@intentius/chant-lexicon-terraform 0.124.54 → 0.124.56

package/dist/registry/reader.js

@@ -0,0 +1,198 @@
+/**
+ * Reading a module registry the way the CLIs do: service discovery, the
+ * versions list, a version's download location, and a tarball's bytes.
+ * Lifted from terragucci's `publish/registry.ts` (18f6431595) for chant#4565.
+ *
+ * `registryLocation` reads the download answer in one of three ways:
+ * `terraform` takes only the `X-Terraform-Get` header (200 or 204), `tofu`
+ * takes the JSON body's `location` on a 200 and the header otherwise, and the
+ * default takes either, header first. A test that wants to know whether
+ * Terraform can install from a registry asks with `reads: "terraform"`.
+ *
+ * Every request to the registry's host carries the token the CLIs would send
+ * it (chant#4563): `TF_TOKEN_<host>`, else the CLI config's or
+ * credentials.tfrc.json's `credentials` block, found by core's
+ * `terraform/credentials` reader. The token goes in the `Authorization`
+ * header and nowhere else; an error names the variable to set, never a value.
+ *
+ * A host with no service discovery of its own, such as a Nexus repository
+ * (chant#4605), is read through `services`: the modules.v1 URL per host, as
+ * a CLI's `host` block gives it, held in memory so no CLI config file is
+ * written. Such a host may be a bare name with no dot, as a `host` block's
+ * label may be.
+ *
+ * With `proxies` (chant#4606), a module whose host a proxy stands for is
+ * read through the proxy: an Artifactory remote repository at
+ * `<proxy host>/<repo>__<ns>/<name>/<system>`, a Nexus proxy or group
+ * repository through its host block's modules.v1 URL. A source with no host
+ * is read at registry.terraform.io, so through the proxy that stands for it.
+ */
+import { gunzipSync } from "node:zlib";
+import { credentialsHost, terraformToken, tokenVariable } from "@intentius/chant/terraform/credentials";
+import { DISCOVERY, parseRegistrySource } from "./address.js";
+import { DEFAULT_PROXY_UPSTREAM, proxyLabels, proxyRoute } from "./proxies.js";
+import { DOWNLOAD_HEADER, readVersions } from "./writer.js";
+const globalFetch = (url, init) => fetch(url, init);
+export class RegistryError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "RegistryError";
+    }
+}
+/** The token a read sends to a host, by the options. */
+export const readToken = (host, o) => (o.token === false ? undefined : (o.token ?? terraformToken(host, o.credentials)));
+const httpGet = async (fetchFn, url, token, authorization) => {
+    const auth = authorization ?? (token ? `Bearer ${token}` : undefined);
+    try {
+        return await fetchFn(url, { method: "GET", redirect: "follow", ...(auth ? { headers: { Authorization: auth } } : {}) });
+    }
+    catch (e) {
+        const cause = e.cause?.message;
+        throw new RegistryError(`${url}: ${e.message}${cause ? ` (${cause})` : ""}`);
+    }
+};
+/** The error for a status that is not OK, saying where a token goes when the registry refused one. */
+const answered = (url, status, host, token) => {
+    if (status !== 401 && status !== 403)
+        return new RegistryError(`${url} answered ${status}`);
+    const variable = tokenVariable(host);
+    const where = variable ? `${variable} or a credentials "${credentialsHost(host)}" block` : `a credentials "${credentialsHost(host) ?? host}" block in credentials.tfrc.json`;
+    return new RegistryError(token ? `${url} answered ${status}: the registry refused the token for ${host}` : `${url} answered ${status}: the registry wants a token; set ${where}`);
+};
+const optionsOf = (o) => (typeof o === "function" ? { fetch: o } : (o ?? {}));
+/** The modules.v1 URL `services` names for a host, matched without case. */
+const serviceFor = (host, o) => {
+    if (!o.services)
+        return undefined;
+    const h = host.toLowerCase();
+    for (const [k, v] of Object.entries(o.services))
+        if (k.toLowerCase() === h)
+            return v;
+    return undefined;
+};
+/** A source split by the hosts the options know as well as by the usual host shape. */
+const sourceOf = (source, o) => parseRegistrySource(source, [...Object.keys(o.services ?? {}), ...proxyLabels(o.proxies)]);
+/**
+ * Where a read of `source` goes: the source as written, or, when a proxy
+ * stands for its host, the proxy's host and namespace, with the options
+ * carrying the proxy's modules.v1 URL when it has one. A source with no host
+ * is taken at registry.terraform.io only when proxies are given, so a read
+ * without them refuses it as before.
+ */
+function readTarget(source, o) {
+    let s = sourceOf(source, o);
+    if (!s && o.proxies?.length) {
+        const base = source.split("?")[0].split("//")[0];
+        const parts = base.split("/");
+        if (parts.length === 3 && parts.every((p) => /^[0-9A-Za-z][0-9A-Za-z_-]*$/.test(p)))
+            s = { host: DEFAULT_PROXY_UPSTREAM, namespace: parts[0], name: parts[1], system: parts[2] };
+    }
+    if (!s)
+        return undefined;
+    const r = proxyRoute(s, o.proxies);
+    if (!r)
+        return { s, o };
+    return { s: { ...s, host: r.host, namespace: r.namespace }, o: r.modules ? { ...o, services: { ...o.services, [r.host]: r.modules } } : o };
+}
+/** The modules.v1 base a host's service discovery names, ending in `/`. */
+export async function modulesBase(host, options) {
+    const o = optionsOf(options);
+    const mapped = serviceFor(host, o);
+    if (mapped !== undefined)
+        return mapped.endsWith("/") ? mapped : `${mapped}/`;
+    const disco = `${o.scheme ?? "https"}://${host}/${DISCOVERY}`;
+    const token = readToken(host, o);
+    const res = await httpGet(o.fetch ?? globalFetch, disco, token, o.authorization);
+    if (!res.ok)
+        throw answered(disco, res.status, host, token ?? o.authorization);
+    let base;
+    try {
+        base = (await res.json())["modules.v1"];
+    }
+    catch {
+        throw new RegistryError(`${disco} is not JSON`);
+    }
+    if (typeof base !== "string")
+        throw new RegistryError(`${disco} names no modules.v1`);
+    const url = new URL(base, disco).toString();
+    return url.endsWith("/") ? url : `${url}/`;
+}
+/** Every version a registry lists for a module; none when it has no versions file. */
+export async function registryVersions(source, options) {
+    const t = readTarget(source, optionsOf(options));
+    if (!t)
+        throw new RegistryError(`${source} is not a registry source`);
+    const { s, o } = t;
+    const token = readToken(s.host, o);
+    const url = `${await modulesBase(s.host, { ...o, token: token ?? false })}${s.namespace}/${s.name}/${s.system}/versions`;
+    const res = await httpGet(o.fetch ?? globalFetch, url, token, o.authorization);
+    if (res.status === 404)
+        return [];
+    if (!res.ok)
+        throw answered(url, res.status, s.host, token ?? o.authorization);
+    return readVersions(await res.text());
+}
+/** The location a download answer gives, read as `reads` says, or undefined when it gives none that way. */
+export async function locationFromAnswer(res, reads = "either") {
+    const header = res.headers.get(DOWNLOAD_HEADER) || undefined;
+    if (reads === "terraform")
+        return res.status === 200 || res.status === 204 ? header : undefined;
+    let body;
+    if (res.status === 200) {
+        try {
+            const doc = (await res.json());
+            if (typeof doc.location === "string" && doc.location)
+                body = doc.location;
+        }
+        catch {
+            // OpenTofu fails on a 200 whose body is not JSON, before it looks at the header.
+            if (reads === "tofu")
+                return undefined;
+        }
+    }
+    return reads === "tofu" ? (body ?? header) : (header ?? body);
+}
+/** Where a registry says one version is, resolved against the download URL when it is relative. */
+export async function registryLocation(source, version, options) {
+    const t = readTarget(source, optionsOf(options));
+    if (!t)
+        throw new RegistryError(`${source} is not a registry source`);
+    const s = t.s;
+    const o = t.o;
+    const token = readToken(s.host, o);
+    const url = `${await modulesBase(s.host, { ...o, token: token ?? false })}${s.namespace}/${s.name}/${s.system}/${version}/download`;
+    const res = await httpGet(o.fetch ?? globalFetch, url, token, o.authorization);
+    if (res.status === 404)
+        throw new RegistryError(`${s.host}/${s.namespace}/${s.name}/${s.system} has no version ${version}`);
+    if (!res.ok)
+        throw answered(url, res.status, s.host, token ?? o.authorization);
+    const reads = o.reads ?? "either";
+    let location = await locationFromAnswer(res, reads);
+    if (!location) {
+        throw new RegistryError(reads === "terraform" ? `${url} sends no ${DOWNLOAD_HEADER} header, and Terraform reads only the header` : `${url} names no location`);
+    }
+    if (/^(\.{0,2}\/)/.test(location))
+        location = new URL(location, url).toString();
+    return location;
+}
+/**
+ * The module archive a tarball location holds, uncompressed: the bytes a
+ * release's digest is of. The host's token goes along only when the location
+ * has no query string; a signed URL carries its own grant, and a bucket
+ * refuses a request that has both a signature and an `Authorization` header.
+ */
+export async function fetchTarball(location, options) {
+    const o = optionsOf(options);
+    const u = new URL(location);
+    const token = u.search || (u.protocol !== "https:" && u.protocol !== "http:") ? undefined : readToken(u.host, o);
+    const res = await httpGet(o.fetch ?? globalFetch, location, token);
+    if (!res.ok)
+        throw answered(location, res.status, u.host, token);
+    const body = Buffer.from(await res.arrayBuffer());
+    try {
+        return gunzipSync(body);
+    }
+    catch {
+        throw new RegistryError(`${location} is not a gzip archive`);
+    }
+}

package/dist/registry/semver.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The versions a module registry lists: plain `major.minor.patch`, with an
+ * optional leading `v` on input. Lifted from terragucci's `publish/semver.ts`
+ * (18f6431595), cut to what the registry protocol needs (chant#4565).
+ */
+export interface Semver {
+    major: number;
+    minor: number;
+    patch: number;
+}
+export declare function parseSemver(text: string): Semver | undefined;
+export declare const formatSemver: (v: Semver) => string;
+export declare function compareSemver(a: Semver, b: Semver): number;
+/** The newest of a list of versions; entries that are not versions are skipped. */
+export declare function newest(versions: string[]): Semver | undefined;
+//# sourceMappingURL=semver.d.ts.map

package/dist/registry/semver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"semver.d.ts","sourceRoot":"","sources":["../../src/registry/semver.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,MAAM;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAID,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG5D;AAED,eAAO,MAAM,YAAY,MAAO,MAAM,KAAG,MAA4C,CAAC;AAEtF,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,mFAAmF;AACnF,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,SAAS,CAO7D"}

package/dist/registry/semver.js

@@ -0,0 +1,24 @@
+/**
+ * The versions a module registry lists: plain `major.minor.patch`, with an
+ * optional leading `v` on input. Lifted from terragucci's `publish/semver.ts`
+ * (18f6431595), cut to what the registry protocol needs (chant#4565).
+ */
+const RE = /^v?(\d+)\.(\d+)\.(\d+)$/;
+export function parseSemver(text) {
+    const m = RE.exec(text.trim());
+    return m ? { major: +m[1], minor: +m[2], patch: +m[3] } : undefined;
+}
+export const formatSemver = (v) => `${v.major}.${v.minor}.${v.patch}`;
+export function compareSemver(a, b) {
+    return a.major - b.major || a.minor - b.minor || a.patch - b.patch;
+}
+/** The newest of a list of versions; entries that are not versions are skipped. */
+export function newest(versions) {
+    let best;
+    for (const v of versions) {
+        const p = parseSemver(v);
+        if (p && (!best || compareSemver(p, best) > 0))
+            best = p;
+    }
+    return best;
+}

package/dist/registry/serve.d.ts

@@ -0,0 +1,24 @@
+import type { RegistryFiles, RegistryHandler } from "./handler.js";
+/** A registry written into a directory, read back as bytes. Keys that climb out of the directory read as missing. */
+export declare function dirFiles(root: string): RegistryFiles;
+export interface ServeOptions {
+    /** Default 127.0.0.1. A loopback address keeps the registry off the network. */
+    hostname?: string;
+    /** Default 0, a free port. */
+    port?: number;
+    /** PEM key and certificate: the server speaks HTTPS, as both CLIs require for discovery. */
+    tls?: {
+        key: string | Buffer;
+        cert: string | Buffer;
+    };
+}
+export interface ServedRegistry {
+    /** `<scheme>://<hostname>:<port>`, no trailing slash. */
+    url: string;
+    /** `<hostname>:<port>`, the host a registry source names. */
+    host: string;
+    close(): Promise<void>;
+}
+/** Serves a handler on a local socket until `close`. */
+export declare function serveRegistry(handler: RegistryHandler, options?: ServeOptions): Promise<ServedRegistry>;
+//# sourceMappingURL=serve.d.ts.map

package/dist/registry/serve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/registry/serve.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAEhE,qHAAqH;AACrH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAQpD;AAED,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4FAA4F;IAC5F,GAAG,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;CACvD;AAED,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAUD,wDAAwD;AACxD,wBAAsB,aAAa,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CA+BjH"}

package/dist/registry/serve.js

@@ -0,0 +1,64 @@
+/**
+ * A registry's files on a loopback socket, for tests that run real
+ * `terraform init` and `tofu init` (terragucci#1287) and for a local preview.
+ * The answers come from `registryHandler` in ./handler; this file adds the
+ * directory reader and the Node server around it.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { createServer as createHttpServer } from "node:http";
+import { createServer as createHttpsServer } from "node:https";
+import { join, normalize, sep } from "node:path";
+/** A registry written into a directory, read back as bytes. Keys that climb out of the directory read as missing. */
+export function dirFiles(root) {
+    const base = normalize(root);
+    return async (key) => {
+        const file = normalize(join(base, key));
+        if (file !== base && !file.startsWith(base.endsWith(sep) ? base : `${base}${sep}`))
+            return {};
+        if (!existsSync(file) || !statSync(file).isFile())
+            return {};
+        return { body: readFileSync(file) };
+    };
+}
+const readBody = (req) => new Promise((resolve, reject) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+    req.on("error", reject);
+});
+/** Serves a handler on a local socket until `close`. */
+export async function serveRegistry(handler, options = {}) {
+    const hostname = options.hostname ?? "127.0.0.1";
+    const scheme = options.tls ? "https" : "http";
+    const listener = async (req, res) => {
+        try {
+            const method = req.method ?? "GET";
+            const body = method === "GET" || method === "HEAD" ? undefined : await readBody(req);
+            const headers = new Headers();
+            for (const [k, v] of Object.entries(req.headers))
+                if (typeof v === "string")
+                    headers.set(k, v);
+            const answer = await handler(new Request(`${scheme}://${req.headers.host ?? hostname}${req.url ?? "/"}`, { method, headers, ...(body ? { body: new Uint8Array(body) } : {}) }));
+            const out = {};
+            answer.headers.forEach((v, k) => (out[k] = v));
+            res.writeHead(answer.status, out);
+            res.end(answer.body ? Buffer.from(await answer.arrayBuffer()) : undefined);
+        }
+        catch (e) {
+            res.writeHead(500, { "content-type": "text/plain" });
+            res.end(String(e.message));
+        }
+    };
+    const server = options.tls ? createHttpsServer({ key: options.tls.key, cert: options.tls.cert }, (q, r) => void listener(q, r)) : createHttpServer((q, r) => void listener(q, r));
+    await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(options.port ?? 0, hostname, () => resolve());
+    });
+    const { port } = server.address();
+    const host = `${hostname.includes(":") ? `[${hostname}]` : hostname}:${port}`;
+    return {
+        url: `${scheme}://${host}`,
+        host,
+        close: () => new Promise((resolve, reject) => server.close((e) => (e ? reject(e) : resolve()))),
+    };
+}

package/dist/registry/source-forms.d.ts

@@ -0,0 +1,79 @@
+import { type RegistryProxy } from "./proxies.js";
+/** The public registry's host, which a source with no host names under Terraform. */
+export declare const PUBLIC_REGISTRY_HOST = "registry.terraform.io";
+/** OpenTofu's public registry's host. */
+export declare const OPENTOFU_REGISTRY_HOST = "registry.opentofu.org";
+/** The hosts a provider or registry module address written without one is read from, Terraform's first. */
+export declare const DEFAULT_REGISTRIES: readonly string[];
+/** Which binary reads an address: it decides the default registry host. */
+export type SourceBinary = "terraform" | "tofu";
+/** The default registry host for a binary. */
+export declare const defaultRegistryHost: (binary?: SourceBinary) => string;
+/** How a source is read: the binary (for default hosts) and the registry proxies in front of upstreams. */
+export interface SourceFormOptions {
+    binary?: SourceBinary;
+    proxies?: readonly RegistryProxy[];
+}
+/** A binary alone, or the options. */
+export type SourceFormArg = SourceBinary | SourceFormOptions;
+/** A source without its `?` query, trimmed. */
+export declare const withoutQuery: (source: string) => string;
+/**
+ * Every form a module source matches as: as written without its query, then
+ * its registry forms. A hostless registry source adds itself at each default
+ * registry; one at a default registry adds its hostless form and its form at
+ * the other default registry; `tfr:///x` adds `x` at each default registry
+ * and `tfr://<host>/x` adds `<host>/x`. Any other source (local, git, OCI,
+ * an archive URL) has the one form. A source through one of `proxies` adds
+ * the forms of the upstream source it stands for.
+ */
+export declare function moduleSourceForms(source: string, options?: SourceFormOptions): string[];
+/**
+ * The module a pin-free source names, written one way: a registry source
+ * with no host gets the public registry's (or the binary's), a host is
+ * lower-cased, and Terragrunt's `tfr:///ns/name/system` and
+ * `tfr://host/ns/name/system` become the plain registry form. Other sources
+ * (git, OCI, an archive URL) are kept as they are. Moved from
+ * ../pin/consumers.ts (chant#4599). A source through one of `proxies` is
+ * the upstream source it stands for.
+ */
+export declare function normalizeModuleSource(module: string, options?: SourceFormArg): string;
+/** A provider address's parts. */
+export interface ProviderAddress {
+    host: string;
+    namespace: string;
+    type: string;
+    /** `<host>/<namespace>/<type>`. */
+    address: string;
+}
+/**
+ * A `required_providers` source in its full form, `<host>/<namespace>/<type>`,
+ * lower case, with the binary's default host when it names none and the
+ * `hashicorp` namespace when it names only a type. Undefined for a string
+ * that is not a provider address. A source through one of `proxies`
+ * (`<host>/<repo>__<ns>/<type>` on Artifactory) gives the upstream's address.
+ */
+export declare function parseProviderAddress(source: string, options?: SourceFormArg): ProviderAddress | undefined;
+/** {@link parseProviderAddress}'s full form, or undefined. */
+export declare const providerAddress: (source: string, options?: SourceFormArg) => string | undefined;
+/**
+ * The provider `init` installs for a local name that has no
+ * `required_providers` entry: `hashicorp/<name>`. Undefined for the binary's
+ * own `terraform` provider (terraform_data, terraform_remote_state), which is
+ * never downloaded.
+ */
+export declare const impliedProvider: (local: string) => string | undefined;
+/**
+ * Every form a provider address matches as: in lower case as written, and,
+ * when written without a host or at a default registry, its hostless form
+ * and its form at each default registry. A source through one of `proxies`
+ * adds the forms of its upstream address.
+ */
+export declare function providerAddressForms(source: string, options?: SourceFormOptions): string[];
+/**
+ * The provider addresses a `.terraform.lock.hcl` names, in the order
+ * written, as the lock file writes them (the full form). Read by text: the
+ * lock file is generated and every entry is a `provider "<address>" {` line.
+ */
+export declare function lockedProviders(lockText: string): string[];
+//# sourceMappingURL=source-forms.d.ts.map

package/dist/registry/source-forms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-forms.d.ts","sourceRoot":"","sources":["../../src/registry/source-forms.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA4C,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAEzF,qFAAqF;AACrF,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAC5D,yCAAyC;AACzC,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAC9D,2GAA2G;AAC3G,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAAmD,CAAC;AAEpG,2EAA2E;AAC3E,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,MAAM,CAAC;AAEhD,8CAA8C;AAC9C,eAAO,MAAM,mBAAmB,YAAY,YAAY,KAAiB,MAA6E,CAAC;AAEvJ,2GAA2G;AAC3G,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACpC;AAED,sCAAsC;AACtC,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAI7D,+CAA+C;AAC/C,eAAO,MAAM,YAAY,WAAY,MAAM,KAAG,MAAsC,CAAC;AAcrF;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAKvF;AAwBD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAcrF;AAED,kCAAkC;AAClC,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,mCAAmC;IACnC,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,eAAe,GAAG,SAAS,CAYzG;AAED,8DAA8D;AAC9D,eAAO,MAAM,eAAe,WAAY,MAAM,YAAY,aAAa,KAAG,MAAM,GAAG,SAA2D,CAAC;AAE/I;;;;;GAKG;AACH,eAAO,MAAM,eAAe,UAAW,MAAM,KAAG,MAAM,GAAG,SAAqF,CAAC;AAE/I;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,MAAM,EAAE,CAK1F;AAaD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAO1D"}

package/dist/registry/source-forms.js

@@ -0,0 +1,202 @@
+/**
+ * Module sources and provider addresses in a normal form (chant#3924), beside
+ * the registry address parsing of ./address.ts (chant#4565), so a product's
+ * allow list, the catalog's consumer scan and the proxy forms (chant#4606)
+ * compare sources one way. No Node imports, so an edge function can carry it.
+ *
+ * A module source is compared without its `?` query: a `ref`, `version` or
+ * `tag` pins a release and does not move where the code comes from. A
+ * registry source written without a host is read by Terraform from
+ * registry.terraform.io and by OpenTofu from registry.opentofu.org, so it
+ * stands for both; Terragrunt's `tfr:///` and `tfr://<host>/` are the same
+ * sources. Registry shapes follow `classifyModuleSource`
+ * (../lint/post-synth/module-source.ts), which mirrors
+ * hashicorp/terraform-registry-address.
+ *
+ * A provider address is `<host>/<namespace>/<type>` in lower case. A
+ * `required_providers` source without a host gets the binary's default
+ * registry, one with only a type gets the `hashicorp` namespace (Terraform's
+ * legacy reading), and a provider a module uses with no entry at all is the
+ * one `init` installs for it, `hashicorp/<name>`; the binary's own
+ * `terraform` provider is never downloaded and has no address.
+ *
+ * With `proxies` (chant#4606, ./proxies.ts), a source written through an
+ * Artifactory remote repository or a Nexus proxy host block stands for its
+ * upstream source: its forms include the upstream's, and its normal form
+ * and provider address are the upstream's, so it compares equal to the
+ * plain source.
+ */
+import { classifyModuleSource } from "../lint/post-synth/module-source.js";
+import { parseRegistrySource } from "./address.js";
+import { moduleThroughProxy, providerThroughProxy } from "./proxies.js";
+/** The public registry's host, which a source with no host names under Terraform. */
+export const PUBLIC_REGISTRY_HOST = "registry.terraform.io";
+/** OpenTofu's public registry's host. */
+export const OPENTOFU_REGISTRY_HOST = "registry.opentofu.org";
+/** The hosts a provider or registry module address written without one is read from, Terraform's first. */
+export const DEFAULT_REGISTRIES = [PUBLIC_REGISTRY_HOST, OPENTOFU_REGISTRY_HOST];
+/** The default registry host for a binary. */
+export const defaultRegistryHost = (binary = "terraform") => (binary === "tofu" ? OPENTOFU_REGISTRY_HOST : PUBLIC_REGISTRY_HOST);
+const optionsOf = (o) => (typeof o === "string" ? { binary: o } : (o ?? {}));
+/** A source without its `?` query, trimmed. */
+export const withoutQuery = (source) => source.trim().split("?")[0];
+/** A hostless registry module source (`<ns>/<name>/<system>`, optionally `//<subdir>`), as the registry protocol shapes one. */
+function isHostlessModule(source) {
+    const base = source.split("//")[0];
+    return base.split("/").length === 3 && classifyModuleSource(base).kind === "registry";
+}
+/** The source without a default registry's host, when it starts with one. */
+function atDefaultRegistry(source) {
+    const host = DEFAULT_REGISTRIES.find((h) => source.toLowerCase().startsWith(`${h}/`));
+    return host ? source.slice(host.length + 1) : undefined;
+}
+/**
+ * Every form a module source matches as: as written without its query, then
+ * its registry forms. A hostless registry source adds itself at each default
+ * registry; one at a default registry adds its hostless form and its form at
+ * the other default registry; `tfr:///x` adds `x` at each default registry
+ * and `tfr://<host>/x` adds `<host>/x`. Any other source (local, git, OCI,
+ * an archive URL) has the one form. A source through one of `proxies` adds
+ * the forms of the upstream source it stands for.
+ */
+export function moduleSourceForms(source, options) {
+    const out = plainModuleForms(source);
+    const via = moduleThroughProxy(source, options?.proxies);
+    if (via)
+        for (const f of plainModuleForms(via.upstream))
+            if (!out.includes(f))
+                out.push(f);
+    return out;
+}
+function plainModuleForms(source) {
+    const written = withoutQuery(source);
+    const out = [written];
+    const add = (...forms) => {
+        for (const f of forms)
+            if (!out.includes(f))
+                out.push(f);
+    };
+    const tfr = /^tfr:\/\/([^/]*)\/(.+)$/.exec(written);
+    if (tfr) {
+        if (tfr[1])
+            add(`${tfr[1].toLowerCase()}/${tfr[2]}`);
+        else
+            add(...DEFAULT_REGISTRIES.map((h) => `${h}/${tfr[2]}`));
+        if (!tfr[1])
+            add(tfr[2]);
+        return out;
+    }
+    if (isHostlessModule(written)) {
+        add(...DEFAULT_REGISTRIES.map((h) => `${h}/${written}`));
+        return out;
+    }
+    const hostless = atDefaultRegistry(written);
+    if (hostless && isHostlessModule(hostless))
+        add(hostless, ...DEFAULT_REGISTRIES.map((h) => `${h}/${hostless}`));
+    return out;
+}
+/**
+ * The module a pin-free source names, written one way: a registry source
+ * with no host gets the public registry's (or the binary's), a host is
+ * lower-cased, and Terragrunt's `tfr:///ns/name/system` and
+ * `tfr://host/ns/name/system` become the plain registry form. Other sources
+ * (git, OCI, an archive URL) are kept as they are. Moved from
+ * ../pin/consumers.ts (chant#4599). A source through one of `proxies` is
+ * the upstream source it stands for.
+ */
+export function normalizeModuleSource(module, options) {
+    const o = optionsOf(options);
+    const binary = o.binary ?? "terraform";
+    const via = moduleThroughProxy(module, o.proxies);
+    let s = (via ? via.upstream : module).trim();
+    const tfr = /^tfr:\/\/([^/]*)\/(.*)$/.exec(s);
+    if (tfr)
+        s = `${tfr[1] || defaultRegistryHost(binary)}/${tfr[2]}`;
+    const [base, ...rest] = s.split("//");
+    const parts = base.split("/");
+    const registryShaped = (n) => parts.length === n && parts.every((p) => p.length > 0) && !base.includes(":");
+    if (registryShaped(3) && !/[.]/.test(parts[0]))
+        return [`${defaultRegistryHost(binary)}/${base}`, ...rest].join("//");
+    const reg = parts.length === 4 ? parseRegistrySource(base) : undefined;
+    if (reg)
+        return [`${reg.host}/${parts.slice(1).join("/")}`, ...rest].join("//");
+    return s;
+}
+const PROVIDER_PART = /^[0-9a-z](?:[0-9a-z_-]{0,62}[0-9a-z])?$/;
+const HOST = /^[a-z0-9.-]+(?::\d+)?$/;
+/**
+ * A `required_providers` source in its full form, `<host>/<namespace>/<type>`,
+ * lower case, with the binary's default host when it names none and the
+ * `hashicorp` namespace when it names only a type. Undefined for a string
+ * that is not a provider address. A source through one of `proxies`
+ * (`<host>/<repo>__<ns>/<type>` on Artifactory) gives the upstream's address.
+ */
+export function parseProviderAddress(source, options) {
+    const o = optionsOf(options);
+    const binary = o.binary ?? "terraform";
+    const via = providerThroughProxy(source, o.proxies);
+    const parts = (via ? via.upstream : source).trim().toLowerCase().split("/");
+    let host, namespace, type;
+    if (parts.length === 1)
+        [host, namespace, type] = [defaultRegistryHost(binary), "hashicorp", parts[0]];
+    else if (parts.length === 2)
+        [host, namespace, type] = [defaultRegistryHost(binary), parts[0], parts[1]];
+    else if (parts.length === 3)
+        [host, namespace, type] = parts;
+    else
+        return undefined;
+    if (!HOST.test(host) || !PROVIDER_PART.test(namespace) || !PROVIDER_PART.test(type))
+        return undefined;
+    return { host, namespace, type, address: `${host}/${namespace}/${type}` };
+}
+/** {@link parseProviderAddress}'s full form, or undefined. */
+export const providerAddress = (source, options) => parseProviderAddress(source, options)?.address;
+/**
+ * The provider `init` installs for a local name that has no
+ * `required_providers` entry: `hashicorp/<name>`. Undefined for the binary's
+ * own `terraform` provider (terraform_data, terraform_remote_state), which is
+ * never downloaded.
+ */
+export const impliedProvider = (local) => (local === "terraform" ? undefined : `hashicorp/${local.toLowerCase()}`);
+/**
+ * Every form a provider address matches as: in lower case as written, and,
+ * when written without a host or at a default registry, its hostless form
+ * and its form at each default registry. A source through one of `proxies`
+ * adds the forms of its upstream address.
+ */
+export function providerAddressForms(source, options) {
+    const out = plainProviderForms(source);
+    const via = providerThroughProxy(source, options?.proxies);
+    if (via)
+        for (const f of plainProviderForms(via.upstream))
+            if (!out.includes(f))
+                out.push(f);
+    return out;
+}
+function plainProviderForms(source) {
+    const a = source.trim().toLowerCase();
+    const out = [a];
+    const add = (...forms) => {
+        for (const f of forms)
+            if (!out.includes(f))
+                out.push(f);
+    };
+    const hostless = a.split("/").length === 2 ? a : a.split("/").length === 1 && a ? `hashicorp/${a}` : atDefaultRegistry(a);
+    if (hostless && hostless.split("/").length === 2)
+        add(hostless, ...DEFAULT_REGISTRIES.map((h) => `${h}/${hostless}`));
+    return out;
+}
+/**
+ * The provider addresses a `.terraform.lock.hcl` names, in the order
+ * written, as the lock file writes them (the full form). Read by text: the
+ * lock file is generated and every entry is a `provider "<address>" {` line.
+ */
+export function lockedProviders(lockText) {
+    const out = [];
+    for (const m of lockText.matchAll(/^\s*provider\s+"([^"]+)"\s*\{/gm)) {
+        const a = m[1].toLowerCase();
+        if (!out.includes(a))
+            out.push(a);
+    }
+    return out;
+}

package/dist/registry/targets/artifactory.d.ts

@@ -0,0 +1,28 @@
+import { type ModuleAddress, type ModulePublishTarget, type ModuleTargetDeps } from "./module-target.js";
+/** How an Artifactory module target is declared. */
+export interface ArtifactoryModuleTargetOptions {
+    /** The Artifactory base, such as `https://acme.jfrog.io/artifactory`. A URL with no path gets `/artifactory`. */
+    url: string;
+    /** The local Terraform repository's key, such as `terraform-local`. */
+    repo: string;
+    /** The variable the access token is read from. Default `JFROG_ACCESS_TOKEN`. */
+    tokenEnv?: string;
+    /** The variable the user name is read from. Default `JFROG_USER`. */
+    userEnv?: string;
+    /** The user name, in place of `userEnv`. */
+    user?: string;
+    /** How long `reveal` waits for Artifactory to list the version. Default 30s. */
+    waitMs?: number;
+    /** How often it asks while it waits. Default 2s. */
+    pollMs?: number;
+}
+export declare const ARTIFACTORY_TOKEN_ENV = "JFROG_ACCESS_TOKEN";
+export declare const ARTIFACTORY_USER_ENV = "JFROG_USER";
+/** The Artifactory base a target deploys under, without a trailing slash. */
+export declare function artifactoryBase(url: string): string;
+/** The source consumers write for a module in the repository: `<host>/<repo>__<namespace>/<name>/<system>`. */
+export declare const artifactorySource: (host: string, repo: string, a: ModuleAddress) => string;
+/** The deploy path of one version's zip. */
+export declare function artifactoryDeployUrl(base: string, repo: string, a: ModuleAddress, version: string): string;
+export declare function artifactoryModuleTarget(options: ArtifactoryModuleTargetOptions, deps?: ModuleTargetDeps): ModulePublishTarget<"artifactory">;
+//# sourceMappingURL=artifactory.d.ts.map

package/dist/registry/targets/artifactory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifactory.d.ts","sourceRoot":"","sources":["../../../src/registry/targets/artifactory.ts"],"names":[],"mappings":"AA6CA,OAAO,EAOL,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EAEtB,MAAM,iBAAiB,CAAC;AAgBzB,oDAAoD;AACpD,MAAM,WAAW,8BAA8B;IAC7C,iHAAiH;IACjH,GAAG,EAAE,MAAM,CAAC;IACZ,uEAAuE;IACvE,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,qBAAqB,uBAAuB,CAAC;AAC1D,eAAO,MAAM,oBAAoB,eAAe,CAAC;AAEjD,6EAA6E;AAC7E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,+GAA+G;AAC/G,eAAO,MAAM,iBAAiB,SAAU,MAAM,QAAQ,MAAM,KAAK,aAAa,KAAG,MAAiE,CAAC;AAEnJ,4CAA4C;AAC5C,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAG1G;AAID,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,8BAA8B,EAAE,IAAI,GAAE,gBAAqB,GAAG,mBAAmB,CAAC,aAAa,CAAC,CA4IhJ"}