@intentius/chant-lexicon-terraform 0.124.54 → 0.124.56

package/dist/used-sources.js

@@ -0,0 +1,157 @@
+/**
+ * Every module source and provider address a root uses (chant#3924), read
+ * from its files before `init` downloads anything, so a product can check
+ * them against an allow list (terragucci's `sources:`) or a proxy map
+ * (chant#4606) in a check job.
+ *
+ * For a root and, with `followLocal`, each local module it calls (`./` and
+ * `../`, followed down to the modules they call), it reads each `module`
+ * block's `source`, each `required_providers` entry, and the providers a
+ * module uses with no entry: a `provider` block, or a resource, data or
+ * ephemeral block's `provider` argument or type prefix, which `init` installs
+ * as `hashicorp/<name>`. In the root itself it also reads a Terragrunt unit's
+ * `terraform { source }`. Files are `.tf`, `.tofu` and their `.json` forms;
+ * `binary` narrows them to the set that binary reads, with OpenTofu's rule
+ * that `x.tofu` hides `x.tf`.
+ *
+ * Each source carries its file and its block path from the root
+ * (`module.a > module.b > required_providers.x`) and its normal form
+ * (./registry/source-forms.ts). A local call that cannot be followed
+ * (outside the project, or missing) is named in `unread`, since what it
+ * uses cannot be read.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, posix, relative, sep } from "node:path";
+import { loadHcl2json } from "@intentius/chant/terraform/hcl2json";
+import { isJsonConfigFile, jsonConfigTree, selectConfigFiles } from "./hcl/files.js";
+import { impliedProvider, normalizeModuleSource, providerAddress, withoutQuery } from "./registry/source-forms.js";
+/** A block list as hcl2json writes it (an array) or a JSON file may (one object). */
+const bodies = (v) => (Array.isArray(v) ? v : v && typeof v === "object" ? [v] : []);
+const ALL_SUFFIXES = [".tf", ".tofu", ".tf.json", ".tofu.json"];
+/** The configuration files of one module directory, plus terragrunt.hcl when `terragrunt`. */
+function moduleFiles(dir, terragrunt, binary) {
+    if (!existsSync(dir) || !statSync(dir).isDirectory())
+        return [];
+    const names = readdirSync(dir).filter((n) => {
+        try {
+            return statSync(join(dir, n)).isFile();
+        }
+        catch {
+            return false;
+        }
+    });
+    const config = binary ? selectConfigFiles(names, binary) : names.filter((n) => ALL_SUFFIXES.some((s) => n.endsWith(s))).sort();
+    return terragrunt && names.includes("terragrunt.hcl") ? [...config, "terragrunt.hcl"] : config;
+}
+/** The local name of the provider a resource, data or ephemeral block uses: its `provider` argument's, else its type's prefix. */
+function providerOf(type, body) {
+    const ref = typeof body.provider === "string" ? /^(?:\$\{)?([A-Za-z][A-Za-z0-9_-]*)/.exec(body.provider) : null;
+    return ref ? ref[1] : type.split("_")[0];
+}
+const isLocal = (source) => /^\.\.?\//.test(source);
+async function readDir(abs, shown, prefix, top, o) {
+    const providers = [];
+    const calls = [];
+    const declared = new Set();
+    const implied = new Map();
+    const provider = (file, block, source, what) => ({
+        kind: "provider",
+        file,
+        block,
+        source,
+        normal: providerAddress(source, { binary: o.binary, proxies: o.proxies }) ?? source.trim().toLowerCase(),
+        ...(what ? { implied: what } : {}),
+    });
+    for (const name of moduleFiles(abs, top, o.binary)) {
+        const file = shown === "." ? name : posix.join(shown, name);
+        const text = readFileSync(join(abs, name), "utf-8");
+        let tree;
+        try {
+            tree = (isJsonConfigFile(name) ? jsonConfigTree(text) : await o.parser.parse(file, text));
+        }
+        catch (e) {
+            throw new Error(`${file} could not be read (${e.message.split("\n")[0]}), so its module and provider sources are unknown`);
+        }
+        if (name === "terragrunt.hcl") {
+            for (const b of bodies(tree.terraform))
+                if (typeof b.source === "string")
+                    calls.push({ file, block: `${prefix}terraform`, source: b.source });
+            continue;
+        }
+        for (const [call, list] of Object.entries(tree.module ?? {})) {
+            for (const b of bodies(list))
+                if (typeof b.source === "string")
+                    calls.push({ file, block: `${prefix}module.${call}`, source: b.source });
+        }
+        for (const t of bodies(tree.terraform)) {
+            for (const req of bodies(t.required_providers)) {
+                for (const [local, v] of Object.entries(req)) {
+                    declared.add(local);
+                    const source = v && typeof v === "object" && typeof v.source === "string" ? v.source : `hashicorp/${local}`;
+                    providers.push(provider(file, `${prefix}required_providers.${local}`, source));
+                }
+            }
+        }
+        for (const local of Object.keys(tree.provider ?? {}))
+            if (!implied.has(local))
+                implied.set(local, { file, what: `provider "${local}"` });
+        for (const kind of ["resource", "data", "ephemeral"]) {
+            for (const [type, named] of Object.entries(tree[kind] ?? {})) {
+                for (const [name, list] of Object.entries(named ?? {})) {
+                    for (const b of bodies(list)) {
+                        const local = providerOf(type, b);
+                        if (!implied.has(local))
+                            implied.set(local, { file, what: `${kind} "${type}" "${name}"` });
+                    }
+                }
+            }
+        }
+    }
+    for (const [local, at] of implied) {
+        const source = declared.has(local) ? undefined : impliedProvider(local);
+        if (source)
+            providers.push(provider(at.file, `${prefix}provider.${local}`, source, at.what));
+    }
+    return { providers, calls };
+}
+/**
+ * Every module source and provider address the root at `dir` uses, and each
+ * local call that could not be followed. Throws, naming the file, when a
+ * file cannot be parsed, so a check fails loudly instead of checking less.
+ */
+export async function usedSources(dir, options = {}) {
+    const project = options.project ?? dir;
+    const o = { ...options, parser: options.parser ?? (await loadHcl2json()) };
+    const follow = options.followLocal !== false;
+    const used = [];
+    const unread = [];
+    const shownOf = (abs) => relative(project, abs).split(sep).join("/") || ".";
+    const walk = async (rel, prefix, chain, top) => {
+        const { providers, calls } = await readDir(join(project, rel), rel, prefix, top, o);
+        used.push(...providers);
+        for (const c of calls) {
+            used.push({ kind: "module", file: c.file, block: c.block, source: c.source, normal: isLocal(c.source) ? withoutQuery(c.source) : normalizeModuleSource(withoutQuery(c.source), { binary: o.binary, proxies: o.proxies }) });
+            if (!follow || !isLocal(c.source))
+                continue;
+            // A Terragrunt source's `//` marks the directory it copies; the module is the path with it read as one `/`.
+            const path = withoutQuery(c.source).replace(/\/\/+/g, "/");
+            const next = posix.normalize(posix.join(rel, path)).replace(/\/+$/, "") || ".";
+            if (next === ".." || next.startsWith("../")) {
+                unread.push({ file: c.file, block: c.block, source: c.source, why: "it is outside the project, so the sources it uses cannot be read" });
+                continue;
+            }
+            if (!existsSync(join(project, next))) {
+                unread.push({ file: c.file, block: c.block, source: c.source, why: `${next} does not exist, so the sources it uses cannot be read` });
+                continue;
+            }
+            if (chain.includes(next) || moduleFiles(join(project, next), false, o.binary).length === 0)
+                continue;
+            await walk(next, `${c.block} > `, [...chain, next], false);
+        }
+    };
+    const start = shownOf(dir);
+    if (start === ".." || start.startsWith("../"))
+        throw new Error(`${dir} is outside the project ${project}`);
+    await walk(start, "", [start], true);
+    return { used, unread };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.124.54",
+  "version": "0.124.56",
   "type": "module",
   "files": [
     "src/",
@@ -34,6 +34,11 @@
       "types": "./dist/pin/index.d.ts",
       "default": "./dist/pin/index.js"
     },
+    "./module-catalog": {
+      "development": "./src/module-catalog/index.ts",
+      "types": "./dist/module-catalog/index.d.ts",
+      "default": "./dist/module-catalog/index.js"
+    },
     "./terragrunt": {
       "development": "./src/terragrunt/index.ts",
       "types": "./dist/terragrunt/index.d.ts",
@@ -44,6 +49,16 @@
       "types": "./dist/state/index.d.ts",
       "default": "./dist/state/index.js"
     },
+    "./registry": {
+      "development": "./src/registry/index.ts",
+      "types": "./dist/registry/index.d.ts",
+      "default": "./dist/registry/index.js"
+    },
+    "./registry/edge": {
+      "development": "./src/registry/edge/index.ts",
+      "types": "./dist/registry/edge/index.d.ts",
+      "default": "./dist/registry/edge/index.js"
+    },
     "./lint/post-synth": {
       "development": "./src/lint/post-synth/index.ts",
       "types": "./dist/lint/post-synth/index.d.ts",
@@ -59,7 +74,8 @@
     "docs": "npx tsx src/codegen/docs-cli.ts",
     "build": "../../scripts/tsc7.sh -p tsconfig.build.json --sourceMap false && tsc-alias -p tsconfig.build.json",
     "prepack": "npm run generate && npm run bundle && npm run validate && npm run build",
-    "bundle": "tsx src/package-cli.ts"
+    "bundle": "tsx src/package-cli.ts",
+    "module-catalog:refresh": "npx tsx src/module-catalog/refresh-cli.ts"
   },
   "devDependencies": {
     "@cdktn/hcl2json": "^0.24.0",
@@ -72,7 +88,7 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.124.54",
+    "@intentius/chant": "^0.124.56",
     "zod": "^4.3.6"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/__fixtures__/drift-record/README.md

@@ -9,3 +9,8 @@ It was not recorded from a run.
 
 `drift-record.test.ts` also reads the recorded fixtures one directory up: `live-plan.json`,
 `live-ls.json`, `show-state.json`, `show-plan.json` and `live-plan-depth/`.
+
+`../drift-rows/` holds two hand-written plans for `drift-rows.test.ts` (#4580), also not recorded
+from a run: `refresh-plan.json`, a stock root's refresh-only plan whose `resource_drift` has an update,
+a delete, a create and a data row, and `live-root-plan.json`, a full plan of a root under live resource
+markers with a create, a delete, an update, both replacement orders, a no-op and two data rows.

package/src/__fixtures__/drift-rows/live-root-plan.json

@@ -0,0 +1,70 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.9.8",
+  "resource_drift": [
+    {
+      "address": "aws_s3_bucket.ignored",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "change": { "actions": ["update"], "before": { "bucket": "ignored" }, "after": { "bucket": "ignored-too" } }
+    }
+  ],
+  "resource_changes": [
+    {
+      "address": "aws_s3_bucket.assets",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "assets",
+      "change": { "actions": ["create"], "before": null, "after": { "bucket": "acme-assets" }, "after_unknown": { "arn": true, "id": true } }
+    },
+    {
+      "address": "aws_sqs_queue.stray",
+      "mode": "managed",
+      "type": "aws_sqs_queue",
+      "name": "stray",
+      "change": { "actions": ["delete"], "before": { "name": "acme-stray", "id": "https://sqs.local/000000000000/acme-stray" }, "after": null }
+    },
+    {
+      "address": "aws_lambda_function.api",
+      "mode": "managed",
+      "type": "aws_lambda_function",
+      "name": "api",
+      "change": { "actions": ["update"], "before": { "function_name": "acme-api", "memory_size": 256, "version": "7" }, "after": { "function_name": "acme-api", "memory_size": 512 }, "after_unknown": { "version": true } }
+    },
+    {
+      "address": "aws_iam_role.deployer",
+      "mode": "managed",
+      "type": "aws_iam_role",
+      "name": "deployer",
+      "change": { "actions": ["delete", "create"], "before": { "name": "acme-deployer-old", "arn": "arn:aws:iam::000000000000:role/acme-deployer-old" }, "after": { "name": "acme-deployer" }, "after_unknown": { "arn": true } }
+    },
+    {
+      "address": "aws_security_group.edge",
+      "mode": "managed",
+      "type": "aws_security_group",
+      "name": "edge",
+      "change": { "actions": ["create", "delete"], "before": { "name": "", "id": "sg-0001" }, "after": { "name": "" }, "after_unknown": { "id": true } }
+    },
+    {
+      "address": "aws_s3_bucket.steady",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "steady",
+      "change": { "actions": ["no-op"], "before": { "bucket": "acme-steady" }, "after": { "bucket": "acme-steady" } }
+    },
+    {
+      "address": "data.aws_region.here",
+      "mode": "data",
+      "type": "aws_region",
+      "name": "here",
+      "change": { "actions": ["read"], "before": null, "after": { "name": "us-east-1" } }
+    },
+    {
+      "address": "data.aws_caller_identity.me",
+      "mode": "data",
+      "type": "aws_caller_identity",
+      "name": "me",
+      "change": { "actions": ["update"], "before": { "account_id": "000000000000" }, "after": { "account_id": "000000000001" } }
+    }
+  ]
+}

package/src/__fixtures__/drift-rows/refresh-plan.json

@@ -0,0 +1,61 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.9.8",
+  "prior_state": {
+    "values": {
+      "root_module": {
+        "resources": [
+          { "address": "aws_s3_bucket.logs", "mode": "managed", "type": "aws_s3_bucket", "values": { "bucket": "acme-logs", "tags": { "team": "data" } } },
+          { "address": "aws_lambda_function.worker", "mode": "managed", "type": "aws_lambda_function", "values": { "function_name": "acme-worker", "memory_size": 128 } },
+          { "address": "aws_iam_role.runner", "mode": "managed", "type": "aws_iam_role", "values": { "name": "acme-runner", "arn": "arn:aws:iam::000000000000:role/acme-runner" } }
+        ]
+      }
+    }
+  },
+  "resource_drift": [
+    {
+      "address": "aws_s3_bucket.logs",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "logs",
+      "change": { "actions": ["update"], "before": { "bucket": "acme-logs", "tags": { "team": "data" } }, "after": { "bucket": "acme-logs", "tags": { "team": "ops" } } }
+    },
+    {
+      "address": "aws_lambda_function.worker",
+      "mode": "managed",
+      "type": "aws_lambda_function",
+      "name": "worker",
+      "change": { "actions": ["delete"], "before": { "function_name": "acme-worker", "memory_size": 128 }, "after": null }
+    },
+    {
+      "address": "aws_sqs_queue.jobs",
+      "mode": "managed",
+      "type": "aws_sqs_queue",
+      "name": "jobs",
+      "change": { "actions": ["create"], "before": null, "after": { "name": "acme-jobs", "id": "https://sqs.local/000000000000/acme-jobs" } }
+    },
+    {
+      "address": "aws_iam_role.runner",
+      "mode": "managed",
+      "type": "aws_iam_role",
+      "name": "runner",
+      "change": { "actions": ["update"], "before": { "name": "", "arn": "arn:aws:iam::000000000000:role/acme-runner" }, "after": { "name": "", "arn": "arn:aws:iam::000000000000:role/acme-runner", "max_session_duration": 7200 } }
+    },
+    {
+      "address": "data.aws_caller_identity.me",
+      "mode": "data",
+      "type": "aws_caller_identity",
+      "name": "me",
+      "change": { "actions": ["update"], "before": { "account_id": "000000000000" }, "after": { "account_id": "000000000001" } }
+    }
+  ],
+  "resource_changes": [
+    {
+      "address": "aws_s3_bucket.logs",
+      "mode": "managed",
+      "type": "aws_s3_bucket",
+      "name": "logs",
+      "change": { "actions": ["no-op"], "before": { "bucket": "acme-logs", "tags": { "team": "ops" } }, "after": { "bucket": "acme-logs", "tags": { "team": "ops" } } }
+    }
+  ]
+}

package/src/__fixtures__/used-sources/root/extra.tofu

@@ -0,0 +1 @@
+provider "google" {}

package/src/__fixtures__/used-sources/root/main.tf

@@ -0,0 +1,31 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+module "vpc" {
+  source  = "terraform-aws-modules/vpc/aws"
+  version = "5.1.0"
+}
+
+module "net" {
+  source = "./modules/net"
+}
+
+module "gone" {
+  source = "./modules/missing"
+}
+
+module "outside" {
+  source = "../../outside"
+}
+
+resource "random_id" "x" {
+  byte_length = 4
+}
+
+resource "terraform_data" "t" {}

package/src/__fixtures__/used-sources/root/modules/net/main.tf

@@ -0,0 +1,14 @@
+module "sg" {
+  source = "git::https://git.acme.dev/sg.git?ref=v1.0.0"
+}
+
+module "back" {
+  source = "../.."
+}
+
+resource "aws_vpc" "v" {
+  provider   = aws.west
+  cidr_block = "10.0.0.0/16"
+}
+
+resource "thing_widget" "w" {}

package/src/__fixtures__/used-sources/root/modules/net/versions.tf.json

@@ -0,0 +1,7 @@
+{
+  "terraform": {
+    "required_providers": {
+      "thing": { "source": "Registry.Acme.dev/acme/thing" }
+    }
+  }
+}

package/src/__fixtures__/used-sources/unit/terragrunt.hcl

@@ -0,0 +1,3 @@
+terraform {
+  source = "tfr:///acme/vpc/aws?version=1.0.0"
+}

package/src/ci-setup.ts

@@ -0,0 +1,42 @@
+/**
+ * The engine install lines a Terraform project's pull request pipeline runs
+ * in chant's default image (#4550, `LexiconPlugin.ciSetup`): OpenTofu, and
+ * choudoufu when a root runs it. Each line skips the install when the binary
+ * is already on PATH.
+ *
+ * Whether a root runs choudoufu is read from the text of the project's
+ * `chant.config.ts` (`binary: "choudoufu"`), never by running it, as lexicon
+ * detection reads source.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { PR_LOOP_SETUP } from "@intentius/chant/components/pr-pipeline";
+
+/** The choudoufu release the default lines install. A product's images pin their own. */
+export const CHOUDOUFU_CI_VERSION = "0.31.0";
+
+/** choudoufu into /usr/local/bin from its release archive. */
+export function choudoufuInstallLine(version = CHOUDOUFU_CI_VERSION): string {
+  const arch = `$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')`;
+  const url = `https://github.com/INTENTIUS/choudoufu/releases/download/v${version}/choudoufu_v${version}_linux_${arch}.tar.gz`;
+  return `command -v choudoufu >/dev/null 2>&1 || (mkdir -p /tmp/choudoufu && curl -fsSL "${url}" | tar -xz -C /tmp/choudoufu && install "$(find /tmp/choudoufu -type f -name choudoufu | head -n 1)" /usr/local/bin/choudoufu)`;
+}
+
+/** Whether the project's config names choudoufu as a root's binary. */
+export function usesChoudoufu(dir: string): boolean {
+  for (const name of ["chant.config.ts", "chant.config.mts", "chant.config.js"]) {
+    const file = join(dir, name);
+    if (!existsSync(file)) continue;
+    try {
+      if (/binary\s*:\s*["']choudoufu["']/.test(readFileSync(file, "utf-8"))) return true;
+    } catch {
+      // unreadable: no choudoufu line
+    }
+  }
+  return false;
+}
+
+/** The lines for the project at `dir`. */
+export function terraformCiSetup(ctx: { dir: string }): string[] {
+  return [...PR_LOOP_SETUP, ...(usesChoudoufu(ctx.dir) ? [choudoufuInstallLine()] : [])];
+}

package/src/components/capability-plugin.test.ts

@@ -24,6 +24,9 @@ const planTexts: Array<boolean | undefined> = [];
 let planError: Error | undefined;
 
 vi.mock("../op/activities/terraform", () => ({
+  // The exit constants exit-codes.ts maps choudoufu's statuses with (#4553), as the module has them.
+  CHOUDOUFU_APPROVAL_EXIT_CODE: 3,
+  CHOUDOUFU_WAVE_EXIT: { landed: 0, error: 1, setMoved: 3, rootFailed: 4 },
   choudoufuWaveRoot: vi.fn(async () => waveRoot),
   choudoufuPlanSet: vi.fn(async (args: { root: string }) => {
     calls.push(`plan-set ${args.root}`);
@@ -52,7 +55,8 @@ vi.mock("../op/activities/terraform", () => ({
     planTargets.push(args.targets);
     planTexts.push(args.text);
     if (planError) throw planError;
-    return { planFile: "chant.tfplan", planDigest: `jcs1-sha256:${args.root}`, json: planJson, ...(changeSet ? { changeSet } : {}) };
+    // `dir` as the real result has it (#4545 writes the plan document beside the plan file there).
+    return { planFile: "chant.tfplan", dir: `/x/${args.root}`, planDigest: `jcs1-sha256:${args.root}`, json: planJson, ...(changeSet ? { changeSet } : {}) };
   }),
   terraformApply: vi.fn(async (args: { root: string; planFile: string }) => {
     calls.push(`apply ${args.root} ${args.planFile}`);
@@ -133,7 +137,8 @@ describe("terraform-apply on a choudoufu root in a gated wave (#3459)", () => {
     expect(calls).toEqual(["plan-set e01"]);
     expect(planned.member).toBe("e01");
     expect(planned.planDigest).toBe("jcs1-sha256:e01");
-    expect(planned.artifact).toEqual(wavePlan);
+    // #4552: the set path keeps the root's lock rows beside the plan (none here: the fake set's plan has no changes).
+    expect(planned.artifact).toEqual({ ...wavePlan, lockRows: [] });
     expect(planned.changeSet).toEqual({ member: { member: "e01", nativeDigest: "sha256:root-e01" }, entries: [] });
   });
 
@@ -203,7 +208,7 @@ describe("terraform-apply on a choudoufu root in a gated wave (#3459)", () => {
 
 describe("terraform-apply", () => {
   test("the plugin contributes it", () => {
-    expect(terraformCapabilityPlugin.capabilities().map((c) => c.kind)).toEqual(["terraform-apply"]);
+    expect(terraformCapabilityPlugin.capabilities().map((c) => c.kind)).toEqual(["terraform-apply", "terraform-state-unlock", "terraform-state-push", "terraform-copy"]);
   });
 
   test("plan inits and plans the root, with its vars, and names the root as the member", async () => {
@@ -341,17 +346,24 @@ describe("terraform-apply, continued", () => {
     expect(calls).not.toContain("output app");
   });
 
-  test.each(["approval-mismatch", "wrong-estate"])(
-    "choudoufu's %s refusal of the wave's plan throws core's plan-moved mark, so the command exits 3 (#3997)",
-    async (refused) => {
-      applyResult = { applied: false, refused, refusal: "refused" };
-      const err = await terraformApplyCapability
-        .run({ env: "test", component: "app", plans: { app: { planFile: "chant.tfplan", planDigest: "d" } } }, { root: "app" })
-        .catch((e: unknown) => e);
-      expect(err).toBeInstanceOf(TerraformPlanMovedError);
-      expect(isPlanMovedError(err)).toBe(true);
-    },
-  );
+  test("choudoufu's approval-mismatch refusal of the wave's plan throws core's plan-moved mark, so the command exits moved (#3997, #4553)", async () => {
+    applyResult = { applied: false, refused: "approval-mismatch", refusal: "refused" };
+    const err = await terraformApplyCapability
+      .run({ env: "test", component: "app", plans: { app: { planFile: "chant.tfplan", planDigest: "d" } } }, { root: "app" })
+      .catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(TerraformPlanMovedError);
+    expect(isPlanMovedError(err)).toBe(true);
+  });
+
+  test("choudoufu's wrong-estate refusal is an ordinary failure: the pipeline handed the wrong file, and no approval fixes that (#4553)", async () => {
+    applyResult = { applied: false, refused: "wrong-estate", refusal: "refused" };
+    const err = await terraformApplyCapability
+      .run({ env: "test", component: "app", plans: { app: { planFile: "chant.tfplan", planDigest: "d" } } }, { root: "app" })
+      .catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(Error);
+    expect(err).not.toBeInstanceOf(TerraformPlanMovedError);
+    expect(isPlanMovedError(err)).toBe(false);
+  });
 
   test("a refusal of a plan this run made itself is an ordinary failure: the next run plans afresh", async () => {
     applyResult = { applied: false, refused: "approval-mismatch", refusal: "refused" };