@intentius/chant-lexicon-terraform 0.57.0 → 0.59.0

package/dist/op/activity-contracts.d.ts

@@ -0,0 +1,148 @@
+/**
+ * Activity contracts for this lexicon's own `op/activities` (chant #2101).
+ *
+ * The schema-shaped sibling of `./activities/index.ts`: that module is
+ * resolved by convention at `@intentius/chant-lexicon-terraform/op/activities`
+ * for the run-time registry, and this one at
+ * `@intentius/chant-lexicon-terraform/op/activity-contracts` for build-time
+ * validation. `loadActivityContracts`
+ * (`packages/core/src/op/activity-contract-registry.ts`) merges what it finds
+ * here into the map core's own OPS012 and OPS013 validate every `Chant::Op`
+ * step against. Since #2122 moved those checks into core they fire on every
+ * project that declares an Op, so an Op built out of terraform steps is
+ * checked wherever it is built. Before this existed, both examples that carry
+ * an Op had to keep it outside `src/` where `chant dev check-lexicon`'s
+ * example build could not see it.
+ *
+ * Each contract's `args` schema mirrors the corresponding `*Args` interface in
+ * `./activities/terraform.ts`, and each `returns` schema the corresponding
+ * `*Result`. Authored with `z.strictObject(...)`, never `z.object(...)`: the
+ * default form silently drops an unrecognized key instead of rejecting it, so
+ * a misspelled `planfile` would vanish rather than fail the build. The
+ * `returns` schemas are the half OPS013 needs — `plan.out.planFile` feeding an
+ * Apply step, `plan.out.text` feeding a `reconcilePr` body — so a field a step
+ * references has to be spelled here for the reference to validate.
+ *
+ * `json` is `z.unknown()` throughout: it is terraform's own `-json` document,
+ * whose shape is the provider's, not chant's. A dot-path reference into it
+ * therefore does not resolve, which is deliberate. Reference `text`, or one of
+ * the counts projected out of the document, instead of reaching into
+ * terraform's JSON from an Op.
+ */
+export declare const terraformInitContract: import("@intentius/chant/op").ActivityContract<{
+    root: string;
+    upgrade?: boolean | undefined;
+    reconfigure?: boolean | undefined;
+    cwd?: string | undefined;
+}, {
+    dir: string;
+    workspace?: string | undefined;
+}>;
+export declare const terraformPlanContract: import("@intentius/chant/op").ActivityContract<{
+    root: string;
+    planFile?: string | undefined;
+    destroy?: boolean | undefined;
+    cwd?: string | undefined;
+}, {
+    changed: boolean;
+    planFile: string;
+    dir: string;
+    json: unknown;
+    text: string;
+    adds: number;
+    changes: number;
+    destroys: number;
+}>;
+export declare const terraformApplyContract: import("@intentius/chant/op").ActivityContract<{
+    root: string;
+    planFile?: string | undefined;
+    cwd?: string | undefined;
+}, {
+    dir: string;
+    applied: boolean;
+    planFile?: string | undefined;
+    refused?: "approval-mismatch" | "wrong-estate" | undefined;
+    refusal?: string | undefined;
+}>;
+export declare const terraformShowContract: import("@intentius/chant/op").ActivityContract<{
+    root: string;
+    planFile?: string | undefined;
+    cwd?: string | undefined;
+}, {
+    source: "plan" | "state";
+    json: unknown;
+    text: string;
+    dir: string;
+    adds: number;
+    changes: number;
+    destroys: number;
+    planFile?: string | undefined;
+}>;
+export declare const choudoufuLivePlanContract: import("@intentius/chant/op").ActivityContract<{
+    root: string;
+    estate?: string | undefined;
+    adoptionOnly?: boolean | undefined;
+    cwd?: string | undefined;
+}, {
+    unowned: number;
+    adoptable: number;
+    drift: boolean;
+    json: unknown;
+    text: string;
+    ledger: string;
+    finding: string;
+    adoptions: {
+        [x: string]: unknown;
+    }[];
+    contested: {
+        [x: string]: unknown;
+    }[];
+    ambiguous: number;
+    dir: string;
+    documentPath: string;
+    estate: string;
+    adds: number;
+    changes: number;
+    destroys: number;
+}>;
+export declare const choudoufuLiveLsContract: import("@intentius/chant/op").ActivityContract<{
+    root: string;
+    estate?: string | undefined;
+    consistent?: boolean | undefined;
+    cwd?: string | undefined;
+}, {
+    json: unknown;
+    dir: string;
+    estate: string;
+}>;
+export declare const choudoufuLiveCheckContract: import("@intentius/chant/op").ActivityContract<{
+    root: string;
+    cwd?: string | undefined;
+}, {
+    refused: boolean;
+    json: unknown;
+    text: string;
+    dir: string;
+}>;
+export declare const choudoufuAdoptContract: import("@intentius/chant/op").ActivityContract<{
+    adoptions: {
+        [x: string]: unknown;
+    }[];
+    root: string;
+    contested?: {
+        [x: string]: unknown;
+    }[] | undefined;
+    cwd?: string | undefined;
+}, {
+    mechanism: "tag-write";
+    adopted: string[];
+    adoptedCount: number;
+    refused: {
+        addr: string;
+        identity: string;
+        reason: string;
+    }[];
+    ambiguous: number;
+    dir: string;
+}>;
+//# sourceMappingURL=activity-contracts.d.ts.map

package/dist/op/activity-contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity-contracts.d.ts","sourceRoot":"","sources":["../../src/op/activity-contracts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AA+BH,eAAO,MAAM,qBAAqB;;;;;;;;EASjC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;EAgBjC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;EAWlC,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;EAYjC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;EAwBrC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;EASnC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;EAKtC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;EAgBlC,CAAC"}

package/dist/op/adoption.d.ts

@@ -0,0 +1,118 @@
+/**
+ * The adoption ledger: which live resources this estate's markers can claim,
+ * read off `live-plan -json`'s document and rendered as text (#2105).
+ *
+ * Pure. No filesystem, no child process, no HCL parse — everything here is a
+ * projection of GitHub issue #788's `unowned` section, which is the one place
+ * choudoufu states both halves of the answer: the live resource sitting at a
+ * declared instance's identity, and the `tofu-estate`/`tofu-address` pair that
+ * would adopt it. Two tags is the whole ownership contract (choudoufu's
+ * `live/MARKERS.md`), so those two values are the whole of what an adoption
+ * needs to know.
+ *
+ * ## Why chant renders a ledger at all
+ *
+ * choudoufu prints its own, under `live-plan -adoption-only`, and it is the
+ * better report for a human at a terminal: it counts the marker-carrying and
+ * the identity-by-declaration halves of the declared population separately and
+ * says why each unadoptable instance is unadoptable. But `-adoption-only` and
+ * `-json` are refused together (`internal/command/live_plan.go`: "this run
+ * cannot produce both reports at once"), and an Op that reports adoptables
+ * needs the machine-readable document anyway — for the counts it publishes as
+ * outcome attributes, and for the addresses an adoption step acts on. So the
+ * ledger below is rendered from the document that run already has, in the row
+ * form `-adoption-only` prints, rather than paying for a third live read.
+ *
+ * ## Ambiguity
+ *
+ * `unowned[]` is one entry per live resource, keyed by the declared instance
+ * whose identity found it, so two live resources at one declared identity are
+ * two entries carrying the same `addr`. That is the ambiguous case: no single
+ * tag write claims the address, and picking one of the two is a decision about
+ * the estate rather than something a tool infers. {@link readAdoptionLedger}
+ * separates those into `contested` and never lets them into `adoptions`, and
+ * `TerraformAdoptOp` passes the contested list to its Adopt step so the Op's
+ * result names what it refused as well as what it wrote.
+ */
+/** One live resource a marker write would bind to a declared instance. */
+export interface AdoptionCandidate {
+    /** The declared instance address whose identity found the live resource. */
+    addr: string;
+    /** The live resource's type, as choudoufu's `unowned[].type`. */
+    type: string;
+    /** The identity the live resource was read with — the handle a human, or a tagging call, needs. */
+    identity: string;
+    /** The `tofu-estate` value that adopts it. */
+    markerEstate: string;
+    /** The `tofu-address` value that adopts it, escaped as choudoufu stores it. */
+    markerAddress: string;
+    /**
+     * The paste-ready tagging command choudoufu printed for this address under
+     * `live-plan -adoption-only`, when it printed one. Absent for a type whose
+     * service has its own tagging call this fork does not spell out (IAM,
+     * Route53, S3 and friends): the two marker values above are still the whole
+     * contract, but the caller has to write them itself.
+     */
+    command?: string;
+}
+/** What {@link readAdoptionLedger} found in one `live-plan -json` document. */
+export interface AdoptionLedger {
+    /** Candidates at an address exactly one live resource sits at. The adoptable set. */
+    adoptions: AdoptionCandidate[];
+    /**
+     * Every candidate at an address more than one live resource sits at. Never
+     * adopted: reported so a human can delete one or write the marker by hand.
+     * Both (or all) candidates for a contested address appear, so the report
+     * shows what the choice is between.
+     */
+    contested: AdoptionCandidate[];
+    /** How many distinct declared addresses are contested. */
+    ambiguous: number;
+}
+/**
+ * Project a `live-plan -json` document's `unowned` section into the adoptable
+ * and the contested sets.
+ *
+ * An entry counts as a candidate only when choudoufu offered both marker
+ * values. Both empty means adoption was not this run's to offer — the resource
+ * belongs to another estate (`tofu_estate` names it), or the run had no estate
+ * name of its own — and such an entry is neither adoptable nor contested here,
+ * because there is no tag write to refuse.
+ *
+ * `commands` maps a declared address to the paste-ready tagging command
+ * choudoufu printed for it, from {@link parseAdoptionCommands}; omit it when
+ * the run had no `-adoption-only` render to read one out of.
+ */
+export declare function readAdoptionLedger(document: unknown, commands?: ReadonlyMap<string, string>): AdoptionLedger;
+/**
+ * Pair each declared address in a `live-plan -adoption-only` render with the
+ * tagging command choudoufu printed under it.
+ *
+ * The render's "Adoptable now" rows are `  <addr> <- <type> <identity>`
+ * followed by indented detail lines, one of which is `      adopt with: <cmd>`
+ * (`internal/command/views/live_adoption.go`). choudoufu builds that command
+ * to be pasted verbatim: every interpolated value is shell-quoted, the tagging
+ * verb comes from its own botocore-derived table rather than a guess, and the
+ * provider configuration's region and endpoint ride along as `--region` and
+ * `--endpoint-url`, so the write lands where the resource is rather than
+ * wherever an operator's AWS CLI profile points. Re-deriving any of that from
+ * the two marker values alone would be a worse command, so this reads the one
+ * choudoufu already wrote.
+ *
+ * An address the render offered no command for is simply absent from the map.
+ */
+export declare function parseAdoptionCommands(ledgerText: string): Map<string, string>;
+/**
+ * Render {@link readAdoptionLedger}'s answer as the text an issue or PR body
+ * carries under the plan.
+ *
+ * One line per adoptable match, naming the declared address, the live resource
+ * it binds, and the two tag values that adopt it, in the token forms
+ * `-adoption-only` prints them in (`<addr> <- <type> <identity>`,
+ * `tofu-estate=`, `tofu-address=`). Contested addresses follow, listed and not
+ * offered. An empty ledger still renders a line: "nothing adoptable" is a
+ * result a reader wants, and a section that vanishes reads as one that was
+ * never computed.
+ */
+export declare function renderAdoptionLedger(ledger: AdoptionLedger, estate?: string): string;
+//# sourceMappingURL=adoption.d.ts.map

package/dist/op/adoption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adoption.d.ts","sourceRoot":"","sources":["../../src/op/adoption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,qFAAqF;IACrF,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,SAAS,EAAE,iBAAiB,EAAE,CAAC;IAC/B,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAcD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,cAAc,CAqC5G;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAoB7E;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAgDpF"}

package/dist/op/builders.d.ts

@@ -15,7 +15,7 @@
  * path a second time.
  */
 import { type ActivityStep, type NamedActivityStep, type WithStepRefs } from "@intentius/chant/op";
-import type { TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs } from "./activities/terraform.js";
+import type { TerraformInitArgs, TerraformPlanArgs, TerraformApplyArgs, TerraformShowArgs, ChoudoufuLivePlanArgs, ChoudoufuLiveLsArgs, ChoudoufuLiveCheckArgs, ChoudoufuAdoptArgs } from "./activities/terraform.js";
 /** Extra opts every wrapper below accepts alongside its activity's own fields. */
 type StepOpts = {
     profile?: ActivityStep["profile"];
@@ -38,13 +38,55 @@ export declare const terraformInit: (root: string, opts?: WithStepRefs<Omit<Terr
  */
 export declare const terraformPlan: (root: string, opts?: WithStepRefs<Omit<TerraformPlanArgs, "root">> & StepOpts) => NamedActivityStep;
 /**
- * `terraform apply <planFile>` in the named root — the fully typed twin of the
+ * `terraform apply <planFile>` in the named root, the fully typed twin of the
  * `terraformApply` activity. `opts` is {@link TerraformApplyArgs} itself,
- * minus the positional `root`, so `planFile` stays required at the call site
- * and the activity's bare-apply refusal is a compile error rather than a
- * runtime one. Defaults to the `longInfra` profile.
+ * minus the positional `root`. `planFile` is optional in the type and
+ * required in practice, on a live root as much as a stock one: the activity
+ * refuses a missing one, and on a live root the file is the approval artifact
+ * choudoufu v0.13.0 re-plans against and refuses on a mismatch (choudoufu
+ * #878). Defaults to the `longInfra` profile.
  */
-export declare const terraformApply: (root: string, opts: WithStepRefs<Omit<TerraformApplyArgs, "root">> & StepOpts) => NamedActivityStep;
+export declare const terraformApply: (root: string, opts?: WithStepRefs<Omit<TerraformApplyArgs, "root">> & StepOpts) => NamedActivityStep;
+/**
+ * `choudoufu live-plan -detailed-exitcode -json` in the named root, plus the
+ * human render. The fully typed twin of the `choudoufuLivePlan` activity
+ * (#2103). `opts` is {@link ChoudoufuLivePlanArgs} itself, minus the
+ * positional `root`; `estate` is optional, auto-detected from the root's
+ * `live` block or `estate.chdf.hcl` sidecar when omitted, and a root that
+ * declares one is run with no `-estate` at all, which is the only form
+ * choudoufu admits there (choudoufu #894, fixed in v0.14.0).
+ * Defaults to the `longInfra` profile: like `terraformPlan`, this reads the
+ * live system in full (the estate-wide sweep).
+ *
+ * Give this step an `id` to read `.out.drift`, `.out.unowned`,
+ * `.out.adoptable` or `.out.documentPath` from a later step.
+ */
+export declare const choudoufuLivePlan: (root: string, opts?: WithStepRefs<Omit<ChoudoufuLivePlanArgs, "root">> & StepOpts) => NamedActivityStep;
+/**
+ * `choudoufu live-ls -estate=<estate> -json [-consistent]` in the named root,
+ * the fully typed twin of the `choudoufuLiveLs` activity (#2103). `opts` is
+ * {@link ChoudoufuLiveLsArgs} itself, minus the positional `root`. Defaults to
+ * the `fastIdempotent` profile: `live-ls` reads a tagging-API listing and
+ * calls no other provider.
+ */
+export declare const choudoufuLiveLs: (root: string, opts?: WithStepRefs<Omit<ChoudoufuLiveLsArgs, "root">> & StepOpts) => NamedActivityStep;
+/**
+ * `choudoufu live-check -json` in the named root, the fully typed twin of the
+ * `choudoufuLiveCheck` activity (#2103). `opts` is {@link ChoudoufuLiveCheckArgs}
+ * itself, minus the positional `root`. Defaults to the `fastIdempotent`
+ * profile: no cloud calls, no state.
+ */
+export declare const choudoufuLiveCheck: (root: string, opts?: WithStepRefs<Omit<ChoudoufuLiveCheckArgs, "root">> & StepOpts) => NamedActivityStep;
+/**
+ * Write the ownership markers that claim an adoption ledger's matches, in the
+ * named root. The fully typed twin of the `choudoufuAdopt` activity (#2105).
+ * `opts` is {@link ChoudoufuAdoptArgs} itself, minus the positional `root`, so
+ * `adoptions` is required at the call site — an adopt step with nothing to
+ * adopt is an authoring mistake, not a no-op worth defaulting to. Defaults to
+ * the `longInfra` profile: one tagging round trip per resource, against the
+ * cloud.
+ */
+export declare const choudoufuAdopt: (root: string, opts: WithStepRefs<Omit<ChoudoufuAdoptArgs, "root">> & StepOpts) => NamedActivityStep;
 /**
  * `terraform show` in the named root, over state or over a saved plan. `opts`
  * is {@link TerraformShowArgs} itself, minus the positional `root`. Defaults

package/dist/op/builders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,wBAAwB,CAAC;AAEhC,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,MAAM,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC"}
+{"version":3,"file":"builders.d.ts","sourceRoot":"","sources":["../../src/op/builders.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EACnB,MAAM,wBAAwB,CAAC;AAEhC,kFAAkF;AAClF,KAAK,QAAQ,GAAG;IAAE,OAAO,CAAC,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnE;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAGF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC/D,iBAGF,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAClE,iBAOF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC1B,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAChE,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KACnE,iBAOF,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,MAAM,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,OAAO,YAAY,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,GAAG,QAAQ,KAC9D,iBAOF,CAAC"}

package/dist/op/resolve-root-mode.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Best-effort, synchronous read of whether a named `terraform.roots` entry is
+ * live: `terraform.binary` is `"choudoufu"` and the root's directory declares
+ * an estate, either a `live { }` block or an `estate.chdf.hcl` sidecar (#2103).
+ *
+ * Three callers decide something at build time, before any activity runs, and
+ * none can afford the async work `../op/activities/terraform.ts`'s own
+ * `resolveRoot` does (`loadChantConfigUpward`, a full `chant.config.ts`/`.json`
+ * walk):
+ *
+ *   - `TerraformApplyOp` (`../composites/terraform-apply-op.ts`) reads the
+ *     mode to word the Gate phase's approval description, and to refuse a
+ *     root whose `policy` block sets `undeclared_untagged = "delete"`. The
+ *     mode no longer picks a phase shape: #2157 made the live and stock Apply
+ *     steps one step, so both roots build the same phases.
+ *   - `TerraformWatchOp` (`../composites/terraform-watch-op.ts`) cross-checks
+ *     its hand-set `live` flag against the root's real mode and refuses a
+ *     mismatch (#2216).
+ *   - TF101 (`../lint/rules/plan-before-apply.ts`) decides whether a
+ *     `terraformApply` call it is statically inspecting is exempt from the
+ *     plan-file pairing it otherwise enforces.
+ *
+ * All three run in the build process (`chant build`/`chant lint`) rather than
+ * in an activity at run time, so a synchronous read is available, but only the
+ * cheap half of it: `findProjectConfig` (`@intentius/chant/project-root`) is a
+ * plain, already-synchronous upward filesystem walk, but a `chant.config.ts`
+ * is project-authored code, and evaluating it synchronously outside chant's
+ * own config-sandbox machinery is more than any caller's best-effort question
+ * is worth. So this reads `chant.config.json` only; a project on a `.ts`
+ * config, or with no config discoverable at all, or naming no matching root,
+ * resolves to `undefined`, and "unknown" reads as "stock" to every caller.
+ *
+ * That default is conservative for the two callers that only ever add a
+ * requirement by knowing more: TF101 keeps enforcing the plan-file pairing,
+ * and the watch Op keeps accepting the flag it was given. It is the
+ * permissive direction for the apply Op's policy refusal and for the watch
+ * Op's mismatch, which is why neither refusal is left to this function alone:
+ * TF027 and TF028 (`../lint/post-synth/`) ask the same questions of the
+ * parsed HCL the build already stamped `mode` onto, whatever the config file
+ * is written in, and those checks are the guarantee (#2216). Every project in
+ * this repository is on a `chant.config.ts`, so a refusal that resolves the
+ * mode through this function alone never fires for anyone.
+ */
+export interface ResolvedRootMode {
+    /** `"live"` when `terraform.binary` is `"choudoufu"` and the root declares an estate; `"state"` otherwise. */
+    mode: "live" | "state";
+    /** The root module directory, resolved to an absolute path. */
+    dir: string;
+}
+/**
+ * Resolve `rootName`'s mode against the nearest `chant.config.json` found by
+ * walking up from `cwd` (default `process.cwd()`, matching every other
+ * `cwd`-defaulting option in this lexicon). `undefined` when that cannot be
+ * done with a plain, synchronous read: no config found, the config found is
+ * `chant.config.ts`, the config declares no such root, or the root's
+ * directory does not exist.
+ */
+export declare function resolveRootModeSync(rootName: string, cwd?: string): ResolvedRootMode | undefined;
+//# sourceMappingURL=resolve-root-mode.d.ts.map

package/dist/op/resolve-root-mode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-root-mode.d.ts","sourceRoot":"","sources":["../../src/op/resolve-root-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAQH,MAAM,WAAW,gBAAgB;IAC/B,8GAA8G;IAC9G,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAoBhG"}

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAwB9D;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aA4H7B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AA+DlF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAkP7B,CAAC"}

package/dist/rules/blocks.ts

@@ -0,0 +1,109 @@
+/**
+ * Shared reading helpers for the single-block post-synth checks (#2110).
+ *
+ * Thirteen of the fourteen rules in that issue do the same three things: pick
+ * the entities of one block type out of `ctx.entities`, read one attribute of
+ * each body, and report. This module is those three things, so a rule file is
+ * its condition and its message and nothing else. It exports no
+ * `PostSynthCheck`, so the generated barrel skips it (see
+ * `packages/core/src/codegen/generate-post-synth-barrel.ts`).
+ */
+
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import type { BlockBody, TerraformEntity } from "../../hcl/parse";
+
+/** One parsed block, with the entity key the diagnostic reports against. */
+export interface TerraformBlock {
+  /** `ctx.entities` key: `<root>/<address>`. */
+  key: string;
+  address: string;
+  body: BlockBody;
+  file: string;
+  root: string;
+  /** The raw text of the file this block came from (see `TerraformEntity.props`). */
+  source: string;
+}
+
+/** Every block of one entity type, in `ctx.entities` order. */
+export function blocksOfType(ctx: PostSynthContext, entityType: string): TerraformBlock[] {
+  const blocks: TerraformBlock[] = [];
+  for (const [key, entity] of ctx.entities) {
+    if (entity.entityType !== entityType) continue;
+    if (!isResourceDeclarable(entity)) continue;
+    const props = (entity as TerraformEntity).props as Partial<TerraformEntity["props"]>;
+    blocks.push({
+      key,
+      address: typeof props.address === "string" ? props.address : key,
+      body: (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody,
+      file: typeof props.file === "string" ? props.file : "",
+      root: typeof props.root === "string" ? props.root : "",
+      source: typeof props.source === "string" ? props.source : "",
+    });
+  }
+  return blocks;
+}
+
+/** Blocks of several types at once, in the order the types are given. */
+export function blocksOfTypes(ctx: PostSynthContext, entityTypes: string[]): TerraformBlock[] {
+  return entityTypes.flatMap((t) => blocksOfType(ctx, t));
+}
+
+/** The name half of a `var.<name>` / `output.<name>` address. */
+export function blockName(address: string): string {
+  const dot = address.indexOf(".");
+  return dot === -1 ? address : address.slice(dot + 1);
+}
+
+/**
+ * The bodies of a nested block (`lifecycle`, `validation`, a provider's
+ * `assume_role`). hcl2json encodes a repeatable block as an array of bodies
+ * and a singleton as a bare object, so both are normalized to an array here.
+ */
+export function nestedBodies(body: BlockBody, key: string): BlockBody[] {
+  const value = body[key];
+  if (Array.isArray(value)) return value.filter((v): v is BlockBody => typeof v === "object" && v !== null && !Array.isArray(v));
+  if (typeof value === "object" && value !== null) return [value as BlockBody];
+  return [];
+}
+
+/** Is this attribute value a string that says nothing? */
+export function isBlank(value: unknown): boolean {
+  return value === undefined || value === null || (typeof value === "string" && value.trim() === "");
+}
+
+/** One scalar attribute found by {@link walkAttributes}. */
+export interface Attribute {
+  /** The attribute's own name (the last path segment). */
+  name: string;
+  /** Dotted path from the block body, e.g. `connection.password`. */
+  path: string;
+  value: unknown;
+}
+
+/**
+ * Every scalar attribute in a block body, descending through nested blocks so
+ * a credential inside `connection {}` or `assume_role {}` is not invisible.
+ * Depth-limited: a Terraform block nests a handful of levels at most, and an
+ * unbounded walk over a large body buys nothing.
+ */
+export function walkAttributes(body: BlockBody, maxDepth = 3): Attribute[] {
+  const out: Attribute[] = [];
+  const visit = (value: unknown, path: string, name: string, depth: number): void => {
+    if (Array.isArray(value)) {
+      if (depth > maxDepth) return;
+      for (const item of value) visit(item, path, name, depth);
+      return;
+    }
+    if (typeof value === "object" && value !== null) {
+      if (depth >= maxDepth) return;
+      for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+        visit(v, path === "" ? k : `${path}.${k}`, k, depth + 1);
+      }
+      return;
+    }
+    if (path !== "") out.push({ name, path, value });
+  };
+  visit(body, "", "", 0);
+  return out;
+}

package/dist/rules/module-source.ts

@@ -0,0 +1,121 @@
+/**
+ * Classify a `module` block's `source` string, shared by TF004 (registry
+ * module without a version) and TF005 (git/hg module unpinned or pinned to
+ * a branch). Neither rule evaluates HCL: both read `source` as the literal
+ * string hcl2json hands back, so a source built from a variable or a
+ * function call is never classified (`"other"`), matching tflint's own
+ * `SourceKnown` guard on `module.Source`.
+ *
+ * `registry` mirrors `hashicorp/terraform-registry-address`'s
+ * `ParseModuleSource` (MPL-2.0,
+ * https://github.com/hashicorp/terraform-registry-address/blob/main/module.go):
+ * three slash-separated parts (`namespace/name/target-system`), or four with
+ * a leading hostname that contains a dot and is not `github.com` or
+ * `bitbucket.org` (those are reserved for direct VCS installs, never a
+ * registry). `git` covers the sources tflint's `terraform_module_pinned_source`
+ * treats as git/hg: an explicit `git::`/`hg::` force prefix, the `github.com`
+ * and `bitbucket.org` shorthands its `GitHubDetector`/`BitBucketDetector`
+ * recognize, scp-style `git@host:path` addresses, and any source ending in
+ * `.git`. `local` is `./` or `../` (checkov's `UNKNOWN` case for module
+ * pinning: a local path cannot be pinned to anything and is never flagged).
+ */
+
+export type ModuleSourceKind = "local" | "registry" | "git" | "other";
+
+export interface ModuleSourceClassification {
+  kind: ModuleSourceKind;
+  /** The `?ref=`/`&ref=` value (falling back to `rev`), when `kind` is `"git"`. */
+  ref?: string;
+}
+
+const REGISTRY_NAME = /^[0-9A-Za-z](?:[0-9A-Za-z_-]{0,62}[0-9A-Za-z])?$/;
+const REGISTRY_TARGET_SYSTEM = /^[0-9a-z]{1,64}$/;
+const RESERVED_VCS_HOSTS = new Set(["github.com", "bitbucket.org"]);
+
+/** Split a raw query string (no leading `?`) into its key/value pairs, last write wins. */
+function parseQuery(query: string): Map<string, string> {
+  const params = new Map<string, string>();
+  for (const pair of query.split("&")) {
+    if (pair === "") continue;
+    const eq = pair.indexOf("=");
+    const key = eq === -1 ? pair : pair.slice(0, eq);
+    const value = eq === -1 ? "" : decodeURIComponent(pair.slice(eq + 1));
+    params.set(decodeURIComponent(key), value);
+  }
+  return params;
+}
+
+/** Strip a `//<subdir>` package-subdirectory suffix, ignoring one embedded in the scheme (`https://`). */
+function stripSubdir(base: string): string {
+  const schemeEnd = base.indexOf("://");
+  const searchFrom = schemeEnd === -1 ? 0 : schemeEnd + 3;
+  const idx = base.indexOf("//", searchFrom);
+  return idx === -1 ? base : base.slice(0, idx);
+}
+
+function isRegistryAddress(rest: string): boolean {
+  const parts = stripSubdir(rest).split("/");
+  let namespace: string, name: string, targetSystem: string;
+  if (parts.length === 3) {
+    [namespace, name, targetSystem] = parts;
+  } else if (parts.length === 4) {
+    const host = parts[0];
+    if (!host.includes(".") || RESERVED_VCS_HOSTS.has(host.toLowerCase())) return false;
+    [, namespace, name, targetSystem] = parts;
+  } else {
+    return false;
+  }
+  return REGISTRY_NAME.test(namespace) && REGISTRY_NAME.test(name) && REGISTRY_TARGET_SYSTEM.test(targetSystem);
+}
+
+/** Is `rest` (source with any `git::`/`hg::` force prefix already stripped) a git/hg-shaped source? */
+function isGitShaped(rest: string): boolean {
+  if (/^[\w.-]+@[^:/]+:/.test(rest)) return true; // scp-style, e.g. git@github.com:org/repo.git
+  const withoutScheme = rest.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
+  if (/^(github\.com|bitbucket\.org)\//i.test(withoutScheme)) return true;
+  if (/\.git($|[/?])/i.test(withoutScheme)) return true;
+  return false;
+}
+
+export function classifyModuleSource(source: string): ModuleSourceClassification {
+  const trimmed = source.trim();
+  if (trimmed.startsWith("./") || trimmed.startsWith("../") || trimmed.startsWith(".\\") || trimmed.startsWith("..\\")) {
+    return { kind: "local" };
+  }
+
+  const queryIdx = trimmed.indexOf("?");
+  const base = queryIdx === -1 ? trimmed : trimmed.slice(0, queryIdx);
+  const query = queryIdx === -1 ? "" : trimmed.slice(queryIdx + 1);
+
+  const forced = /^(git|hg)::/i.exec(base);
+  const rest = forced ? base.slice(forced[0].length) : base;
+
+  if (forced || isGitShaped(rest)) {
+    const params = parseQuery(query);
+    const ref = params.get("ref") || params.get("rev") || undefined;
+    return { kind: "git", ref };
+  }
+
+  if (isRegistryAddress(rest)) return { kind: "registry" };
+
+  return { kind: "other" };
+}
+
+const TAG_LIKE = /^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+const FULL_SHA = /^[0-9a-f]{40}$/i;
+const DEFAULT_BRANCHES = new Set(["main", "master", "develop", "trunk"]);
+
+/**
+ * Is `ref` pinned tightly enough for TF005: a semver-shaped tag or a full
+ * 40-hex commit SHA. Stricter than checkov's `CKV_TF_1`/`CKV_TF_2`, which
+ * accept any `?ref=` containing `\d\.\d` (so `v1.2-dev` passes there); the
+ * page documents the difference.
+ */
+export function isPinnedRef(ref: string): boolean {
+  return TAG_LIKE.test(ref) || FULL_SHA.test(ref);
+}
+
+/** Is `ref` one of the well-known mutable branch names tflint's `flexible` style rejects, plus `trunk`. */
+export function isDefaultBranch(ref: string): boolean {
+  return DEFAULT_BRANCHES.has(ref);
+}