@intentius/chant-lexicon-terraform 0.124.52 → 0.124.55

package/src/hcl/parse.test.ts

@@ -1,5 +1,10 @@
+import { readdirSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
 import { describe, test, expect } from "vitest";
-import { blocksToEntities, type TerraformEntity } from "./parse";
+import type { Declarable } from "@intentius/chant/declarable";
+import { blocksToEntities, jsonConfigTree, parseTerraformRootContent, parseTerraformRootDir, type TerraformEntity } from "./parse";
+import { terraformPlugin } from "../plugin";
 
 describe("blocksToEntities: suppression attachment (chant #2111)", () => {
   test("attaches the block's start line even with no suppression comment", async () => {
@@ -92,3 +97,136 @@ describe("Terragrunt config files (#3417)", () => {
     expect([...entities.values()].map((e) => e.entityType)).toEqual(["Terraform::Terraform"]);
   });
 });
+
+// ── chant#4457: `.tf.json` and `.tofu` files ───────────────────────────────
+
+describe("configuration files beyond `.tf` (chant#4457)", () => {
+  const configFiles = join(dirname(fileURLToPath(import.meta.url)), "..", "__fixtures__", "config-files");
+  const at = (name: string): string => join(configFiles, name);
+
+  /** What the acceptance compares: each entity's type, address, body and file. */
+  const shape = (entities: Map<string, Declarable>): Record<string, { type: string; address: string; body: unknown; file: string }> =>
+    Object.fromEntries(
+      [...entities].map(([key, e]) => {
+        const p = (e as TerraformEntity).props;
+        return [key, { type: e.entityType, address: p.address, body: p.body, file: p.file }];
+      }),
+    );
+  /** The same, with each file's suffix taken off so two syntaxes of one file compare equal. */
+  const sameFile = (entities: Map<string, Declarable>, suffix: string) =>
+    Object.fromEntries(Object.entries(shape(entities)).map(([k, v]) => [k, { ...v, file: v.file.replace(suffix, "") }]));
+
+  test("a block in main.tf.json is the entity the same block in main.tf is", async () => {
+    const tf = await parseTerraformRootDir(at("tf"), "app");
+    const json = await parseTerraformRootDir(at("tf-json"), "app");
+    expect(Object.keys(shape(json)).sort()).toEqual(["app/aws_s3_bucket.assets", "app/var.region"]);
+    expect(shape(json)["app/aws_s3_bucket.assets"]).toEqual({ ...shape(tf)["app/aws_s3_bucket.assets"], file: "main.tf.json" });
+    expect(sameFile(json, ".tf.json")).toEqual(sameFile(tf, ".tf"));
+  });
+
+  test("a main.tofu and a main.tofu.json root yields its entities under tofu and choudoufu", async () => {
+    const tf = sameFile(await parseTerraformRootDir(at("tf"), "app"), ".tf");
+    for (const binary of ["tofu", "choudoufu", "/usr/local/bin/tofu"]) {
+      expect(sameFile(await parseTerraformRootDir(at("tofu"), "app", undefined, { binary }), ".tofu")).toEqual(tf);
+      expect(sameFile(await parseTerraformRootDir(at("tofu-json"), "app", undefined, { binary }), ".tofu.json")).toEqual(tf);
+    }
+  });
+
+  test("a terraform root, or one with no binary set, reads no .tofu file", async () => {
+    expect((await parseTerraformRootDir(at("tofu"), "app", undefined, { binary: "terraform" })).size).toBe(0);
+    expect((await parseTerraformRootDir(at("tofu-json"), "app")).size).toBe(0);
+  });
+
+  test("x.tofu shadows x.tf in a tofu or choudoufu root, and a terraform root reads x.tf", async () => {
+    for (const binary of ["tofu", "choudoufu"]) {
+      const keys = [...(await parseTerraformRootDir(at("shadow"), "app", undefined, { binary })).keys()].sort();
+      expect(keys).toEqual(["app/aws_s3_bucket.from_tofu", "app/output.kept"]);
+    }
+    const keys = [...(await parseTerraformRootDir(at("shadow"), "app", undefined, { binary: "terraform" })).keys()].sort();
+    expect(keys).toEqual(["app/aws_s3_bucket.from_tf", "app/output.kept"]);
+  });
+
+  test("a root whose only declaration is in a .tofu file builds its entities through buildRoots()", async () => {
+    const hook = terraformPlugin.buildRoots!;
+    const config = (binary: string) => ({ terraform: { binary, roots: { only: { dir: "tofu-only" } } } });
+    const tofu = await hook({ projectRoot: configFiles, config: config("tofu"), entities: new Map() });
+    expect([...tofu.entities.keys()]).toEqual(["only/aws_s3_bucket.only"]);
+    expect(((tofu.entities.get("only/aws_s3_bucket.only") as TerraformEntity).props).file).toBe("main.tofu");
+    const terraform = await hook({ projectRoot: configFiles, config: config("terraform"), entities: new Map() });
+    expect(terraform.entities.size).toBe(0);
+  });
+
+  /** The joined form `chant audit` builds for a directory, every file behind a `# file:` line. */
+  const bundle = (dir: string): string =>
+    readdirSync(dir)
+      .sort()
+      .map((name) => `# file: ${name}\n${readFileSync(join(dir, name), "utf-8")}`)
+      .join("\n");
+
+  test("the audit path sees the entities the build path sees for each fixture", async () => {
+    for (const [name, binary] of [
+      ["tf", undefined],
+      ["tf-json", undefined],
+      ["tofu", "tofu"],
+      ["tofu-json", "tofu"],
+      ["tofu-only", "choudoufu"],
+      ["shadow", "tofu"],
+      ["shadow", "terraform"],
+    ] as const) {
+      const opts = binary ? { binary } : undefined;
+      const built = shape(await parseTerraformRootDir(at(name), "app", undefined, opts));
+      const audited = shape(await parseTerraformRootContent(bundle(at(name)), "app", undefined, opts));
+      expect(audited).toEqual(built);
+    }
+  });
+
+  test("the audit hook reads a root carrying a .tofu file as a tofu root", async () => {
+    const entities = await terraformPlugin.auditEntities!(bundle(at("shadow")));
+    expect([...entities.keys()].sort()).toEqual(["audit-root/aws_s3_bucket.from_tofu", "audit-root/output.kept"]);
+  });
+});
+
+describe("jsonConfigTree: Terraform's JSON syntax in hcl2json's shape (chant#4457)", () => {
+  test("wraps each block body in an array, one object level per label", () => {
+    const tree = jsonConfigTree(
+      JSON.stringify({
+        "//": "a comment Terraform ignores",
+        terraform: { required_version: ">= 1.5", backend: { s3: { bucket: "b", key: "k" } }, required_providers: { aws: { source: "hashicorp/aws" } } },
+        locals: { a: 1 },
+        provider: { aws: [{ region: "us-east-1" }, { alias: "west", region: "us-west-2" }] },
+        resource: { aws_instance: { web: { ami: "x", lifecycle: { create_before_destroy: true } } } },
+        data: { aws_ami: { ubuntu: { most_recent: true } } },
+      }),
+    );
+    expect(tree).toEqual({
+      terraform: [{ required_version: ">= 1.5", backend: { s3: [{ bucket: "b", key: "k" }] }, required_providers: [{ aws: { source: "hashicorp/aws" } }] }],
+      locals: [{ a: 1 }],
+      provider: { aws: [{ region: "us-east-1" }, { alias: "west", region: "us-west-2" }] },
+      resource: { aws_instance: { web: [{ ami: "x", lifecycle: [{ create_before_destroy: true }] }] } },
+      data: { aws_ami: { ubuntu: [{ most_recent: true }] } },
+    });
+  });
+
+  test("a live block in a .tf.json terraform block declares the estate", async () => {
+    const source = JSON.stringify({ terraform: { live: { estate: "prod" } } });
+    const entities = await blocksToEntities([{ name: "main.tf.json", source }], "app", undefined, { binary: "choudoufu" });
+    const live = entities.get("app/live") as TerraformEntity;
+    expect(live.props.mode).toBe("live");
+    expect(live.props.estate).toBe("prod");
+  });
+
+  test("a bare expression JSON writes in a string reads as hcl2json writes the expression", () => {
+    const tree = jsonConfigTree(
+      JSON.stringify({
+        variable: { region: { type: "string" } },
+        resource: { aws_instance: { web: { provider: "aws.west", depends_on: ["aws_vpc.main"], ami: "${var.ami}" } } },
+      }),
+    );
+    expect(tree.variable).toEqual({ region: [{ type: "${string}" }] });
+    expect(tree.resource).toEqual({ aws_instance: { web: [{ provider: "${aws.west}", depends_on: ["${aws_vpc.main}"], ami: "${var.ami}" }] } });
+  });
+
+  test("malformed JSON throws, as malformed HCL does", () => {
+    expect(() => jsonConfigTree("{ not json")).toThrow();
+  });
+});

package/src/hcl/parse.ts

@@ -1,11 +1,13 @@
 /**
  * The one shared HCL parse for the terraform lexicon.
  *
- * Two entry points, one entity shape. `parseTerraformRootDir` reads the `.tf`
- * files of a directory (non-recursive, matching Terraform's own module
- * scoping) and is what `buildRoots()` calls. `parseTerraformRootContent` takes
- * the joined-file string `chant audit` hands a lexicon for a discovered root
- * module: every `.tf` in filename order behind a `# file: <name>` line comment.
+ * Two entry points, one entity shape. `parseTerraformRootDir` reads the
+ * configuration files of a directory (non-recursive, matching Terraform's own
+ * module scoping; `.tf` and `.tf.json`, plus `.tofu` and `.tofu.json` for a
+ * tofu or choudoufu root, see `./files.ts`) and is what `buildRoots()` calls.
+ * `parseTerraformRootContent` takes the joined-file string `chant audit` hands
+ * a lexicon for a discovered root module: every configuration file in filename
+ * order behind a `# file: <name>` line comment, narrowed to the same set.
  * Both funnel through `blocksToEntities`, so an entity the audit path sees is
  * the entity the build path sees.
  *
@@ -18,7 +20,7 @@
  * changed in `packages/core/package.json` for this.
  */
 
-import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { loadHcl2json, type Hcl2Json } from "@intentius/chant/terraform/hcl2json";
 import { DECLARABLE_MARKER, type Declarable } from "@intentius/chant/declarable";
@@ -27,6 +29,20 @@ import type { SuppressionDirective } from "@intentius/chant/lint/suppressions";
 import type { TerraformDeleteMode } from "../config";
 import { redactSensitiveBody, redactSensitiveSource } from "./redact";
 import { scanSuppressions, directivesFor, type FileScan } from "./suppressions";
+import { isJsonConfigFile, jsonConfigTree, listConfigFiles, selectConfigFiles } from "./files";
+
+export {
+  TERRAFORM_SUFFIXES,
+  TOFU_SUFFIXES,
+  isConfigFileFor,
+  isJsonConfigFile,
+  isTofuConfigFile,
+  jsonConfigTree,
+  listConfigFiles,
+  listConfigFilesSafe,
+  readsTofuFiles,
+  selectConfigFiles,
+} from "./files";
 
 /** A parsed HCL block body, as `@cdktn/hcl2json` encodes it. */
 export type BlockBody = Record<string, unknown>;
@@ -40,6 +56,10 @@ export type BlockBody = Record<string, unknown>;
  * the instance count is a plan-time answer and often a state-time one, but it
  * is a shape a reader should be told rather than left to infer from a node
  * count that never grows.
+ *
+ * Since #4454 a literal expansion also gets its instance nodes, children of
+ * the block's node (`TerraformEntity.instanceKeys`). The block node stays,
+ * and the edges stay block to block.
  */
 export type TerraformExpansion = "count" | "for_each";
 
@@ -151,6 +171,27 @@ export interface TerraformEntity extends Declarable {
    * ROOT's name, not the module's: the module is not separately applied.
    */
   readonly stack: string;
+  /**
+   * The instance keys a `resource` or `data` block's literal `count` or
+   * `for_each` expands to (#4454), as Terraform prints them: `[0]`, `[1]`
+   * for `count = 2`, `["a"]` for a `for_each` over a literal map or
+   * `toset([...])`. Core's `withInstanceNodes` reads this lexicon-neutral
+   * field, as `buildGraphIr` reads `stack`, and draws one instance node per
+   * key under the block's node. Absent when the block is not expanded or its
+   * expansion is not a literal. Since #4486 `./instances.ts` also sets it
+   * for an expansion it can count from the root's variables (`count = var.n`
+   * with `n` known), and for a `module` call.
+   */
+  readonly instanceKeys?: readonly string[];
+  /**
+   * The instance nodes of a block under an expanded module call (#4486), by
+   * full node id: `estate/module.app[0]/aws_eip.pool[1]`, with `key` the
+   * block's own key (`[1]`, absent when the block is not expanded itself)
+   * and `scope` the module path as Terraform prints it (`module.app[0]`).
+   * Core's `entityInstances` reads this in place of `instanceKeys`, which
+   * such a block never carries. Set by `./instances.ts`.
+   */
+  readonly instances?: ReadonlyArray<{ readonly id: string; readonly key?: string; readonly scope?: string }>;
   /**
    * Every reference in this block, resolved to the entity keys it points at
    * (chant #2265), in core's lexicon-neutral {@link EntityReference} shape.
@@ -183,6 +224,23 @@ export const OUTPUT_TYPE = "Terraform::Output";
 export const LOCALS_TYPE = "Terraform::Locals";
 /** A `live { estate = "..." }` block, or an `estate.chdf.hcl` sidecar's content (#2103). */
 export const LIVE_TYPE = "Terraform::Live";
+/**
+ * The four configuration blocks that change how a plan treats addresses
+ * rather than declaring anything (#4458): `moved`, `import`, `removed` and
+ * `check`. The first three carry no label and key as `moved`, `import`,
+ * `removed` (numbered `~2`, `~3` when a root holds several, as `locals` is);
+ * a `check` keys as `check.<name>`. Their references are edges like any other
+ * block's: a `moved` block's `from` and `to`, an `import` block's `to`, a
+ * `removed` block's `from`, and everything a `check` block's assertions and
+ * scoped `data` blocks read. A `from` usually names an address that is no
+ * longer declared, which resolves to no entity and so draws no edge, and
+ * that is all that happens: an unresolved reference is dropped, never
+ * reported (`./edges.ts`).
+ */
+export const MOVED_TYPE = "Terraform::Moved";
+export const IMPORT_TYPE = "Terraform::Import";
+export const REMOVED_TYPE = "Terraform::Removed";
+export const CHECK_TYPE = "Terraform::Check";
 
 /**
  * Terragrunt config entities (#3417). A `terragrunt.hcl` or `root.hcl` is not
@@ -214,6 +272,55 @@ function expansionOf(body: BlockBody): TerraformExpansion | undefined {
   return undefined;
 }
 
+/** The most instance keys read off one literal; past it the block draws as the block alone. */
+const MAX_LITERAL_INSTANCES = 256;
+
+/**
+ * The instance keys a literal expansion gives (#4454), as Terraform prints
+ * them, or undefined when the expansion is not a literal a read of the
+ * source can count. `count` as a number (`count = 3`), `for_each` as a
+ * literal map (`{ a = 1 }`, keys in Terraform's lexical order) or
+ * `toset([...])` over string literals. Anything holding a reference is a
+ * plan-time answer.
+ */
+export function literalInstanceKeys(body: BlockBody): string[] | undefined {
+  const keys = literalKeys(body);
+  if (keys === undefined || keys.length > MAX_LITERAL_INSTANCES) return undefined;
+  return keys;
+}
+
+function literalKeys(body: BlockBody): string[] | undefined {
+  if ("count" in body) {
+    const count = body.count;
+    const n = typeof count === "number" ? count
+      : typeof count === "string" && /^\$\{\s*\d+\s*\}$/.test(count.trim()) ? Number(count.trim().slice(2, -1))
+      : undefined;
+    if (n === undefined || !Number.isInteger(n) || n < 0) return undefined;
+    return Array.from({ length: n }, (_, i) => `[${i}]`);
+  }
+  if ("for_each" in body) {
+    const each = body.for_each;
+    if (typeof each === "object" && each !== null && !Array.isArray(each)) {
+      const names = Object.keys(each);
+      if (names.some((k) => k.includes("${"))) return undefined;
+      return names.sort().map((k) => `[${JSON.stringify(k)}]`);
+    }
+    if (typeof each === "string") {
+      const m = /^\$\{\s*toset\(\s*(\[[\s\S]*\])\s*\)\s*\}$/.exec(each.trim());
+      if (!m) return undefined;
+      let list: unknown;
+      try {
+        list = JSON.parse(m[1]!.replace(/,\s*\]$/, "]"));
+      } catch {
+        return undefined;
+      }
+      if (!Array.isArray(list) || !list.every((v) => typeof v === "string")) return undefined;
+      return [...new Set(list as string[])].sort().map((k) => `[${JSON.stringify(k)}]`);
+    }
+  }
+  return undefined;
+}
+
 /**
  * Build one entity. Written out rather than run through `createResource`
  * from `@intentius/chant/runtime`: that factory is for generated resource
@@ -234,6 +341,7 @@ export function terraformEntity(
   suppressions?: readonly SuppressionDirective[],
 ): TerraformEntity {
   const expansion = expansionOf(body);
+  const instanceKeys = expansion && (entityType === RESOURCE_TYPE || entityType === DATA_TYPE) ? literalInstanceKeys(body) : undefined;
   const labels = entityType === RESOURCE_TYPE ? blockLabels(address)
     : entityType === DATA_TYPE && address.startsWith("data.") ? blockLabels(address.slice("data.".length))
     : undefined;
@@ -243,6 +351,7 @@ export function terraformEntity(
     entityType,
     kind: "resource",
     stack: root,
+    ...(instanceKeys ? { instanceKeys } : {}),
     props: {
       address,
       ...(labels ?? {}),
@@ -302,11 +411,20 @@ export function splitBundleContent(content: string, fallbackName = "main.tf"): T
   return files.filter((f) => f.source.trim() !== "");
 }
 
-/** Every `.tf` directly under `dir`, in filename order. Non-recursive. */
-export function listTerraformFiles(dir: string): string[] {
-  return readdirSync(dir)
-    .filter((f) => f.endsWith(".tf"))
-    .sort();
+/**
+ * Every configuration file directly under `dir` that a root run by `binary`
+ * reads, in filename order, non-recursive: `.tf` and `.tf.json`, plus `.tofu`
+ * and `.tofu.json` for a tofu or choudoufu root, with `x.tofu` shadowing
+ * `x.tf` (chant#4457). The shared lister is `./files.ts`'s `listConfigFiles`.
+ */
+export function listTerraformFiles(dir: string, binary?: string): string[] {
+  return listConfigFiles(dir, binary);
+}
+
+/** One file's tree in hcl2json's shape: hcl2json for HCL, {@link jsonConfigTree} for Terraform's JSON syntax. */
+export async function parseFileTree(parser: Hcl2Json, file: TerraformFile): Promise<Record<string, unknown>> {
+  if (isJsonConfigFile(file.name)) return jsonConfigTree(file.source);
+  return (await parser.parse(file.name, file.source)) as Record<string, unknown>;
 }
 
 /** The Terragrunt config files directly under `dir` (`root.hcl`, `terragrunt.hcl`), in filename order like the audit's bundle. */
@@ -488,7 +606,7 @@ export async function blocksToEntities(
   };
 
   for (const file of files) {
-    const tree = (await parser.parse(file.name, file.source)) as Record<string, unknown>;
+    const tree = await parseFileTree(parser, file);
     const scan = scanSuppressions(file.name, file.source);
     if (isTerragruntFileName(file.name)) {
       terragruntBlocks(tree, file, scan, add);
@@ -503,6 +621,10 @@ export async function blocksToEntities(
     oneLabel(tree, "output", OUTPUT_TYPE, (n) => `output.${n}`, file, scan);
     twoLabels(tree, "resource", RESOURCE_TYPE, (t, n) => `${t}.${n}`, file, scan);
     twoLabels(tree, "data", DATA_TYPE, (t, n) => `data.${t}.${n}`, file, scan);
+    unlabelled(tree, "moved", MOVED_TYPE, file, scan);
+    unlabelled(tree, "import", IMPORT_TYPE, file, scan);
+    unlabelled(tree, "removed", REMOVED_TYPE, file, scan);
+    oneLabel(tree, "check", CHECK_TYPE, (n) => `check.${n}`, file, scan);
   }
 
   if (sidecar) {
@@ -568,8 +690,9 @@ function terragruntBlocks(
 }
 
 /**
- * Parse a root module directory. Reads every `.tf` directly under `dir`, plus
- * the `estate.chdf.hcl` sidecar beside them when present. Throws whatever the
+ * Parse a root module directory. Reads the configuration files directly under
+ * `dir` that `modeOptions.binary` reads ({@link listTerraformFiles}), plus the
+ * `estate.chdf.hcl` sidecar beside them when present. Throws whatever the
  * parser throws for malformed HCL; `buildRoots()` is where that becomes a
  * warning.
  */
@@ -581,7 +704,7 @@ export async function parseTerraformRootDir(
   callers: readonly string[] = [],
 ): Promise<Map<string, Declarable>> {
   // A child module is a Terraform module, never a Terragrunt unit (#3417).
-  const names = [...listTerraformFiles(dir), ...(callers.length === 0 ? listTerragruntFiles(dir) : [])];
+  const names = [...listTerraformFiles(dir, modeOptions?.binary), ...(callers.length === 0 ? listTerragruntFiles(dir) : [])];
   const files = names.map((name) => ({
     name,
     source: readFileSync(join(dir, name), "utf-8"),
@@ -610,7 +733,17 @@ export async function parseTerraformRootContent(
   hcl2json?: Hcl2Json,
   modeOptions?: TerraformRootModeOptions,
 ): Promise<Map<string, Declarable>> {
-  return blocksToEntities(splitBundleContent(content), root, hcl2json, modeOptions);
+  return blocksToEntities(bundleFilesFor(splitBundleContent(content), modeOptions?.binary), root, hcl2json, modeOptions);
+}
+
+/**
+ * The files of a joined bundle a root run by `binary` reads: the same set
+ * {@link listTerraformFiles} gives for a directory holding them, plus the
+ * Terragrunt files, in bundle order (chant#4457).
+ */
+export function bundleFilesFor(files: readonly TerraformFile[], binary?: string): TerraformFile[] {
+  const keep = new Set(selectConfigFiles(files.map((f) => f.name), binary));
+  return files.filter((f) => keep.has(f.name) || isTerragruntFileName(f.name));
 }
 
 /** The root name an audit of the audited directory itself parses under. */

package/src/hcl/roots.ts

@@ -34,6 +34,7 @@ import type { TerraformRootConfig } from "../config";
 import { LIVE_TYPE, parseTerraformRootDir } from "./parse";
 import { descendModules, resolveCallModuleType, type CallModuleType } from "./descend";
 import { resolveEntityReferences } from "./edges";
+import { resolveInstanceNodes } from "./instances";
 
 export interface TerraformRootsResult {
   entities: Map<string, Declarable>;
@@ -111,6 +112,11 @@ export async function renderTerraformRoots(
       for (const [key, entity] of descended.entities) entities.set(key, entity);
       warnings.push(...descended.warnings);
 
+      // Instance nodes the root's variables let the declared graph count,
+      // and those under expanded module calls (#4486). Needs the root and
+      // every child scope parsed, so it runs once the descent has.
+      await resolveInstanceNodes(entities, name, { dir, ...(root.varFiles ? { varFiles: root.varFiles } : {}), hcl2json: opts.hcl2json });
+
       // A `live` block or `estate.chdf.hcl` sidecar only takes effect under
       // choudoufu; under any other binary it parses fine but is inert, which
       // is worth a warning rather than silence (#2103).

package/src/hcl/suppressions.ts

@@ -27,9 +27,9 @@
 import type { SuppressionDirective, SuppressionIds } from "@intentius/chant/lint/suppressions";
 
 /** A block header keyword with zero labels (`terraform {`, `locals {`). */
-const BARE_RE = /^\s*(terraform|locals|remote_state)\s*\{/;
+const BARE_RE = /^\s*(terraform|locals|remote_state|moved|import|removed)\s*\{/;
 /** One label (`provider "aws" {`, `module "vpc" {`, `variable "x" {`, `output "x" {`). */
-const ONE_LABEL_RE = /^\s*(provider|module|variable|output|dependency|generate)\s+"([^"]*)"\s*\{/;
+const ONE_LABEL_RE = /^\s*(provider|module|variable|output|check|dependency|generate)\s+"([^"]*)"\s*\{/;
 /** Two labels (`resource "aws_s3_bucket" "assets" {`, `data "aws_ami" "x" {`). */
 const TWO_LABEL_RE = /^\s*(resource|data)\s+"([^"]*)"\s+"([^"]*)"\s*\{/;
 
@@ -45,6 +45,12 @@ function addressFor(keyword: string, labels: string[]): string {
       return "locals";
     case "remote_state":
       return "remote_state";
+    case "moved":
+    case "import":
+    case "removed":
+      return keyword;
+    case "check":
+      return `check.${labels[0]}`;
     case "dependency":
       return `dependency.${labels[0]}`;
     case "generate":

package/src/index.ts

@@ -10,10 +10,86 @@ export {
   terraformApplyCapability,
   TerraformPlanMovedError,
   TERRAFORM_VERB_FAMILIES,
+  // #4455: a choudoufu member's outputs, read for core's `member-outputs`.
+  choudoufuOutputSource,
+  choudoufuMemberPlannedOutputs,
   type TerraformApplyStepInput,
   type TerraformApplyStepOutput,
 } from "./components/capability-plugin";
 
+// Composed runs (#4442): the working state merged and split, the composed
+// plan cut into one plan per member, and each member's apply outcome.
+export { mergeStates, splitState, splitStates, derivedLineage, COMPOSE_LINEAGE, type SplitState } from "./compose/state-merge";
+export {
+  slicePlan as sliceComposedPlan,
+  sliceText,
+  planCounts,
+  composedReads,
+  composedMemberPlans,
+  type PlanCounts,
+  type ComposedMemberRead,
+  type ComposedMemberPlan,
+  type ComposedMemberPlansOptions,
+} from "./compose/slice";
+export { readApplyEvents, memberApply, composedApplyOutcomes, type ApplyEvents, type MemberApply, type MemberApplyOutcome } from "./compose/apply-events";
+export { topModule, stripModule, stripChange, moduleChanges } from "./compose/module-address";
+
+// Composed runs of choudoufu estates (#4445): one plan and one apply, values read from a post-apply plan.
+export {
+  EstateRun,
+  estateVersionFallback,
+  estateOutcomes,
+  readEstateApplyText,
+  type ComposedRunner,
+  type ComposedRunPlan,
+  type ComposedRunApply,
+  type ComposedMemberOutcome,
+  type EstateRunOptions,
+} from "./compose/estate";
+export { priorStateValues, stateResources, stateOutputs, type StateResourceValues } from "./applied-state";
+
+// Composed runs over roots with state (#4444): one plan and one apply, each
+// state written back whatever happened. Implements `ComposedRunner` (#4445).
+export {
+  ComposedRun,
+  composedPlanDigest,
+  changesSomething,
+  type ComposedRunOptions,
+  type ComposedRunStage,
+  type StateRunPlan,
+  type StateRunApply,
+  type StateMemberOutcome,
+  type ComposedStateWrite,
+  type ComposeHook,
+  type ComposeHookMoment,
+} from "./compose/run";
+
+// The plan shape of a `show -json` plan (#4436), for core's `coveredRound`.
+export { terraformPlanShape, type TerraformPlanShapeOptions } from "./plan-shape";
+export { terraformLockRows, terraformLockRowsFromPart, terraformDefaultLockGrain, terraformLockGrainRefusal } from "./lock-rows";
+
+// Composed runs (#4419, #4438): which roots compose, in what order, and why
+// the others fall back. Off unless `terraform.compose.enabled` is set.
+export {
+  compositionFor,
+  compositionIfEnabled,
+  composeOff,
+  composeSet,
+  readOrder,
+  moduleNames,
+  fallbackLine,
+  withPlanFailed,
+  identityKey,
+  DEFAULT_COMPOSE_MAX,
+  COMPOSE_STEP_KIND,
+  type Composition,
+  type CompositionInput,
+  type ComposedRead,
+  type ComposeFallback,
+  type ComposeFallbackKind,
+  type ExpectedBinary,
+} from "./compose";
+
 // Serializer
 export { terraformSerializer } from "./serializer";
 
@@ -68,6 +144,7 @@ export {
   choudoufuLiveLs,
   choudoufuLiveCheck,
   choudoufuAdopt,
+  choudoufuPlanSet,
   terraformPinRollout,
 } from "./op/builders";
 
@@ -132,3 +209,5 @@ export {
   type TerraformLiveRead,
   type TerraformPredictOptions,
 } from "./behaviour";
+// terraform, tofu and choudoufu exit statuses on chant's exit-code table (#4553).
+export { terraformExitOf, terraformPlanMoved, type TerraformExitSource } from "./exit-codes";

package/src/lint/audit-catalog.ts

@@ -88,10 +88,11 @@ export const terraformAuditCatalog: Record<string, RuleMeta> = {
     tier: "merge-worthy",
     fixKind: "guidance",
     category: "correctness",
-    title: "Live root declares a backend or cloud block, which choudoufu refuses",
+    title: "Live root declares a backend or cloud block, which choudoufu ignores",
     remediation:
-      "Remove the `backend`/`cloud` block from the live root's terraform block; a live root's prior " +
-      "state is a projection rebuilt from the live system every run, so there is no state to store.",
+      "Keep a `backend` block if other roots read this estate's outputs or the record store should be " +
+      "derived from its bucket; declare `record_store` to put records elsewhere. Remove a `cloud` block, " +
+      "which choudoufu drops entirely, or swap it for a `backend` block.",
     yamlBased: false,
   },
   TF025: {
@@ -551,6 +552,31 @@ export const terraformAuditCatalog: Record<string, RuleMeta> = {
       'Set `terragrunt_version_constraint = ">= 1.1.0"` in the root config. Off by default; judged only across the configs scanned.',
     yamlBased: false,
   },
+  TF046: {
+    id: "TF046",
+    tier: "report-only",
+    fixKind: "guidance",
+    category: "correctness",
+    title: "Live root resolves to the local record store in a CI run",
+    remediation:
+      "Keep or add a `backend` block of type s3, gcs or azurerm with a literal bucket, so choudoufu " +
+      "derives the record store from it, or declare `record_store` in the live block or `estate.chdf.hcl`. " +
+      "The rule is off by default and terragucci turns it on for its users; an emulator or test lane " +
+      "that keeps the local store on purpose sets `CHANT_ALLOW_LOCAL_RECORD_STORE=1`.",
+    yamlBased: false,
+  },
+  TF047: {
+    id: "TF047",
+    tier: "report-only",
+    fixKind: "guidance",
+    category: "correctness",
+    title: "Live root pins a module version the known-module catalog has no row for, or one with refusals",
+    remediation:
+      "Run `choudoufu live-check` on the root to see each refused site, or pin a version whose examples are clear in " +
+      "the static tier of choudoufu's module table (https://intentius.io/choudoufu/aws/compatibility/#modules). " +
+      "Off by default; terragucci turns it on for its users.",
+    yamlBased: false,
+  },
 };
 
 // Prior art credits, if any, live beside the rules in ./audit-lineage.ts (see

package/src/lint/audit-lineage.ts

@@ -76,8 +76,8 @@
  *
  * TF024 (#2103, live root declares a backend/cloud block) credits choudoufu's
  * own `RuleStateBackend`, `internal/live/lint/issue.go` of
- * github.com/INTENTIUS/choudoufu: the identical condition, checked the same
- * way this fork checks it at `init` before any command runs. TF025 (a live
+ * github.com/INTENTIUS/choudoufu: the same condition, which choudoufu has
+ * reported as a warning since its #2213 (the block is ignored, not refused). TF025 (a live
  * root's non-default `terraform.workspace`) has no entry: its workspace half
  * is refused at the CLI argument-parsing layer there
  * (`internal/command/live_mode.go`), not by a dedicated lint rule under
@@ -110,6 +110,18 @@
  * a root's mode, and no surveyed tool has an Op model to read: choudoufu lints
  * HCL, and every tflint ruleset, tfsec/trivy-checks and the Sentinel policies
  * do the same. There is nothing upstream to credit.
+ *
+ * TF046 (chant#4561, a live root on the local record store in a CI run) has
+ * no entry. choudoufu prints where records go on every run and reports a
+ * `record_store.note` in `live-check -json` (INTENTIUS/choudoufu#2293), but
+ * it has no `internal/live/lint` rule for the local store, and no surveyed
+ * tool knows about record stores. TF044 is the nearest neighbour, for a
+ * Terragrunt state backend.
+ *
+ * TF047 (chant#4560, a live root pins a module version the known-module
+ * catalog has no row for, or one with refusals) has no entry. Its data is
+ * choudoufu's own module table (choudoufu#2292), vendored; no surveyed tool
+ * checks a module pin against a measured compatibility table.
  */
 import type { Lineage } from "@intentius/chant/audit/catalog";
 

package/src/lint/post-synth/fixtures/TF024/live-with-record-store/main.tf

@@ -0,0 +1,18 @@
+terraform {
+  required_version = ">= 1.5.0"
+
+  live {
+    estate = "fixture-estate"
+
+    record_store "s3" {
+      bucket = "fixture-records"
+    }
+  }
+
+  backend "s3" {
+    bucket = "tfstate"
+    key    = "fixture/terraform.tfstate"
+  }
+}
+
+resource "null_resource" "first" {}

package/src/lint/post-synth/fixtures/TF024/sidecar-with-backend/estate.chdf.hcl

@@ -0,0 +1 @@
+estate = "fixture-estate"