}

package/src/__fixtures__/live-module-keyed/root/modules/app/main.tf

@@ -0,0 +1,17 @@
+variable "index" {
+  type = number
+}
+
+# Expanded itself too, so its instances carry a key and a scope:
+# `module.app[1].aws_eip.pool[0]`. EC2 assigns the allocation id, so
+# choudoufu binds these by marker.
+resource "aws_eip" "pool" {
+  count  = 2
+  domain = "vpc"
+}
+
+# Not expanded itself: its instances carry a scope and no key. The name is
+# the identity, so choudoufu derives it from the configuration.
+resource "aws_cloudwatch_log_group" "logs" {
+  name = "/module-keyed-estate/app-${var.index}"
+}

package/src/__fixtures__/live-module-keyed/root/modules/edge/main.tf

@@ -0,0 +1,7 @@
+variable "zone" {
+  type = string
+}
+
+resource "aws_cloudwatch_log_group" "front" {
+  name = "/module-keyed-estate/edge-${var.zone}"
+}

package/src/__fixtures__/live-module-keyed/root/versions.tf

@@ -0,0 +1,30 @@
+# Provider wiring, copied from ../../live-estate/versions.tf (itself derived
+# from choudoufu's live/e2e/estate-block/versions.tf). The estate name is in
+# the estate.chdf.hcl sidecar beside this file, as in live-estate/.
+#
+# Same environment-variable wiring as choudoufu's own fixture
+# (AWS_ENDPOINT_URL, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION);
+# the provider block carries only the flags with no env-var form.
+
+terraform {
+  required_version = ">= 1.5.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "= 6.58.0"
+    }
+  }
+}
+
+provider "aws" {
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+
+  # skip_requesting_account_id deliberately absent — same rationale as the
+  # main estate's versions.tf (live/e2e/estate/versions.tf): letting the
+  # provider resolve the account keeps tag-filtered discovery honest about
+  # what real AWS would do.
+
+  s3_use_path_style = true
+}

package/src/__fixtures__/live-module-keyed/show-state.json

@@ -0,0 +1,146 @@
+{
+  "format_version": "1.0",
+  "terraform_version": "1.13.0",
+  "values": {
+    "root_module": {
+      "child_modules": [
+        {
+          "resources": [
+            {
+              "address": "module.app[0].aws_cloudwatch_log_group.logs",
+              "mode": "managed",
+              "type": "aws_cloudwatch_log_group",
+              "name": "logs",
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "arn": "arn:aws:logs:us-east-1:000000000000:log-group:/module-keyed-estate/app-0",
+                "id": "/module-keyed-estate/app-0",
+                "name": "/module-keyed-estate/app-0"
+              },
+              "sensitive_values": {}
+            },
+            {
+              "address": "module.app[0].aws_eip.pool[0]",
+              "mode": "managed",
+              "type": "aws_eip",
+              "name": "pool",
+              "index": 0,
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "allocation_id": "eipalloc-0a41c7d2e9b3f5061",
+                "domain": "vpc",
+                "id": "eipalloc-0a41c7d2e9b3f5061"
+              },
+              "sensitive_values": {}
+            },
+            {
+              "address": "module.app[0].aws_eip.pool[1]",
+              "mode": "managed",
+              "type": "aws_eip",
+              "name": "pool",
+              "index": 1,
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "allocation_id": "eipalloc-0b52d8e3fac4061f2",
+                "domain": "vpc",
+                "id": "eipalloc-0b52d8e3fac4061f2"
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.app[0]"
+        },
+        {
+          "resources": [
+            {
+              "address": "module.app[1].aws_cloudwatch_log_group.logs",
+              "mode": "managed",
+              "type": "aws_cloudwatch_log_group",
+              "name": "logs",
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "arn": "arn:aws:logs:us-east-1:000000000000:log-group:/module-keyed-estate/app-1",
+                "id": "/module-keyed-estate/app-1",
+                "name": "/module-keyed-estate/app-1"
+              },
+              "sensitive_values": {}
+            },
+            {
+              "address": "module.app[1].aws_eip.pool[0]",
+              "mode": "managed",
+              "type": "aws_eip",
+              "name": "pool",
+              "index": 0,
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "allocation_id": "eipalloc-0c63e9f40bd5172a3",
+                "domain": "vpc",
+                "id": "eipalloc-0c63e9f40bd5172a3"
+              },
+              "sensitive_values": {}
+            },
+            {
+              "address": "module.app[1].aws_eip.pool[1]",
+              "mode": "managed",
+              "type": "aws_eip",
+              "name": "pool",
+              "index": 1,
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "allocation_id": "eipalloc-0d74fa051ce6283b4",
+                "domain": "vpc",
+                "id": "eipalloc-0d74fa051ce6283b4"
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.app[1]"
+        },
+        {
+          "resources": [
+            {
+              "address": "module.edge[\"east\"].aws_cloudwatch_log_group.front",
+              "mode": "managed",
+              "type": "aws_cloudwatch_log_group",
+              "name": "front",
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "arn": "arn:aws:logs:us-east-1:000000000000:log-group:/module-keyed-estate/edge-east",
+                "id": "/module-keyed-estate/edge-east",
+                "name": "/module-keyed-estate/edge-east"
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.edge[\"east\"]"
+        },
+        {
+          "resources": [
+            {
+              "address": "module.edge[\"west\"].aws_cloudwatch_log_group.front",
+              "mode": "managed",
+              "type": "aws_cloudwatch_log_group",
+              "name": "front",
+              "provider_name": "registry.opentofu.org/hashicorp/aws",
+              "schema_version": 0,
+              "values": {
+                "arn": "arn:aws:logs:us-east-1:000000000000:log-group:/module-keyed-estate/edge-west",
+                "id": "/module-keyed-estate/edge-west",
+                "name": "/module-keyed-estate/edge-west"
+              },
+              "sensitive_values": {}
+            }
+          ],
+          "address": "module.edge[\"west\"]"
+        }
+      ]
+    }
+  }
+}

package/src/__fixtures__/pr-loop/README.md

@@ -0,0 +1,50 @@
+# pr-loop: five roots through the pull-request loop
+
+The workspace `../../components/pr-loop.tofu.test.ts` runs through
+`chant components pr-plan` and `chant components pr-apply` over real `tofu`
+(or `terraform`). Every root uses `terraform_data` with local state, so
+nothing downloads a provider or reaches a cloud.
+
+The estate is net -> a, b and a -> app, with dns on its own. a and b read
+net's `cidr`, and app reads a's `id`, through `stackOutput()` in
+`estate.component.ts`. a's `id` is `terraform_data.subnet.output`, which is
+known only after a applies, so on a pull request that changes a, app sits
+outside any group with an unknown upstream read and is previewed with a
+placeholder for `var.subnet` (chant#4463).
+
+What happens on merge depends on the value a applies with:
+
+- A pull request that changes a's subnet suffix from `a-v1` to `a-v2`: app's
+  real plan, made once a applied, is the update the preview showed with
+  `a.id` filled in. The first approval covers it and both roots apply in one
+  run. This is the single-approval path.
+- A pull request that changes it to `a-wide`: app's `wide` resource has
+  `count = local.wide`, and `local.wide` reads `var.subnet` through a local,
+  which the preview does not follow. The stand-in does not end in `-wide`, so
+  the preview plans no `terraform_data.wide`. The real id does, so the real
+  plan also creates `terraform_data.wide[0]`. That exceeds the preview, so
+  app's round 2 is not covered and waits on its own `pr-apply-round-2` gate
+  (chant#4487).
+
+`chant.config.json` names `tofu`; the test writes its own with whichever
+binary is on PATH.
+
+## The recorded pull-request run for chant#4463
+
+chant#4463's maintainer run uses this fixture, on the `a-v2` path. In a scratch
+directory:
+
+1. Copy this directory, `git init -b main`, add a `.gitignore` with
+   `node_modules`, `.terraform`, `.terraform.lock.hcl`, `*.tfstate*`,
+   `chant.tfplan` and `.chant`, and commit.
+2. Apply the base once: write `all.json` as `{"changed":["net","dns"]}` and run
+   `chant components fan-out --from-affected all.json`.
+3. On a branch, change `a-v1` to `a-v2` in `roots/a/main.tf`, commit, and run
+   `chant components pr-plan --base main --pr <n> --forge github` on the pull
+   request. The note's app row says `previewed with placeholders for var.subnet`.
+4. Approve the digest the note names, merge, and run
+   `chant components pr-apply --base <main before the merge> --forge github --require-review`.
+   Both roots apply in one run, and the note says app's round was covered by
+   the first approval with `a.id` filled in.
+
+Record the note and the apply's output on chant#4463.

package/src/__fixtures__/pr-loop/chant.config.json

@@ -0,0 +1,13 @@
+{
+  "lexicons": ["terraform"],
+  "terraform": {
+    "binary": "tofu",
+    "roots": {
+      "net": { "dir": "roots/net" },
+      "a": { "dir": "roots/a" },
+      "b": { "dir": "roots/b" },
+      "app": { "dir": "roots/app" },
+      "dns": { "dir": "roots/dns" }
+    }
+  }
+}

package/src/__fixtures__/pr-loop/estate.component.ts

@@ -0,0 +1,10 @@
+import { phase, stackOutput, type Component } from "@intentius/chant/components";
+
+const apply = (root: string, vars?: Record<string, unknown>) =>
+  [phase("Apply", [{ kind: "terraform-apply", root, noRollback: "test roots with local state", vars: vars ?? {} }])];
+
+export const net: Component = { name: "net", dependsOn: [], deploy: apply("net") };
+export const a: Component = { name: "a", dependsOn: ["net"], deploy: apply("a", { cidr: stackOutput("net", "cidr") }) };
+export const b: Component = { name: "b", dependsOn: ["net"], deploy: apply("b", { cidr: stackOutput("net", "cidr") }) };
+export const app: Component = { name: "app", dependsOn: ["a"], deploy: apply("app", { subnet: stackOutput("a", "id") }) };
+export const dns: Component = { name: "dns", dependsOn: [], deploy: apply("dns") };

package/src/__fixtures__/pr-loop/roots/a/main.tf

@@ -0,0 +1,11 @@
+variable "cidr" {
+  type = string
+}
+
+resource "terraform_data" "subnet" {
+  input = "${var.cidr}/a-v1"
+}
+
+output "id" {
+  value = terraform_data.subnet.output
+}