@intentius/chant-lexicon-terraform 0.124.54 → 0.124.56

package/dist/lint/post-synth/tf046.d.ts

@@ -0,0 +1,64 @@
+/**
+ * TF046: a live root's record store is local, and the lint runs in CI.
+ *
+ * A live root keeps its records (what binds a record-backed resource to the
+ * estate) in a record store. With nothing to say otherwise that store is a
+ * directory beside the module (choudoufu `live/STORAGE.md`), and on a CI
+ * runner the directory is empty on every run: an ordinary resource still binds
+ * by its marker, but a record-backed one is proposed for create again.
+ *
+ * "Local" is what choudoufu resolves, read here through `./record-store.ts`,
+ * the same resolution TF024 names in its message (INTENTIUS/choudoufu#2293):
+ *
+ * - an explicit `record_store "local"` fires;
+ * - an explicit `record_store` of any other kind is quiet, whatever backend
+ *   sits beside it;
+ * - with no `record_store`, an ignored `backend "s3"`, `"gcs"` or `"azurerm"`
+ *   block that names its bucket as a literal gives a derived store and is
+ *   quiet;
+ * - with no `record_store` and no backend, or a backend with no counterpart
+ *   (`local`, `consul`, `http`), or one whose bucket comes only from
+ *   `-backend-config`, the store is implied local and the rule fires, naming
+ *   the reason choudoufu would print.
+ *
+ * A root that is also a Terragrunt unit with a `remote_state`, a `generate`
+ * block that writes a backend, or an `include` of a parent config gets its
+ * backend file at run time, so what chant reads is not what choudoufu sees.
+ * The rule stays quiet there rather than guess; TF044 still reports a
+ * Terragrunt `backend = "local"`.
+ *
+ * CI is read from the environment chant runs in: `CI` set to anything but
+ * `false` or `0`, or `GITHUB_ACTIONS`, `GITLAB_CI`, `FORGEJO_ACTIONS`,
+ * `GITEA_ACTIONS` or `TF_BUILD` (Azure Pipelines) set to `true`. Outside CI the
+ * local store is a reasonable choice for one person or a demo, and the rule
+ * says nothing.
+ *
+ * Opt-outs, for emulator and test lanes that use the local store on purpose:
+ * `CHANT_ALLOW_LOCAL_RECORD_STORE=1` in the lane's environment, or
+ * `# chant-ignore-block: TF046` above the `terraform` block holding `live`
+ * for one root, or
+ * `lint.rules: { TF046: "off" }` for a whole project.
+ *
+ * The rule is `report-only` in the audit catalog, so it is off under the
+ * `recommended` preset: terragucci switches it on and holds the product
+ * wording (chant#4561 placement).
+ *
+ * One diagnostic per root. It fires from the `terraform` block that holds the
+ * `live` block, since suppression comments anchor on top-level blocks only,
+ * and from the sidecar's `Terraform::Live` entity for a sidecar estate, where
+ * `# chant-ignore-file: TF046` in `estate.chdf.hcl` suppresses it.
+ */
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+/** The environment variable an emulator or test lane sets to keep the local store without a finding. */
+export declare const ALLOW_LOCAL_RECORD_STORE_ENV = "CHANT_ALLOW_LOCAL_RECORD_STORE";
+type Env = Readonly<Record<string, string | undefined>>;
+/** Whether the environment is a CI job. */
+export declare function isCiEnvironment(env: Env): boolean;
+/**
+ * TF046 against an explicit environment. `tf046.check` passes `process.env`;
+ * tests pass their own.
+ */
+export declare function checkLocalRecordStore(ctx: PostSynthContext, env: Env): PostSynthDiagnostic[];
+export declare const tf046: PostSynthCheck;
+export {};
+//# sourceMappingURL=tf046.d.ts.map

package/dist/lint/post-synth/tf046.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf046.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf046.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAa1C,wGAAwG;AACxG,eAAO,MAAM,4BAA4B,mCAAmC,CAAC;AAE7E,KAAK,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAIxD,2CAA2C;AAC3C,wBAAgB,eAAe,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAMjD;AA4FD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,GAAG,mBAAmB,EAAE,CAgB5F;AAED,eAAO,MAAM,KAAK,EAAE,cAOnB,CAAC"}

package/dist/lint/post-synth/tf046.js

@@ -0,0 +1,175 @@
+/**
+ * TF046: a live root's record store is local, and the lint runs in CI.
+ *
+ * A live root keeps its records (what binds a record-backed resource to the
+ * estate) in a record store. With nothing to say otherwise that store is a
+ * directory beside the module (choudoufu `live/STORAGE.md`), and on a CI
+ * runner the directory is empty on every run: an ordinary resource still binds
+ * by its marker, but a record-backed one is proposed for create again.
+ *
+ * "Local" is what choudoufu resolves, read here through `./record-store.ts`,
+ * the same resolution TF024 names in its message (INTENTIUS/choudoufu#2293):
+ *
+ * - an explicit `record_store "local"` fires;
+ * - an explicit `record_store` of any other kind is quiet, whatever backend
+ *   sits beside it;
+ * - with no `record_store`, an ignored `backend "s3"`, `"gcs"` or `"azurerm"`
+ *   block that names its bucket as a literal gives a derived store and is
+ *   quiet;
+ * - with no `record_store` and no backend, or a backend with no counterpart
+ *   (`local`, `consul`, `http`), or one whose bucket comes only from
+ *   `-backend-config`, the store is implied local and the rule fires, naming
+ *   the reason choudoufu would print.
+ *
+ * A root that is also a Terragrunt unit with a `remote_state`, a `generate`
+ * block that writes a backend, or an `include` of a parent config gets its
+ * backend file at run time, so what chant reads is not what choudoufu sees.
+ * The rule stays quiet there rather than guess; TF044 still reports a
+ * Terragrunt `backend = "local"`.
+ *
+ * CI is read from the environment chant runs in: `CI` set to anything but
+ * `false` or `0`, or `GITHUB_ACTIONS`, `GITLAB_CI`, `FORGEJO_ACTIONS`,
+ * `GITEA_ACTIONS` or `TF_BUILD` (Azure Pipelines) set to `true`. Outside CI the
+ * local store is a reasonable choice for one person or a demo, and the rule
+ * says nothing.
+ *
+ * Opt-outs, for emulator and test lanes that use the local store on purpose:
+ * `CHANT_ALLOW_LOCAL_RECORD_STORE=1` in the lane's environment, or
+ * `# chant-ignore-block: TF046` above the `terraform` block holding `live`
+ * for one root, or
+ * `lint.rules: { TF046: "off" }` for a whole project.
+ *
+ * The rule is `report-only` in the audit catalog, so it is off under the
+ * `recommended` preset: terragucci switches it on and holds the product
+ * wording (chant#4561 placement).
+ *
+ * One diagnostic per root. It fires from the `terraform` block that holds the
+ * `live` block, since suppression comments anchor on top-level blocks only,
+ * and from the sidecar's `Terraform::Live` entity for a sidecar estate, where
+ * `# chant-ignore-file: TF046` in `estate.chdf.hcl` suppresses it.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE, TERRAFORM_TYPE, TERRAGRUNT_CONFIG_TYPE, TERRAGRUNT_GENERATE_TYPE, TERRAGRUNT_REMOTE_STATE_TYPE, } from "../../hcl/parse.js";
+import { isRootScoped } from "./scope.js";
+import { resolveRecordStore } from "./record-store.js";
+/** The environment variable an emulator or test lane sets to keep the local store without a finding. */
+export const ALLOW_LOCAL_RECORD_STORE_ENV = "CHANT_ALLOW_LOCAL_RECORD_STORE";
+const truthy = (v) => v !== undefined && v !== "" && v !== "0" && v.toLowerCase() !== "false";
+/** Whether the environment is a CI job. */
+export function isCiEnvironment(env) {
+    if (truthy(env.CI))
+        return true;
+    for (const name of ["GITHUB_ACTIONS", "GITLAB_CI", "FORGEJO_ACTIONS", "GITEA_ACTIONS", "TF_BUILD"]) {
+        if (env[name]?.toLowerCase() === "true")
+            return true;
+    }
+    return false;
+}
+const bodyOf = (entity) => {
+    const props = entity.props;
+    return (typeof props.body === "object" && props.body !== null ? props.body : {});
+};
+const rootOf = (entity) => {
+    const root = entity.props.root;
+    return typeof root === "string" ? root : "";
+};
+/** Whether a Terragrunt block in this root writes a backend file at run time. */
+function writesRuntimeBackend(entity) {
+    const body = bodyOf(entity);
+    switch (entity.entityType) {
+        case TERRAGRUNT_REMOTE_STATE_TYPE:
+            return body.backend !== "local";
+        case TERRAGRUNT_GENERATE_TYPE: {
+            const contents = typeof body.contents === "string" ? body.contents : "";
+            return /\bbackend\s+"(?!local")/.test(contents);
+        }
+        case TERRAGRUNT_CONFIG_TYPE:
+            return Array.isArray(body.includes) && body.includes.length > 0;
+        default:
+            return false;
+    }
+}
+function liveRoots(ctx) {
+    const roots = new Map();
+    const terraform = new Map();
+    /** Per root, the key of the first `terraform` block that holds a `live` block. */
+    const holder = new Map();
+    const runtime = new Set();
+    for (const [key, entity] of ctx.entities) {
+        if (!isResourceDeclarable(entity) || !isRootScoped(entity))
+            continue;
+        const root = rootOf(entity);
+        if (entity.entityType === TERRAFORM_TYPE) {
+            const list = terraform.get(root) ?? [];
+            const body = bodyOf(entity);
+            list.push(body);
+            terraform.set(root, list);
+            if (body.live !== undefined && !holder.has(root))
+                holder.set(root, key);
+            continue;
+        }
+        if (entity.entityType === LIVE_TYPE) {
+            if (entity.props.mode !== "live")
+                continue;
+            const found = roots.get(root);
+            if (found)
+                found.liveBodies.push(bodyOf(entity));
+            else
+                roots.set(root, { anchor: key, liveBodies: [bodyOf(entity)], terraformBodies: [], runtimeBackend: false });
+            continue;
+        }
+        if (writesRuntimeBackend(entity))
+            runtime.add(root);
+    }
+    for (const [root, live] of roots) {
+        live.terraformBodies = terraform.get(root) ?? [];
+        live.anchor = holder.get(root) ?? live.anchor;
+        live.runtimeBackend = runtime.has(root);
+    }
+    return roots;
+}
+function message(root, store) {
+    const why = store.source === "record_store"
+        ? 'Its live declaration names record_store "local", a directory beside the module.'
+        : store.note
+            ? `It declares no record_store, and no store is derived from its backend: ${store.note}.`
+            : store.backend
+                ? `It declares no record_store, and its backend "${store.backend}" block keeps state on local disk, so choudoufu uses the local store.`
+                : "It declares no record_store and has no backend block to derive one from, so choudoufu uses the local store.";
+    return (`Live root "${root}" keeps its records in the local store, and this is a CI run. ${why} ` +
+        "A CI runner starts with an empty directory every run, so each record-backed resource is proposed " +
+        "for create again. Keep or add a backend \"s3\", \"gcs\" or \"azurerm\" block with a literal bucket " +
+        "(choudoufu derives the store from it), or declare a record_store in the live block or " +
+        `estate.chdf.hcl. A lane that uses the local store on purpose sets ${ALLOW_LOCAL_RECORD_STORE_ENV}=1.`);
+}
+/**
+ * TF046 against an explicit environment. `tf046.check` passes `process.env`;
+ * tests pass their own.
+ */
+export function checkLocalRecordStore(ctx, env) {
+    if (!isCiEnvironment(env) || truthy(env[ALLOW_LOCAL_RECORD_STORE_ENV]))
+        return [];
+    const diagnostics = [];
+    for (const [root, live] of liveRoots(ctx)) {
+        if (live.runtimeBackend)
+            continue;
+        const store = resolveRecordStore(live.terraformBodies, live.liveBodies);
+        if (store.kind !== "local")
+            continue;
+        diagnostics.push({
+            checkId: "TF046",
+            severity: "error",
+            message: message(root, store),
+            entity: live.anchor,
+            lexicon: "terraform",
+        });
+    }
+    return diagnostics;
+}
+export const tf046 = {
+    id: "TF046",
+    description: "Live root resolves to the local record store in a CI run",
+    check(ctx) {
+        return checkLocalRecordStore(ctx, process.env);
+    },
+};

package/dist/lint/post-synth/tf047.d.ts

@@ -0,0 +1,36 @@
+/**
+ * TF047: a live root pins a registry module version the known-module catalog
+ * has no row for, or one whose row carries refusals.
+ *
+ * The catalog is choudoufu's module compatibility table, vendored in
+ * `../../module-catalog/` (chant#4560, choudoufu#2292). It has one static
+ * row per terraform-aws-modules example at one tag, measured offline in the
+ * onboarded form. A module call on a root whose binary is choudoufu (the
+ * root's `mode` is `live`) with an exact `version` is looked up there:
+ *
+ * - no row for the module, or none at the pinned version: `info`, naming the
+ *   versions the static tier did measure;
+ * - at least one example at that version refused: `warning`, with each
+ *   refusal ID, its site count, the examples that carry it and its
+ *   `live/LIMITATIONS.md` link;
+ * - every example clear: quiet.
+ *
+ * Every message names the tier. The catalog holds the static tier only, and
+ * no figure here counts a gauntlet run (choudoufu#2292 ruling: two tiers,
+ * never mixed).
+ *
+ * A stock root (`mode: "state"`) is skipped: the table measures choudoufu.
+ * A range is TF039's finding and a missing `version` TF004's, so both are
+ * skipped here. A `//subdir` source is looked up by its module repository.
+ *
+ * Off by default: `report-only` in the audit catalog, as TF039 is.
+ * terragucci turns it on and holds the product wording (terragucci#1286).
+ *
+ * Scope: root and child modules of a live root alike.
+ */
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import { type ModuleCompatibility } from "../../module-catalog/index.js";
+/** The TF047 message for one module call, or undefined when the call is clear. */
+export declare function catalogMessage(address: string, c: ModuleCompatibility): string | undefined;
+export declare const tf047: PostSynthCheck;
+//# sourceMappingURL=tf047.d.ts.map

package/dist/lint/post-synth/tf047.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tf047.d.ts","sourceRoot":"","sources":["../../../src/lint/post-synth/tf047.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EACV,cAAc,EAGf,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAK9B,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CA2B1F;AAED,eAAO,MAAM,KAAK,EAAE,cAkCnB,CAAC"}

package/dist/lint/post-synth/tf047.js

@@ -0,0 +1,94 @@
+/**
+ * TF047: a live root pins a registry module version the known-module catalog
+ * has no row for, or one whose row carries refusals.
+ *
+ * The catalog is choudoufu's module compatibility table, vendored in
+ * `../../module-catalog/` (chant#4560, choudoufu#2292). It has one static
+ * row per terraform-aws-modules example at one tag, measured offline in the
+ * onboarded form. A module call on a root whose binary is choudoufu (the
+ * root's `mode` is `live`) with an exact `version` is looked up there:
+ *
+ * - no row for the module, or none at the pinned version: `info`, naming the
+ *   versions the static tier did measure;
+ * - at least one example at that version refused: `warning`, with each
+ *   refusal ID, its site count, the examples that carry it and its
+ *   `live/LIMITATIONS.md` link;
+ * - every example clear: quiet.
+ *
+ * Every message names the tier. The catalog holds the static tier only, and
+ * no figure here counts a gauntlet run (choudoufu#2292 ruling: two tiers,
+ * never mixed).
+ *
+ * A stock root (`mode: "state"`) is skipped: the table measures choudoufu.
+ * A range is TF039's finding and a missing `version` TF004's, so both are
+ * skipped here. A `//subdir` source is looked up by its module repository.
+ *
+ * Off by default: `report-only` in the audit catalog, as TF039 is.
+ * terragucci turns it on and holds the product wording (terragucci#1286).
+ *
+ * Scope: root and child modules of a live root alike.
+ */
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { MODULE_TYPE } from "../../hcl/parse.js";
+import { classifyModuleSource, isExactVersionConstraint } from "./module-source.js";
+import { MODULE_CATALOG_SOURCE, MODULE_COMPATIBILITY_PAGE, moduleCompatibility, } from "../../module-catalog/index.js";
+const tierNote = () => `static tier of choudoufu's module table, measured ${MODULE_CATALOG_SOURCE.date} with hashicorp/aws ${MODULE_CATALOG_SOURCE.awsProvider}`;
+/** The TF047 message for one module call, or undefined when the call is clear. */
+export function catalogMessage(address, c) {
+    const pin = `${c.module} ${c.version}`;
+    switch (c.status) {
+        case "clear":
+            return undefined;
+        case "unknown-module":
+            return (`Module "${address}" pins ${pin}, and the ${tierNote()} has no row for this module. ` +
+                `Run \`choudoufu live-check\` on the root to see whether it plans. The table: ${MODULE_COMPATIBILITY_PAGE}`);
+        case "unknown-version":
+            return (`Module "${address}" pins ${pin}, and the ${tierNote()} has no row at this version. ` +
+                `It measured ${c.measuredVersions.join(", ")}. ` +
+                `Run \`choudoufu live-check\` on the root, or pin a measured version. The table: ${MODULE_COMPATIBILITY_PAGE}`);
+        case "refused": {
+            const ids = c.refusals
+                .map((r) => `${r.id} (${r.sites} site${r.sites === 1 ? "" : "s"} in ${r.examples.join(", ")}; ${r.docsUrl})`)
+                .join("; ");
+            return (`Module "${address}" pins ${pin}. In the ${tierNote()}, ${c.refusedExamples} of ${c.examples} ` +
+                `examples at this version are refused: ${ids}. ` +
+                "A call that uses the same features is refused the same way; `choudoufu live-check` names each site in this root.");
+        }
+    }
+}
+export const tf047 = {
+    id: "TF047",
+    description: "Live root pins a module version the known-module catalog has no row for, or one with refusals",
+    check(ctx) {
+        const diagnostics = [];
+        for (const [key, entity] of ctx.entities) {
+            if (entity.entityType !== MODULE_TYPE || !isResourceDeclarable(entity))
+                continue;
+            const props = entity.props;
+            if (props.mode !== "live")
+                continue;
+            const body = (typeof props.body === "object" && props.body !== null ? props.body : {});
+            const source = typeof body.source === "string" ? body.source : undefined;
+            if (source === undefined || classifyModuleSource(source).kind !== "registry")
+                continue;
+            const version = body.version;
+            if (typeof version !== "string" || !isExactVersionConstraint(version))
+                continue;
+            const compat = moduleCompatibility(source, version);
+            if (compat === undefined)
+                continue;
+            const address = typeof props.address === "string" ? props.address : key;
+            const message = catalogMessage(address, compat);
+            if (message === undefined)
+                continue;
+            diagnostics.push({
+                checkId: "TF047",
+                severity: compat.status === "refused" ? "warning" : "info",
+                message,
+                entity: key,
+                lexicon: "terraform",
+            });
+        }
+        return diagnostics;
+    },
+};

package/dist/lock-rows.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The terraform lexicon's lock grain (#4552) and the rows a choudoufu apply
+ * holds on the resource grain, in terragucci's format (`planRows` in
+ * terragucci's `apply-rows.ts` at 18f6431), unchanged:
+ *
+ * - `estate <estate> <address>` for every resource instance the apply acts
+ *   on (a create, update, delete, replace or forget), or `root <root>
+ *   <address>` when the root has no estate;
+ * - the same for `previous_address` on a moved instance;
+ * - `object <id>` for anything but a create, from the object's id before,
+ *   so two estates that meet on one object meet on its row.
+ *
+ * Data reads and no-ops hold nothing.
+ *
+ * The grain: `resource` for choudoufu, which keeps one record per resource,
+ * writes each conditionally and refuses a plan one of whose changes moved;
+ * `target` (the root, or the Terragrunt unit) for Terraform, tofu and
+ * Terragrunt, whose state is one file the backend's lock keeps whole. Those
+ * three refuse `resource` by name, since nothing in their state is per
+ * resource.
+ */
+import type { ChangeSetPart, ChangeSetPlanner } from "@intentius/chant/change-set";
+import { type LockGrain, type LockRow } from "@intentius/chant/lifecycle/lock-rows";
+/** The rows a plan's changes key, from `show -json`'s `resource_changes` (terragucci's `planRows`). */
+export declare function terraformLockRows(root: string, estate: string | undefined, plan: unknown): LockRow[];
+/**
+ * The rows from a member's change-set part, when the plan document is not
+ * at hand: the same keys, less the previous address of a moved instance,
+ * which the part does not carry. The part's `scope` is the estate.
+ */
+export declare function terraformLockRowsFromPart(root: string, part: ChangeSetPart): LockRow[];
+/** The grain a root takes by default: `resource` under choudoufu, `target` under every other binary. */
+export declare function terraformDefaultLockGrain(planner: ChangeSetPlanner | undefined): LockGrain;
+/** Why a root cannot take `grain`, by engine name, or undefined when it can. */
+export declare function terraformLockGrainRefusal(grain: LockGrain, planner: ChangeSetPlanner | undefined, binary?: string): string | undefined;
+//# sourceMappingURL=lock-rows.d.ts.map

package/dist/lock-rows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-rows.d.ts","sourceRoot":"","sources":["../src/lock-rows.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAgC,KAAK,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,sCAAsC,CAAC;AASlH,uGAAuG;AACvG,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,EAAE,CAgBpG;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,EAAE,CAStF;AAOD,wGAAwG;AACxG,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,SAAS,GAAG,SAAS,CAE1F;AAED,gFAAgF;AAChF,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,GAAG,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAItI"}

package/dist/lock-rows.js

@@ -0,0 +1,60 @@
+import { objectRowKey, sortedLockRows } from "@intentius/chant/lifecycle/lock-rows";
+const CHANGING = new Set(["create", "update", "delete", "forget"]);
+/** The scope a root's rows are keyed in: its estate, else its path. */
+function rowScope(root, estate) {
+    return estate ? `estate ${estate}` : `root ${root}`;
+}
+/** The rows a plan's changes key, from `show -json`'s `resource_changes` (terragucci's `planRows`). */
+export function terraformLockRows(root, estate, plan) {
+    const scope = rowScope(root, estate);
+    const rows = [];
+    const changes = plan?.resource_changes ?? [];
+    for (const c of changes) {
+        if (c?.mode === "data" || typeof c?.address !== "string")
+            continue;
+        const actions = Array.isArray(c.change?.actions) ? c.change.actions : [];
+        if (!actions.some((a) => CHANGING.has(a)))
+            continue;
+        const address = c.address;
+        rows.push({ key: `${scope} ${address}`, target: root, address });
+        if (typeof c.previous_address === "string" && c.previous_address !== address)
+            rows.push({ key: `${scope} ${c.previous_address}`, target: root, address });
+        // The live object an update or a delete acts on: two estates that meet on one object meet here.
+        const id = c.change?.before?.id;
+        if (actions.some((a) => a !== "create") && (typeof id === "string" || typeof id === "number") && String(id) !== "")
+            rows.push({ key: objectRowKey(String(id)), target: root, address });
+    }
+    return sortedLockRows(rows);
+}
+/**
+ * The rows from a member's change-set part, when the plan document is not
+ * at hand: the same keys, less the previous address of a moved instance,
+ * which the part does not carry. The part's `scope` is the estate.
+ */
+export function terraformLockRowsFromPart(root, part) {
+    const scope = rowScope(root, part.member.planner === "choudoufu" ? part.member.scope : undefined);
+    const rows = [];
+    for (const e of part.entries) {
+        if (e.action === "no-op" || e.action === "read")
+            continue;
+        rows.push({ key: `${scope} ${e.address}`, target: root, address: e.address });
+        if (e.action !== "create" && e.id)
+            rows.push({ key: objectRowKey(e.id), target: root, address: e.address });
+    }
+    return sortedLockRows(rows);
+}
+/** Whether a binary's name is Terragrunt's. */
+function isTerragrunt(binary) {
+    return /^terragrunt(\.exe)?$/.test((binary ?? "").split(/[\\/]/).pop() ?? "");
+}
+/** The grain a root takes by default: `resource` under choudoufu, `target` under every other binary. */
+export function terraformDefaultLockGrain(planner) {
+    return planner === "choudoufu" ? "resource" : "target";
+}
+/** Why a root cannot take `grain`, by engine name, or undefined when it can. */
+export function terraformLockGrainRefusal(grain, planner, binary) {
+    if (grain !== "resource" || planner === "choudoufu")
+        return undefined;
+    const engine = isTerragrunt(binary) ? "Terragrunt" : planner === "tofu" ? "tofu" : "Terraform";
+    return `${engine} keeps a root's state in one file that its backend's lock keeps whole, so nothing in it is per resource; the resource grain needs choudoufu (ci.lockGrain: target)`;
+}

package/dist/lock-timeout.d.ts

@@ -0,0 +1,22 @@
+/**
+ * State-lock waits for a plan or an apply (#4545): how long `plan` and
+ * `apply` wait for another run's state lock before failing. Taken from
+ * terragucci's waves, where two jobs of one pipeline can reach the same
+ * backend a moment apart and a failed lock fails the wave for nothing.
+ *
+ * A job that already sets `-lock-timeout` through `TF_CLI_ARGS` or
+ * `TF_CLI_ARGS_<command>` keeps its own: the flag is added only when neither
+ * names one. Terragrunt waves pass the same flag after `--`
+ * (`./terragrunt/wave.ts`, `extra`).
+ */
+/** How long a plan or an apply waits for a state lock unless the job set a `-lock-timeout` of its own. */
+export declare const DEFAULT_LOCK_TIMEOUT = "5m";
+/** Whether `value` is a `-lock-timeout` duration. */
+export declare function isLockTimeout(value: unknown): value is string;
+/**
+ * The `-lock-timeout` flag a `command` takes: `-lock-timeout=<timeout>`, or
+ * nothing when `TF_CLI_ARGS` or `TF_CLI_ARGS_<command>` in `env` already
+ * names one, or `timeout` is `false`. Throws on a duration terraform refuses.
+ */
+export declare function lockTimeoutArgs(command: "plan" | "apply", timeout?: string | false, env?: Record<string, string | undefined>): string[];
+//# sourceMappingURL=lock-timeout.d.ts.map

package/dist/lock-timeout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lock-timeout.d.ts","sourceRoot":"","sources":["../src/lock-timeout.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,0GAA0G;AAC1G,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAKzC,qDAAqD;AACrD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,EAAE,OAAO,GAAE,MAAM,GAAG,KAA4B,EAAE,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAAG,MAAM,EAAE,CAK1K"}

package/dist/lock-timeout.js

@@ -0,0 +1,32 @@
+/**
+ * State-lock waits for a plan or an apply (#4545): how long `plan` and
+ * `apply` wait for another run's state lock before failing. Taken from
+ * terragucci's waves, where two jobs of one pipeline can reach the same
+ * backend a moment apart and a failed lock fails the wave for nothing.
+ *
+ * A job that already sets `-lock-timeout` through `TF_CLI_ARGS` or
+ * `TF_CLI_ARGS_<command>` keeps its own: the flag is added only when neither
+ * names one. Terragrunt waves pass the same flag after `--`
+ * (`./terragrunt/wave.ts`, `extra`).
+ */
+/** How long a plan or an apply waits for a state lock unless the job set a `-lock-timeout` of its own. */
+export const DEFAULT_LOCK_TIMEOUT = "5m";
+/** A duration terraform's `-lock-timeout` takes: `0s`, `30s`, `5m`, `1h30m`. */
+const DURATION = /^(\d+(ms|s|m|h))+$/;
+/** Whether `value` is a `-lock-timeout` duration. */
+export function isLockTimeout(value) {
+    return typeof value === "string" && DURATION.test(value);
+}
+/**
+ * The `-lock-timeout` flag a `command` takes: `-lock-timeout=<timeout>`, or
+ * nothing when `TF_CLI_ARGS` or `TF_CLI_ARGS_<command>` in `env` already
+ * names one, or `timeout` is `false`. Throws on a duration terraform refuses.
+ */
+export function lockTimeoutArgs(command, timeout = DEFAULT_LOCK_TIMEOUT, env = process.env) {
+    if (timeout === false)
+        return [];
+    if (!isLockTimeout(timeout))
+        throw new Error(`lockTimeout "${timeout}" is not a duration terraform takes, such as "5m" or "30s"`);
+    const set = `${env.TF_CLI_ARGS ?? ""} ${env[`TF_CLI_ARGS_${command}`] ?? ""}`;
+    return /(^|\s)-{1,2}lock-timeout[=\s]/.test(set) ? [] : [`-lock-timeout=${timeout}`];
+}

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.124.54",
+  "version": "0.124.56",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/module-catalog/index.d.ts

@@ -0,0 +1,69 @@
+import type { StaticRow } from "./types.js";
+export type { StaticRefusal, StaticRow, StaticMeasurement, StaticSource } from "./types.js";
+/** Where the vendored rows came from. */
+export declare const MODULE_CATALOG_SOURCE: {
+    readonly repo: "INTENTIUS/choudoufu";
+    readonly path: "live/module-compat.json";
+    readonly commit: "39a143679a6f5ffeae7dc186190049e8b55f7149";
+    /** The static tier's measurement date. */
+    readonly date: string;
+    /** The choudoufu commit the static tier was measured at. */
+    readonly measuredAt: string;
+    /** The hashicorp/aws provider version the static tier was measured with. */
+    readonly awsProvider: string;
+};
+/** choudoufu's site page that renders both tiers. */
+export declare const MODULE_COMPATIBILITY_PAGE = "https://intentius.io/choudoufu/aws/compatibility/#modules";
+/** The tiers this catalog holds. */
+export type ModuleCatalogTier = "static";
+/** Every static row, as vendored. */
+export declare const staticRows: readonly StaticRow[];
+/** One refusal ID across the examples of a module version that carry it. */
+export interface ModuleRefusalSummary {
+    id: string;
+    /** Sites summed across the examples that carry it. */
+    sites: number;
+    docsUrl: string;
+    /** Example directories that carry it, sorted. */
+    examples: string[];
+}
+/**
+ * What the catalog says about one pinned module version.
+ *
+ * - `unknown-module`: no static row for this module at any version.
+ * - `unknown-version`: rows for the module, none measured at this version
+ *   (`measuredVersions` lists the ones there are).
+ * - `refused`: at least one example at this version is refused.
+ * - `clear`: every measured example at this version is clear.
+ */
+export interface ModuleCompatibility {
+    module: string;
+    /** The pinned version, without a leading `v` or `=`. */
+    version: string;
+    tier: ModuleCatalogTier;
+    status: "unknown-module" | "unknown-version" | "clear" | "refused";
+    /** Static rows measured at this version (an `unmeasured` row is left out). */
+    examples: number;
+    clearExamples: number;
+    refusedExamples: number;
+    /** Refusal IDs at this version, most refused examples first, then by ID. */
+    refusals: ModuleRefusalSummary[];
+    /** Versions the static tier measured for this module, without a leading `v`. */
+    measuredVersions: string[];
+}
+/**
+ * The registry address of a module source, without a registry host, a
+ * `//subdir` or a query, lowercased: `registry.terraform.io/terraform-aws-modules/iam/aws//modules/iam-role`
+ * gives `terraform-aws-modules/iam/aws`. Undefined when the source is not a
+ * three-part registry address.
+ */
+export declare function registryModuleAddress(source: string): string | undefined;
+/** `= 1.4.0`, `v1.4.0` and `1.4.0` all give `1.4.0`; a range gives undefined. */
+export declare function exactModuleVersion(version: string): string | undefined;
+/**
+ * The catalog's answer for a module `source` pinned at `version`, or
+ * undefined when the source is not a registry address or the version is not
+ * exact (a range is TF039's finding, and the catalog has no row for one).
+ */
+export declare function moduleCompatibility(source: string, version: string): ModuleCompatibility | undefined;
+//# sourceMappingURL=index.d.ts.map

package/dist/module-catalog/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/module-catalog/index.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzF,yCAAyC;AACzC,eAAO,MAAM,qBAAqB;aAChC,IAAI,EAAE,qBAAqB;aAC3B,IAAI;aACJ,MAAM;IACN,0CAA0C;aAC1C,IAAI;IACJ,4DAA4D;aAC5D,UAAU;IACV,4EAA4E;aAC5E,WAAW;CACH,CAAC;AAEX,qDAAqD;AACrD,eAAO,MAAM,yBAAyB,8DAA8D,CAAC;AAErG,oCAAoC;AACpC,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AAEzC,qCAAqC;AACrC,eAAO,MAAM,UAAU,EAAE,SAAS,SAAS,EAAgB,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,sDAAsD;IACtD,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,gBAAgB,GAAG,iBAAiB,GAAG,OAAO,GAAG,SAAS,CAAC;IACnE,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,gFAAgF;IAChF,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQxE;AAED,iFAAiF;AACjF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtE;AAiBD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS,CAoCpG"}