@intentius/chant-lexicon-terraform 0.124.54 → 0.124.56

package/dist/rules/tf024.ts

@@ -1,18 +1,38 @@
 /**
  * TF024: a live root declares a `backend` or `cloud` block.
  *
- * choudoufu refuses this combination at `init`, before any command runs,
- * naming both blocks that collide: "Both a backend and a live configuration
- * are present" (a `backend` block) or "Both a cloud and a live configuration
- * are present" (a `cloud` block). A live root keeps no state to store, since
- * prior state is a projection rebuilt from the live system every run, so
- * either block is a contradiction about where the truth lives, not a
- * redundant setting.
+ * choudoufu used to refuse this pair at `init` (#1170). Since
+ * INTENTIUS/choudoufu#2213 it accepts both and ignores them with a warning
+ * (`internal/configs/module.go`, `ignoreStateStoreUnderLive`), because
+ * Terragrunt's `remote_state` and Atmos's `backend.tf.json` write a backend
+ * beside the live block on every run. What each block still does:
+ *
+ * - `backend "<type>"`: no state is read or written there, and
+ *   `init -migrate-state` is refused. choudoufu keeps the block as
+ *   `IgnoredBackend`: an apply publishes the estate's non-sensitive outputs
+ *   to the location it names, so `terraform_remote_state` readers keep
+ *   working, and when the live declaration has no `record_store` the record
+ *   store is derived from the backend's bucket, s3 to s3, gcs to gcs, azurerm
+ *   to azurerm (INTENTIUS/choudoufu#2293), when the bucket is a literal in
+ *   the configuration. An explicit `record_store` always wins. The resolution
+ *   is shared with TF046 in `./record-store.ts`.
+ * - `cloud {}`: dropped entirely. Nothing is published to it and no store is
+ *   derived from it.
+ *
+ * So the backend case is reported as `info` (the block is doing a job the
+ * author may want, and is the derivation source the maintainer ruled for),
+ * and the cloud case as `warning` (the block does nothing at all). Neither
+ * fails a build at default severity. The guard against a CI root that ends
+ * up on the local store is TF046 (chant#4561).
+ *
+ * The live marker is the root's `mode`, stamped from either a `live` block or
+ * an `estate.chdf.hcl` sidecar (`hcl/parse.ts`), so a sidecar estate is
+ * covered. A `record_store` is read from whichever `Terraform::Live` entity
+ * carries it: the `live` block, or the sidecar's top level.
  *
  * TF001 is the equivalent check for a stock root (no remote backend is
- * configured); it explicitly does not fire on a live root, and this check is
- * why: the two are mutually exclusive by construction; a root is flagged by
- * at most one of them.
+ * configured); it does not fire on a live root. A root is flagged by at most
+ * one of them.
  *
  * Scope: root modules only (#2112). A child module's backend or cloud block
  * is TF015's finding, whatever binary the root runs.
@@ -26,17 +46,74 @@ import type {
   PostSynthDiagnostic,
 } from "@intentius/chant/lint/post-synth";
 import { isResourceDeclarable } from "@intentius/chant/declarable";
-import { TERRAFORM_TYPE, type BlockBody } from "../../hcl/parse";
-import { hasBlock } from "./tf001";
+import { LIVE_TYPE, TERRAFORM_TYPE, type BlockBody } from "../../hcl/parse";
+import { backendTypes, hasBlock } from "./tf001";
 import { isRootScoped } from "./scope";
+import { DERIVABLE_BACKENDS, resolveRecordStore, type ResolvedRecordStore } from "./record-store";
+
+export { DERIVABLE_BACKENDS } from "./record-store";
+
+const bodyOf = (props: { body?: unknown }): BlockBody =>
+  (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+
+/** Each root's live declarations (its `live` block and its sidecar), keyed by root. */
+export function liveBodiesByRoot(ctx: PostSynthContext): Map<string, BlockBody[]> {
+  const roots = new Map<string, BlockBody[]>();
+  for (const entity of ctx.entities.values()) {
+    if (entity.entityType !== LIVE_TYPE) continue;
+    if (!isResourceDeclarable(entity) || !isRootScoped(entity)) continue;
+    const props = entity.props as { root?: unknown; body?: unknown };
+    const root = typeof props.root === "string" ? props.root : "";
+    const list = roots.get(root) ?? [];
+    list.push(bodyOf(props));
+    roots.set(root, list);
+  }
+  return roots;
+}
+
+function backendMessage(root: string, type: string, store: ResolvedRecordStore): string {
+  const label = type ? `backend "${type}"` : "backend";
+  const head =
+    `Root module "${root}" runs choudoufu with a declared estate and also declares a ${label} block. ` +
+    "choudoufu ignores it with a warning: no state is read or written there and `init -migrate-state` " +
+    "is refused. An apply publishes the estate's non-sensitive outputs to the location it names, so " +
+    "terraform_remote_state readers keep working.";
+  if (store.source === "record_store") {
+    return `${head} Records go to the record_store the live declaration names, which wins over the backend.`;
+  }
+  if (store.source === "backend") {
+    return (
+      `${head} With no record_store declared, choudoufu derives the record store from this backend's ` +
+      "bucket and prints it on every init and plan (INTENTIUS/choudoufu#2293). Declare record_store to " +
+      "put records somewhere else."
+    );
+  }
+  const why = DERIVABLE_BACKENDS.has(type) && store.note
+    ? `No record store is derived from it: ${store.note}.`
+    : `No record store is derived from a ${type ? `"${type}"` : "backend of unknown type"} (only s3, gcs and azurerm are).`;
+  return (
+    `${head} ${why} No record_store is declared, so records stay in the local ` +
+    "store. Declare record_store if more than one machine runs this root (TF046 guards this in CI)."
+  );
+}
+
+function cloudMessage(root: string): string {
+  return (
+    `Root module "${root}" runs choudoufu with a declared estate and also declares a cloud block. ` +
+    "choudoufu ignores it entirely: no state is read or written there, no outputs are published to it, " +
+    "and no record store is derived from it. Remove it, or use a backend block if " +
+    "terraform_remote_state readers need this estate's outputs."
+  );
+}
 
 export const tf024: PostSynthCheck = {
   id: "TF024",
-  description: "Live root declares a backend or cloud block, which choudoufu refuses",
+  description: "Live root declares a backend or cloud block, which choudoufu ignores",
 
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
     const flagged = new Set<string>();
+    let liveBodies: Map<string, BlockBody[]> | undefined;
 
     for (const [name, entity] of ctx.entities) {
       if (entity.entityType !== TERRAFORM_TYPE) continue;
@@ -46,20 +123,26 @@ export const tf024: PostSynthCheck = {
       const root = typeof props.root === "string" ? props.root : "";
       if (flagged.has(root)) continue;
 
-      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
-      const hasBackend = hasBlock(body, "backend");
+      const body = bodyOf(props);
       const hasCloud = hasBlock(body, "cloud");
+      const hasBackend = hasBlock(body, "backend");
       if (!hasBackend && !hasCloud) continue;
-
       flagged.add(root);
-      const blockKind = hasBackend ? "backend" : "cloud";
+
+      // A cloud block does nothing at all, so it is the one worth a warning
+      // when a (malformed) root somehow carries both.
+      if (hasCloud) {
+        diagnostics.push({ checkId: "TF024", severity: "warning", message: cloudMessage(root), entity: name, lexicon: "terraform" });
+        continue;
+      }
+
+      liveBodies ??= liveBodiesByRoot(ctx);
+      const type = backendTypes(body)[0] ?? "";
+      const store = resolveRecordStore([body], liveBodies.get(root) ?? []);
       diagnostics.push({
         checkId: "TF024",
-        severity: "error",
-        message:
-          `Root module "${root}" runs choudoufu with a declared estate and also declares a ` +
-          `${blockKind} block. choudoufu refuses this at init: "Both a ${blockKind} and a live ` +
-          `configuration are present." Remove the ${blockKind} block; a live root keeps no state to store.`,
+        severity: "info",
+        message: backendMessage(root, type, store),
         entity: name,
         lexicon: "terraform",
       });

package/dist/rules/tf046.ts

@@ -0,0 +1,204 @@
+/**
+ * TF046: a live root's record store is local, and the lint runs in CI.
+ *
+ * A live root keeps its records (what binds a record-backed resource to the
+ * estate) in a record store. With nothing to say otherwise that store is a
+ * directory beside the module (choudoufu `live/STORAGE.md`), and on a CI
+ * runner the directory is empty on every run: an ordinary resource still binds
+ * by its marker, but a record-backed one is proposed for create again.
+ *
+ * "Local" is what choudoufu resolves, read here through `./record-store.ts`,
+ * the same resolution TF024 names in its message (INTENTIUS/choudoufu#2293):
+ *
+ * - an explicit `record_store "local"` fires;
+ * - an explicit `record_store` of any other kind is quiet, whatever backend
+ *   sits beside it;
+ * - with no `record_store`, an ignored `backend "s3"`, `"gcs"` or `"azurerm"`
+ *   block that names its bucket as a literal gives a derived store and is
+ *   quiet;
+ * - with no `record_store` and no backend, or a backend with no counterpart
+ *   (`local`, `consul`, `http`), or one whose bucket comes only from
+ *   `-backend-config`, the store is implied local and the rule fires, naming
+ *   the reason choudoufu would print.
+ *
+ * A root that is also a Terragrunt unit with a `remote_state`, a `generate`
+ * block that writes a backend, or an `include` of a parent config gets its
+ * backend file at run time, so what chant reads is not what choudoufu sees.
+ * The rule stays quiet there rather than guess; TF044 still reports a
+ * Terragrunt `backend = "local"`.
+ *
+ * CI is read from the environment chant runs in: `CI` set to anything but
+ * `false` or `0`, or `GITHUB_ACTIONS`, `GITLAB_CI`, `FORGEJO_ACTIONS`,
+ * `GITEA_ACTIONS` or `TF_BUILD` (Azure Pipelines) set to `true`. Outside CI the
+ * local store is a reasonable choice for one person or a demo, and the rule
+ * says nothing.
+ *
+ * Opt-outs, for emulator and test lanes that use the local store on purpose:
+ * `CHANT_ALLOW_LOCAL_RECORD_STORE=1` in the lane's environment, or
+ * `# chant-ignore-block: TF046` above the `terraform` block holding `live`
+ * for one root, or
+ * `lint.rules: { TF046: "off" }` for a whole project.
+ *
+ * The rule is `report-only` in the audit catalog, so it is off under the
+ * `recommended` preset: terragucci switches it on and holds the product
+ * wording (chant#4561 placement).
+ *
+ * One diagnostic per root. It fires from the `terraform` block that holds the
+ * `live` block, since suppression comments anchor on top-level blocks only,
+ * and from the sidecar's `Terraform::Live` entity for a sidecar estate, where
+ * `# chant-ignore-file: TF046` in `estate.chdf.hcl` suppresses it.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable, type ResourceDeclarable } from "@intentius/chant/declarable";
+import {
+  LIVE_TYPE,
+  TERRAFORM_TYPE,
+  TERRAGRUNT_CONFIG_TYPE,
+  TERRAGRUNT_GENERATE_TYPE,
+  TERRAGRUNT_REMOTE_STATE_TYPE,
+  type BlockBody,
+} from "../../hcl/parse";
+import { isRootScoped } from "./scope";
+import { resolveRecordStore, type ResolvedRecordStore } from "./record-store";
+
+/** The environment variable an emulator or test lane sets to keep the local store without a finding. */
+export const ALLOW_LOCAL_RECORD_STORE_ENV = "CHANT_ALLOW_LOCAL_RECORD_STORE";
+
+type Env = Readonly<Record<string, string | undefined>>;
+
+const truthy = (v: string | undefined): boolean => v !== undefined && v !== "" && v !== "0" && v.toLowerCase() !== "false";
+
+/** Whether the environment is a CI job. */
+export function isCiEnvironment(env: Env): boolean {
+  if (truthy(env.CI)) return true;
+  for (const name of ["GITHUB_ACTIONS", "GITLAB_CI", "FORGEJO_ACTIONS", "GITEA_ACTIONS", "TF_BUILD"]) {
+    if (env[name]?.toLowerCase() === "true") return true;
+  }
+  return false;
+}
+
+const bodyOf = (entity: ResourceDeclarable): BlockBody => {
+  const props = entity.props as { body?: unknown };
+  return (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+};
+
+const rootOf = (entity: ResourceDeclarable): string => {
+  const root = (entity.props as { root?: unknown }).root;
+  return typeof root === "string" ? root : "";
+};
+
+interface LiveRoot {
+  /** Entity key the finding anchors on: the live declaration's entity, until a `terraform` block holding it is seen. */
+  anchor: string;
+  liveBodies: BlockBody[];
+  terraformBodies: BlockBody[];
+  /** A Terragrunt unit whose backend file is written at run time. */
+  runtimeBackend: boolean;
+}
+
+/** Whether a Terragrunt block in this root writes a backend file at run time. */
+function writesRuntimeBackend(entity: ResourceDeclarable): boolean {
+  const body = bodyOf(entity);
+  switch (entity.entityType) {
+    case TERRAGRUNT_REMOTE_STATE_TYPE:
+      return body.backend !== "local";
+    case TERRAGRUNT_GENERATE_TYPE: {
+      const contents = typeof body.contents === "string" ? body.contents : "";
+      return /\bbackend\s+"(?!local")/.test(contents);
+    }
+    case TERRAGRUNT_CONFIG_TYPE:
+      return Array.isArray(body.includes) && body.includes.length > 0;
+    default:
+      return false;
+  }
+}
+
+function liveRoots(ctx: PostSynthContext): Map<string, LiveRoot> {
+  const roots = new Map<string, LiveRoot>();
+  const terraform = new Map<string, BlockBody[]>();
+  /** Per root, the key of the first `terraform` block that holds a `live` block. */
+  const holder = new Map<string, string>();
+  const runtime = new Set<string>();
+
+  for (const [key, entity] of ctx.entities) {
+    if (!isResourceDeclarable(entity) || !isRootScoped(entity)) continue;
+    const root = rootOf(entity);
+    if (entity.entityType === TERRAFORM_TYPE) {
+      const list = terraform.get(root) ?? [];
+      const body = bodyOf(entity);
+      list.push(body);
+      terraform.set(root, list);
+      if (body.live !== undefined && !holder.has(root)) holder.set(root, key);
+      continue;
+    }
+    if (entity.entityType === LIVE_TYPE) {
+      if ((entity.props as { mode?: unknown }).mode !== "live") continue;
+      const found = roots.get(root);
+      if (found) found.liveBodies.push(bodyOf(entity));
+      else roots.set(root, { anchor: key, liveBodies: [bodyOf(entity)], terraformBodies: [], runtimeBackend: false });
+      continue;
+    }
+    if (writesRuntimeBackend(entity)) runtime.add(root);
+  }
+
+  for (const [root, live] of roots) {
+    live.terraformBodies = terraform.get(root) ?? [];
+    live.anchor = holder.get(root) ?? live.anchor;
+    live.runtimeBackend = runtime.has(root);
+  }
+  return roots;
+}
+
+function message(root: string, store: ResolvedRecordStore): string {
+  const why =
+    store.source === "record_store"
+      ? 'Its live declaration names record_store "local", a directory beside the module.'
+      : store.note
+        ? `It declares no record_store, and no store is derived from its backend: ${store.note}.`
+        : store.backend
+          ? `It declares no record_store, and its backend "${store.backend}" block keeps state on local disk, so choudoufu uses the local store.`
+          : "It declares no record_store and has no backend block to derive one from, so choudoufu uses the local store.";
+  return (
+    `Live root "${root}" keeps its records in the local store, and this is a CI run. ${why} ` +
+    "A CI runner starts with an empty directory every run, so each record-backed resource is proposed " +
+    "for create again. Keep or add a backend \"s3\", \"gcs\" or \"azurerm\" block with a literal bucket " +
+    "(choudoufu derives the store from it), or declare a record_store in the live block or " +
+    `estate.chdf.hcl. A lane that uses the local store on purpose sets ${ALLOW_LOCAL_RECORD_STORE_ENV}=1.`
+  );
+}
+
+/**
+ * TF046 against an explicit environment. `tf046.check` passes `process.env`;
+ * tests pass their own.
+ */
+export function checkLocalRecordStore(ctx: PostSynthContext, env: Env): PostSynthDiagnostic[] {
+  if (!isCiEnvironment(env) || truthy(env[ALLOW_LOCAL_RECORD_STORE_ENV])) return [];
+  const diagnostics: PostSynthDiagnostic[] = [];
+  for (const [root, live] of liveRoots(ctx)) {
+    if (live.runtimeBackend) continue;
+    const store = resolveRecordStore(live.terraformBodies, live.liveBodies);
+    if (store.kind !== "local") continue;
+    diagnostics.push({
+      checkId: "TF046",
+      severity: "error",
+      message: message(root, store),
+      entity: live.anchor,
+      lexicon: "terraform",
+    });
+  }
+  return diagnostics;
+}
+
+export const tf046: PostSynthCheck = {
+  id: "TF046",
+  description: "Live root resolves to the local record store in a CI run",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    return checkLocalRecordStore(ctx, process.env);
+  },
+};

package/dist/rules/tf047.ts

@@ -0,0 +1,114 @@
+/**
+ * TF047: a live root pins a registry module version the known-module catalog
+ * has no row for, or one whose row carries refusals.
+ *
+ * The catalog is choudoufu's module compatibility table, vendored in
+ * `../../module-catalog/` (chant#4560, choudoufu#2292). It has one static
+ * row per terraform-aws-modules example at one tag, measured offline in the
+ * onboarded form. A module call on a root whose binary is choudoufu (the
+ * root's `mode` is `live`) with an exact `version` is looked up there:
+ *
+ * - no row for the module, or none at the pinned version: `info`, naming the
+ *   versions the static tier did measure;
+ * - at least one example at that version refused: `warning`, with each
+ *   refusal ID, its site count, the examples that carry it and its
+ *   `live/LIMITATIONS.md` link;
+ * - every example clear: quiet.
+ *
+ * Every message names the tier. The catalog holds the static tier only, and
+ * no figure here counts a gauntlet run (choudoufu#2292 ruling: two tiers,
+ * never mixed).
+ *
+ * A stock root (`mode: "state"`) is skipped: the table measures choudoufu.
+ * A range is TF039's finding and a missing `version` TF004's, so both are
+ * skipped here. A `//subdir` source is looked up by its module repository.
+ *
+ * Off by default: `report-only` in the audit catalog, as TF039 is.
+ * terragucci turns it on and holds the product wording (terragucci#1286).
+ *
+ * Scope: root and child modules of a live root alike.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE, type BlockBody } from "../../hcl/parse";
+import { classifyModuleSource, isExactVersionConstraint } from "./module-source";
+import {
+  MODULE_CATALOG_SOURCE,
+  MODULE_COMPATIBILITY_PAGE,
+  moduleCompatibility,
+  type ModuleCompatibility,
+} from "../../module-catalog";
+
+const tierNote = (): string =>
+  `static tier of choudoufu's module table, measured ${MODULE_CATALOG_SOURCE.date} with hashicorp/aws ${MODULE_CATALOG_SOURCE.awsProvider}`;
+
+/** The TF047 message for one module call, or undefined when the call is clear. */
+export function catalogMessage(address: string, c: ModuleCompatibility): string | undefined {
+  const pin = `${c.module} ${c.version}`;
+  switch (c.status) {
+    case "clear":
+      return undefined;
+    case "unknown-module":
+      return (
+        `Module "${address}" pins ${pin}, and the ${tierNote()} has no row for this module. ` +
+        `Run \`choudoufu live-check\` on the root to see whether it plans. The table: ${MODULE_COMPATIBILITY_PAGE}`
+      );
+    case "unknown-version":
+      return (
+        `Module "${address}" pins ${pin}, and the ${tierNote()} has no row at this version. ` +
+        `It measured ${c.measuredVersions.join(", ")}. ` +
+        `Run \`choudoufu live-check\` on the root, or pin a measured version. The table: ${MODULE_COMPATIBILITY_PAGE}`
+      );
+    case "refused": {
+      const ids = c.refusals
+        .map((r) => `${r.id} (${r.sites} site${r.sites === 1 ? "" : "s"} in ${r.examples.join(", ")}; ${r.docsUrl})`)
+        .join("; ");
+      return (
+        `Module "${address}" pins ${pin}. In the ${tierNote()}, ${c.refusedExamples} of ${c.examples} ` +
+        `examples at this version are refused: ${ids}. ` +
+        "A call that uses the same features is refused the same way; `choudoufu live-check` names each site in this root."
+      );
+    }
+  }
+}
+
+export const tf047: PostSynthCheck = {
+  id: "TF047",
+  description: "Live root pins a module version the known-module catalog has no row for, or one with refusals",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const [key, entity] of ctx.entities) {
+      if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity)) continue;
+      const props = entity.props as { address?: unknown; body?: unknown; mode?: unknown };
+      if (props.mode !== "live") continue;
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const source = typeof body.source === "string" ? body.source : undefined;
+      if (source === undefined || classifyModuleSource(source).kind !== "registry") continue;
+      const version = body.version;
+      if (typeof version !== "string" || !isExactVersionConstraint(version)) continue;
+
+      const compat = moduleCompatibility(source, version);
+      if (compat === undefined) continue;
+      const address = typeof props.address === "string" ? props.address : key;
+      const message = catalogMessage(address, compat);
+      if (message === undefined) continue;
+
+      diagnostics.push({
+        checkId: "TF047",
+        severity: compat.status === "refused" ? "warning" : "info",
+        message,
+        entity: key,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/dist/state/azure-blob.d.ts

@@ -1,68 +1,9 @@
-import { type StoreFetch } from "./object-store.js";
-/** The REST version every request names. */
-export declare const AZURE_VERSION = "2021-08-06";
-/** Entra ID's public cloud. */
-export declare const AZURE_AUTHORITY = "https://login.microsoftonline.com";
-export interface AzureLocation {
-    account: string;
-    container: string;
-    /** The account's blob endpoint, no trailing slash: https://<account>.blob.core.windows.net, or an emulator's http://host:10000/<account>. */
-    endpoint: string;
-}
-/** The job's federated identity: an Entra app or managed identity that trusts the forge's token. */
-export interface AzureOidc {
-    tenantId: string;
-    clientId: string;
-    tokenFile: string;
-    /** Entra ID's address, https://host, no path. */
-    authority: string;
-}
-export type AzureTarget = AzureLocation & ({
-    accountKey: string;
-} | {
-    oidc: AzureOidc;
-} | {
-    sas: string;
-});
-/** A blob's properties, as a HEAD answers them: never its body. */
-export interface BlobHead {
-    exists: boolean;
-    etag?: string;
-    /** x-ms-lease-state: `leased` while a lease holds it. */
-    leaseState?: string;
-    /** Its metadata, by name without the x-ms-meta- prefix. */
-    metadata: Record<string, string>;
-}
-/** The Shared Key Authorization header for a request. */
-export declare function sharedKey(account: string, accountKey: string, method: string, rawUrl: string, headers: Record<string, string>): string;
-export declare class AzureBlobClient {
-    readonly target: AzureTarget;
-    private readonly fetchFn;
-    private readonly readToken;
-    private token?;
-    constructor(target: AzureTarget, fetchFn?: StoreFetch, readToken?: (file: string) => string);
-    private where;
-    private blobUrl;
-    /** The storage token for the OIDC identity: once per client, again a minute before it expires. */
-    private bearer;
-    /** The headers for one request, signed or with the bearer token. */
-    private headers;
-    get(key: string): Promise<string | undefined>;
-    /** A blob's properties and metadata, from a HEAD. */
-    head(key: string): Promise<BlobHead>;
-    /** Take a snapshot of a blob: its id, the time Azure gives it. */
-    snapshot(key: string): Promise<string>;
-    /** Write a block blob with metadata, under a lease when one holds it; with `ifNoneMatch`, only when there is none (false when one was there). */
-    putBlob(key: string, body: string, contentType: string, options?: {
-        leaseId?: string;
-        metadata?: Record<string, string>;
-        ifNoneMatch?: boolean;
-    }): Promise<boolean>;
-    /** Delete a blob. One that is not there is deleted already. */
-    remove(key: string): Promise<void>;
-    /** A blob lease: acquire one that never expires with the id given (false when one holds it), or release it. */
-    lease(key: string, action: "acquire" | "release", id: string): Promise<boolean>;
-    /** Set a blob's metadata, all of it, under its lease when one holds it. */
-    setMetadata(key: string, metadata: Record<string, string>, leaseId?: string): Promise<void>;
-}
+/**
+ * The Azure Blob Storage client an azurerm backend's state uses: chant
+ * core's (#4554, `@intentius/chant/object-store`): a blob's properties and
+ * metadata, a snapshot, a block blob put, and the blob lease the backend
+ * locks a state with, signed with Shared Key, a SAS, or an Entra token for
+ * the job's OIDC identity.
+ */
+export { AZURE_AUTHORITY, AZURE_VERSION, AzureBlobClient, sharedKey, type AzureLocation, type AzureOidc, type AzureTarget, type BlobHead } from "@intentius/chant/object-store";
 //# sourceMappingURL=azure-blob.d.ts.map

package/dist/state/azure-blob.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"azure-blob.d.ts","sourceRoot":"","sources":["../../src/state/azure-blob.ts"],"names":[],"mappings":"AAeA,OAAO,EAAiD,KAAK,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEhG,4CAA4C;AAC5C,eAAO,MAAM,aAAa,eAAe,CAAC;AAE1C,+BAA+B;AAC/B,eAAO,MAAM,eAAe,sCAAsC,CAAC;AAInE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,6IAA6I;IAC7I,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,WAAW,GAAG,aAAa,GAAG,CAAC;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3G,mEAAmE;AACnE,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAOD,yDAAyD;AACzD,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAUtI;AAaD,qBAAa,eAAe;IAGd,QAAQ,CAAC,MAAM,EAAE,WAAW;IAAE,OAAO,CAAC,QAAQ,CAAC,OAAO;IAA6B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAFzH,OAAO,CAAC,KAAK,CAAC,CAA8C;IAE5D,YAAqB,MAAM,EAAE,WAAW,EAAmB,OAAO,GAAE,UAAyB,EAAmB,SAAS,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAwC,EAAI;IAEzL,OAAO,CAAC,KAAK;IAIb,OAAO,CAAC,OAAO;IAMf,kGAAkG;YACpF,MAAM;IAsCpB,oEAAoE;YACtD,OAAO;IAQf,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAMlD;IAED,qDAAqD;IAC/C,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAczC;IAED,kEAAkE;IAC5D,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO3C;IAED,iJAAiJ;IAC3I,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAe5K;IAED,+DAA+D;IACzD,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIvC;IAED,+GAA+G;IACzG,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,SAAS,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOpF;IAED,2EAA2E;IACrE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhG;CACF"}
+{"version":3,"file":"azure-blob.d.ts","sourceRoot":"","sources":["../../src/state/azure-blob.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,+BAA+B,CAAC"}