@intentius/chant-lexicon-terraform 0.65.0 → 0.66.0

package/dist/behaviour/index.d.ts

@@ -0,0 +1,4 @@
+export { blockAddressOf, edgeCoverageOf, regionOfArn, substituteReferences, terraformBehaviourRequest, type LiveResourceFacts, type LiveResourceStatus, type TerraformBehaviourEntity, type TerraformBehaviourRequest, type TerraformBehaviourRequestOptions, type TerraformLiveRead, } from "./request.js";
+export { liveRootsOf, predictTerraformBehaviour, TERRAFORM, type TerraformBehaviourDeps, type TerraformPredictOptions, } from "./predict.js";
+export { CATALOGUED_KINDS, isUnresolvedKind, REFERENCES_NOTHING, TERRAFORM_REFERENCE_CATALOG, } from "./reference-catalog.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/behaviour/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/behaviour/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,cAAc,EACd,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,SAAS,EACT,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC"}

package/dist/behaviour/predict.d.ts

@@ -0,0 +1,112 @@
+/**
+ * The live path for choudoufu roots (#2360): a prediction of the account as
+ * it stands, drift included.
+ *
+ * `describeResources` (`../describe-resources.ts`) answers "does this declared
+ * block exist" for a live root by running `choudoufu live-plan -json` through
+ * the applier's own activity. This does the same two reads — `live-ls -json`
+ * for what the account holds, `live-plan -json` for how that binds to the
+ * declaration — through the same injected activities, builds the engine's
+ * request from them (`./request.ts`), and hands it to whichever lexicon fronts
+ * the engine. The terraform lexicon has no engine of its own and dials none:
+ * `deps.predict` is augur's `predictBehaviour` in production, and a fixture
+ * in a test.
+ *
+ * ## Four moves, in this order
+ *
+ *  1. **Read.** One `live-ls` and one `live-plan` per live root — none at all
+ *     under `from: "declared"` — no ambient
+ *     credentials and no new shell-out: the activities are the ones
+ *     `describeResources` already runs. A root whose read fails reports every
+ *     resource it declares `read-failed`, naming the root, and is not sent — a
+ *     failed read must never render as an estate with nothing in it.
+ *  2. **Build.** `terraformBehaviourRequest`, pure, over the parsed documents.
+ *  3. **Screen.** `screenBehaviourRequest`, before any engine is asked. Live
+ *     props are exactly where a resolved connection string or a secret written
+ *     into a tag can appear, and the screen's key-name, value-shape,
+ *     URL-userinfo and walk-depth rules all apply to them. A refusal here is
+ *     the result.
+ *  4. **Ask, and account for the rest.** The engine-fronting lexicon answers
+ *     for what was sent. What was not sent — a resource the plan could not
+ *     read, one withheld by `owned`, every resource of a root whose read
+ *     failed — is merged into the report as `unpredicted` with its reason, so
+ *     every declared name still lands in one map or the other.
+ *
+ * A root that is not live is built from its declaration by the same producer,
+ * so a project mixing stock and live roots gets one request with both, and
+ * `sources` says which is which. With no live root at all this is the
+ * declared path, containment included.
+ *
+ * ## Both halves of the delta come out of here
+ *
+ * `from: "declared"` reads no account and builds every root from its file,
+ * including a root that is live. That is the other side of the delta the epic
+ * wants, and it is deliberately the same function rather than a second one:
+ * two reports that differ because one producer was handed different input are
+ * a statement about the estate, and two reports that differ because two
+ * producers disagree about how to assemble a graph are a statement about
+ * chant. `edgeCoverage.containmentEdges` is the field that made the
+ * difference concrete (#2360's third review comment) — it is built by the same
+ * catalog over the same reconstruction on both sides here, so a "one zone
+ * lost" verdict that differs between the two differs because the account
+ * differs.
+ */
+import { type BehaviourResult, type PredictBehaviourOptions } from "@intentius/chant/behaviour";
+import { type TerraformReadDeps } from "../describe-resources.js";
+import { type TerraformBehaviourEntity } from "./request.js";
+/** The name this path screens and refuses under. */
+export declare const TERRAFORM = "terraform";
+/** What the live path needs beyond the request: the two reads, and an engine to ask. */
+export interface TerraformBehaviourDeps {
+    liveLs: TerraformReadDeps["liveLs"];
+    livePlan: TerraformReadDeps["livePlan"];
+    /**
+     * The lexicon in front of the engine. Its own `screenBehaviourRequest` runs
+     * again inside; that is harmless, and the one here is what makes "screened
+     * before any engine call" true of this path rather than of its callee.
+     */
+    predict: (options: PredictBehaviourOptions) => Promise<BehaviourResult>;
+}
+/**
+ * The contract's options, less the three fields this path produces rather than
+ * accepts, plus where to read from.
+ *
+ * `edges` and `edgeCoverage` are **not** inputs. They are what
+ * `./request.ts` computes — from the live reads on one side and from the
+ * declaration on the other — and a caller has no way to know either before
+ * this function has decided which roots it is reading. Asking for them and
+ * then discarding whatever arrived would be a signature that lies about what
+ * it uses, and the delta this path exists for depends on both sides' coverage
+ * being this producer's claim rather than a caller's.
+ *
+ * `entities` is widened to carry the terraform build's `references` beside
+ * `props`, which the builder needs and the contract's own entity shape has no
+ * room for.
+ */
+export interface TerraformPredictOptions extends Omit<PredictBehaviourOptions, "entities" | "edges" | "edgeCoverage"> {
+    entities: ReadonlyMap<string, TerraformBehaviourEntity>;
+    /** Directory the activities start the `chant.config.*` search from. Default: the process cwd. */
+    cwd?: string;
+    /**
+     * Which estate to predict. `"live"`, the default, is this path's whole
+     * point: the account as it stands, drift included. `"declared"` runs the
+     * same producer over the declaration alone and reads no account, which is
+     * the other half of the delta the epic asks for (#2355) — a caller wanting
+     * that delta calls this twice and differences the two reports, and gets two
+     * reports assembled by one producer rather than two shapes that have each
+     * been through a different translation.
+     *
+     * `"declared"` on a project with no live root is the same request `"live"`
+     * builds, because there is no account to read; the option exists so that a
+     * caller can ask for the declaration of a root that *is* live.
+     */
+    from?: "live" | "declared";
+}
+/** Which roots the request would read live: those whose entities the parse stamped `mode: "live"`. */
+export declare function liveRootsOf(entityNames: readonly string[], entities: ReadonlyMap<string, TerraformBehaviourEntity>): string[];
+/**
+ * Predict from the account for every live root, and from the declaration for
+ * every other, through the engine `deps.predict` fronts.
+ */
+export declare function predictTerraformBehaviour(options: TerraformPredictOptions, deps: TerraformBehaviourDeps): Promise<BehaviourResult>;
+//# sourceMappingURL=predict.d.ts.map

package/dist/behaviour/predict.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"predict.d.ts","sourceRoot":"","sources":["../../src/behaviour/predict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAE7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,WAAW,CAAC;AAEnB,oDAAoD;AACpD,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxC;;;;OAIG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;IAC5E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;CAC5B;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,GACtD,MAAM,EAAE,CAQV;AAQD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA2E1B"}

package/dist/behaviour/reference-catalog.d.ts

@@ -0,0 +1,79 @@
+/**
+ * How the aws provider's resources reference each other, as a `ReferenceCatalog`
+ * over terraform's own argument names (#2360).
+ *
+ * `packages/core/src/graph-refs.ts`'s `reconstructEdges` turns a bag of nodes
+ * into a graph by reading identifier values out of each node's attributes and
+ * matching them against every other node's identity. The aws lexicon's
+ * catalog does that over the SDK's shape (`VpcId`, `SecurityGroups[].GroupId`);
+ * this one does it over a terraform block's shape (`vpc_id`,
+ * `vpc_security_group_ids[]`), because that is the shape a block's body has
+ * after `../hcl/parse.ts` and the shape `./request.ts` hands the resolver on
+ * both the declared and the live side.
+ *
+ * ## Keyed by provider type, not by chant entity type
+ *
+ * Every terraform `resource` block is `Terraform::Resource` to chant. A rule
+ * keyed on that would apply to a VPC and an instance alike, so the nodes
+ * `./request.ts` builds for the resolver carry the **provider type** as their
+ * `kind` — `aws_subnet` — and the rules here are keyed the same way. That is
+ * also why this catalog is not declared on the plugin as `referenceCatalog`:
+ * `chant graph --live` builds its nodes with `kind: "Terraform::Resource"`
+ * and attributes that carry no arguments at all, so declaring it there would
+ * be a catalog that matched nothing and looked like coverage.
+ *
+ * ## Two relations, and why the split matters to an engine
+ *
+ * A `containment` rule (subnet ∈ VPC, instance ∈ subnet) becomes a boundary
+ * pair and a traversable containment edge; a `reference` rule becomes an
+ * ordinary edge. `PredictBehaviourOptions.edges` carries the second and
+ * `edgeCoverage.containmentEdges` the first, and the contract keeps them
+ * apart for a reason that is the whole of #2360's first review comment: a
+ * "one zone lost" verdict is computed over zone membership, and membership is
+ * not a reference. Both sides of the declared-versus-live delta run these
+ * same rules, so neither side is structurally short of containment the other
+ * has.
+ *
+ * ## Multi-kind arguments carry no `targetKind`
+ *
+ * `reconstructEdges` records a value under a rule with a `targetKind` as
+ * dangling when the value resolves to a node of another kind. An argument
+ * that legitimately points at more than one kind — a target-group attachment's
+ * `target_id` is an instance or a function — would therefore report every
+ * match of the other kind as a reference leaving the estate. Those rules name
+ * no `targetKind` and take whatever the identifier resolves to, the same
+ * choice the aws catalog makes for its CloudFormation template paths.
+ *
+ * ## What "no rule" means
+ *
+ * A kind with no rule here produces no edges and, on its own, no complaint —
+ * the quiet gap `edgeCoverage.unresolvedKinds` exists to name. But "no rule"
+ * has two causes that should not read alike: nobody has written one, or the
+ * kind holds no identifier-bearing argument to write one about. A VPC
+ * references nothing; an SQS queue names its dead-letter queue inside a JSON
+ * document this catalog does not read. {@link REFERENCES_NOTHING} is the list
+ * of kinds in the first position, checked rather than assumed, so that an
+ * estate with a VPC in it is not `partial` forever and an estate with a queue
+ * in it is not `complete` by omission.
+ */
+import type { ReferenceCatalog } from "@intentius/chant/graph-refs";
+/**
+ * Provider types this catalog has looked at and found to hold no argument
+ * that identifies another resource. A node of one of these kinds is not an
+ * unresolved kind: nothing was looked for because there is nothing to find.
+ *
+ * Deliberately short. A kind is added here when every identifier-bearing
+ * argument it has is also a rule below, or when it has none — not when its
+ * references happen to be inconvenient to read.
+ */
+export declare const REFERENCES_NOTHING: ReadonlySet<string>;
+/** The catalog. Rules are grouped by the relation they produce. */
+export declare const TERRAFORM_REFERENCE_CATALOG: ReferenceCatalog;
+/** Every provider type the catalog has at least one rule from. */
+export declare const CATALOGUED_KINDS: ReadonlySet<string>;
+/**
+ * True when nothing would be looked for on a node of this kind: no rule is
+ * written for it, and it is not one of the kinds known to reference nothing.
+ */
+export declare function isUnresolvedKind(kind: string): boolean;
+//# sourceMappingURL=reference-catalog.d.ts.map

package/dist/behaviour/reference-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference-catalog.d.ts","sourceRoot":"","sources":["../../src/behaviour/reference-catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAMjD,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,2BAA2B,EAAE,gBA8FzC,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAgE,CAAC;AAElH;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD"}

package/dist/behaviour/request.d.ts

@@ -0,0 +1,178 @@
+/**
+ * A behaviour engine's request from a terraform estate, declared or live (#2360).
+ *
+ * The epic (#2355) wants two predictions shown as a delta: what the file
+ * declares, and what the account holds. For a choudoufu root the second is
+ * readable — `live-ls -json` lists every resource the account holds under the
+ * estate's marker, `live-plan -json` says which declared instance each one is
+ * bound to and which declarations nothing answers for — and this module turns
+ * either reading into the request `PredictBehaviourOptions` describes:
+ * `entityNames`, `entities`, `edges`, `edgeCoverage`, `traffic`.
+ *
+ * One producer for both sides, on purpose. A delta is only a statement about
+ * the estate if both sides were assembled the same way, and the third review
+ * comment on #2360 is about exactly the asymmetry this avoids: the declared
+ * path had no containment producer, so a "one zone lost" verdict differed
+ * between the sides for a reason that was not drift. Here the same reference
+ * catalog (`./reference-catalog.ts`) runs over the same reconstruction
+ * (`reconstructEdges`, `packages/core/src/graph-refs.ts`) on both sides, and
+ * `edgeCoverage.containmentEdges` is populated the same way on each.
+ *
+ * ## What the live side is, and is not
+ *
+ * The two documents carry identities, types, addresses and markers. Neither
+ * carries a resource's attributes: a subnet's `vpc_id` as the account holds it
+ * is in no section of either. So a live node's arguments are the declaration's
+ * arguments — the body choudoufu applied — and its **references** are the
+ * declaration's references resolved against what is bound: a reference whose
+ * target the plan bound resolves to that target's live identity, and one whose
+ * target is absent from the account stays unresolved and is reported as
+ * `dangling`, naming the node, the argument and the address it points at. A
+ * resource the listing holds that nothing declares has no body at all; it is a
+ * node with an identity and a type, and its kind is counted into
+ * `unresolvedKinds` unless the catalog knows that kind references nothing.
+ *
+ * The drift this side sees is therefore **membership** drift: a resource added
+ * out of band under the estate's marker, a declared resource never applied, a
+ * resource at a declared identity that another estate holds. An attribute
+ * changed live — an instance resized by hand — is not in either document and
+ * is not claimed here; the size an engine is sent is the declared one on both
+ * sides. `describe-resources.ts`'s module doc has the same boundary for the
+ * observation read, for the same reason.
+ *
+ * One consequence of that worth stating outright, because it is the one a
+ * reader will hit first: a block with `count` or `for_each` is **one** node on
+ * both sides, whatever the account holds. The request's unit is the entity the
+ * caller asked about, and the caller asked about `aws_eip.pool`, not about two
+ * slots — inventing `aws_eip.pool[0]` and `[1]` as entities would put names in
+ * the report that are in no `entityNames` list and in no build. Every instance
+ * address the plan named rides on `props.live.instances` instead, so an engine
+ * that prices per instance has the count and one that does not is not silently
+ * handed a multiplier. An estate whose drift is a changed `count` is therefore
+ * a delta this path does not yet show.
+ *
+ * ## `edgeCoverage`, honestly
+ *
+ * `partial` whenever `dangling` or `unresolvedKinds` is non-empty, `complete`
+ * only when both are empty, and `dangling` carries `reconstructEdges`'s
+ * `DanglingRef` records through unflattened — `from` is the field that says
+ * which node's argument leaves the estate. `containmentEdges` comes from the
+ * reconstruction's `containmentEdges`, the traversable shape, and never from
+ * the `containment` pairs beside it. All three of those are #2360's review
+ * comments, applied.
+ */
+import type { BehaviourEdgeCoverage, PredictBehaviourOptions, UnpredictedEntity } from "@intentius/chant/behaviour";
+import type { EntityReference } from "@intentius/chant/graph-ir";
+import { type ReconstructedEdges } from "@intentius/chant/graph-refs";
+import { type LiveLsListing, type LivePlanIndex } from "../describe-resources.js";
+/**
+ * One entity as this builder needs it: the contract's `{ entityType, props }`
+ * plus the `references` the terraform build stamps beside `props`
+ * (`../hcl/edges.ts`, chant #2265). A caller holding the build's entities has
+ * them; a caller that copied only the two contract fields does not, and a
+ * block whose body holds a `${…}` reference with none resolved is counted as
+ * an unresolved kind rather than read as referencing nothing.
+ */
+export interface TerraformBehaviourEntity {
+    entityType: string;
+    props: Record<string, unknown>;
+    references?: readonly EntityReference[];
+}
+/** One live root's two documents, already parsed. */
+export interface TerraformLiveRead {
+    root: string;
+    listing: LiveLsListing;
+    plan: LivePlanIndex;
+}
+/** How a live node stands in the account. */
+export type LiveResourceStatus = "bound" | "adoptable" | "foreign" | "orphan";
+/**
+ * What a live node's `props.live` carries: the facts the two documents state
+ * about it, kept apart from the declaration under `props` so a reader can
+ * tell which side said what.
+ */
+export interface LiveResourceFacts {
+    status: LiveResourceStatus;
+    ownership: "owned" | "unknown" | "foreign";
+    /** The import identity the plan bound (`vpc-…`, a bucket name), on a single-instance block. */
+    identity?: string;
+    /** The ARN or other stable identity the listing carries. */
+    arn?: string;
+    /** The region the ARN names, where it names one. */
+    region?: string;
+    /** Every instance address the plan named for the block, where there is more than the block itself. */
+    instances?: string[];
+    /** The estate holding a foreign resource, when its marker names one. */
+    heldBy?: string;
+    /** The marker tags the listing read off an undeclared resource. */
+    tags?: Record<string, string>;
+}
+export interface TerraformBehaviourRequestOptions extends Pick<PredictBehaviourOptions, "environment" | "buildOutput" | "traffic" | "region" | "stack" | "owned"> {
+    entityNames: readonly string[];
+    entities: ReadonlyMap<string, TerraformBehaviourEntity>;
+    /**
+     * Live reads, one per live root. A root with a read here is built from the
+     * account; every other root is built from its declaration. Omit for the
+     * declared side.
+     */
+    live?: readonly TerraformLiveRead[];
+}
+export interface TerraformBehaviourRequest {
+    /** The request, ready for `screenBehaviourRequest` and an engine-fronting `predictBehaviour`. */
+    request: PredictBehaviourOptions;
+    /** Which side each name in the request came from. */
+    sources: Record<string, "live" | "declared">;
+    /**
+     * Declared resources of a live root the account does not hold: the plan
+     * reported them `ABSENT`, or named no instance for them. Not in the request,
+     * because a prediction of the account cannot price what is not in it, and
+     * not `unpredicted`, because the contract has no reason for "not there".
+     * The declared side names them; the delta shows them as declared-only.
+     */
+    absent: string[];
+    /**
+     * Declared names of a live root with no live verdict to build from — an
+     * instance the plan could not read, or one withheld by `owned` — each with
+     * the reason. Not in the request; a caller merges them into the report.
+     */
+    unpredicted: Record<string, UnpredictedEntity>;
+}
+/** The block a document instance address belongs to: `aws_eip.pool[0]` is `aws_eip.pool`. */
+export declare function blockAddressOf(instance: string): string;
+/** The region an ARN names, or undefined for a global one (`arn:aws:s3:::bucket`). */
+export declare function regionOfArn(arn: string): string | undefined;
+/**
+ * The body with every resolvable reference replaced by the identifier it
+ * stands for, so `reconstructEdges` can match it against the node that owns
+ * that identifier.
+ *
+ * A leaf string is replaced only when the reference **is** the whole value:
+ * the string is one `${…}` and nothing else, exactly one of the block's
+ * references under the same top-level argument is the one it names, and that
+ * reference resolves. Then the value in the account really is the target's
+ * identity, and matching it against the node holding that identity is a
+ * statement about the estate.
+ *
+ * Everything else is left alone, and the two cases it leaves alone are
+ * different. `"${a.id}-${b.id}"` and `"${a.id}-suffix"` are composed values —
+ * a name derived from an identity is not that identity, and substituting the
+ * bare identity into one would hand the resolver a value the account does not
+ * hold and get back an edge nothing points along. A string naming a reference
+ * that does not resolve keeps its `${…}`, which is what makes a reference to a
+ * target the account is missing come back from the resolver as `dangling` with
+ * the address in `value` rather than vanishing.
+ */
+export declare function substituteReferences(body: Record<string, unknown>, references: readonly EntityReference[], addressOf: (to: string) => string | undefined, resolve: (to: string) => string | undefined): Record<string, unknown>;
+/**
+ * The coverage claim, from the reconstruction and the kinds nothing was
+ * looked for on. `partial` names what is missing; `complete` is claimed only
+ * when nothing is.
+ */
+export declare function edgeCoverageOf(reconstructed: Pick<ReconstructedEdges, "dangling" | "containmentEdges">, unresolvedKinds: readonly string[]): BehaviourEdgeCoverage;
+/**
+ * Build the request. Pure: the documents are already parsed and nothing here
+ * reads a clock, the environment or the filesystem, so the same declaration
+ * and the same two documents give the same request forever.
+ */
+export declare function terraformBehaviourRequest(options: TerraformBehaviourRequestOptions): TerraformBehaviourRequest;
+//# sourceMappingURL=request.d.ts.map

package/dist/behaviour/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/behaviour/request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAU,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAI/B;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACzC;AAED,qDAAqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gCACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/G,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD;;;;OAIG;IACH,IAAI,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,iGAAiG;IACjG,OAAO,EAAE,uBAAuB,CAAC;IACjC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC;IAC7C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAQD,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3D;AAmCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,UAAU,EAAE,SAAS,eAAe,EAAE,EACtC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC7C,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB;AAgRD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,kBAAkB,CAAC,EACxE,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,qBAAqB,CASvB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CA6D9G"}

package/dist/describe-resources.d.ts

@@ -153,7 +153,7 @@
  * `id`, which is the physical id every observation carries.
  */
 import type { DescribeResourcesResult, ResourceMetadata, TeardownEnumeration } from "@intentius/chant/lexicon";
-import { type UnobservedReason } from "@intentius/chant/observation";
+import { type DeclaredEntity, type UnobservedReason } from "@intentius/chant/observation";
 import type { OwnershipMarker } from "@intentius/chant/ownership";
 import { choudoufuLiveLs, choudoufuLivePlan, terraformInit, terraformShow } from "./op/activities/terraform.js";
 export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
@@ -281,6 +281,40 @@ export declare function indexLivePlan(document: unknown): LivePlanIndex;
  * direction: no NOT-OBSERVED verdict ever becomes a create or a delete.
  */
 export declare const LIVE_PLAN_OMISSION_REASONS: Readonly<Record<string, UnobservedReason | "absent">>;
+/**
+ * Every instance address in the document belonging to the declared block
+ * `address`. Exported for the behaviour request builder (`./behaviour/`,
+ * #2360), which places the same blocks against the same document.
+ */
+export declare function instancesOf(address: string, index: LivePlanIndex): string[];
+/** One instance's verdict, before a block aggregates its instances. */
+export type InstanceVerdict = {
+    kind: "owned";
+    row: LivePlanBoundRow;
+} | {
+    kind: "adoptable";
+    row: LivePlanAdoptableRow;
+} | {
+    kind: "foreign";
+    row: LivePlanUnownedRow;
+} | {
+    kind: "absent";
+} | {
+    kind: "unobserved";
+    reason: UnobservedReason;
+    detail: string;
+};
+/**
+ * Classify one instance address against the document, `unowned[]` first: a
+ * declared instance that also carries a `UNOWNED` omission is answered by the
+ * section that has the verdict, not by the one that has the apology.
+ * `adoptable[]` sits under `bound[]` for the same reason, one rung further
+ * down: a content match is the answer for an instance nothing else could
+ * answer for, and its paired omission is always `NEEDS_DISCOVERY`, which on
+ * its own would read as unsupported-kind and hide a real, actionable verdict
+ * (choudoufu #962, chant #2241).
+ */
+export declare function classifyLiveInstance(address: string, index: LivePlanIndex): InstanceVerdict;
 /** One `items[]` entry of a `live-ls -json` listing. */
 export interface LiveLsItem {
     /** ARN or other stable identity. */
@@ -387,6 +421,13 @@ export interface TerraformReadDeps {
     livePlan: typeof choudoufuLivePlan;
     liveLs: typeof choudoufuLiveLs;
 }
+/** A declared entity, plus the root, address and mode `buildRoots()` recorded on it. */
+export interface TerraformDeclared extends DeclaredEntity {
+    root: string;
+    address: string;
+    /** `"live"` when the root runs under choudoufu with a declared estate (#2103). */
+    mode?: string;
+}
 /**
  * The address the live system knows a block by. For a root-module block that
  * is the block's own address; for one inside a child module it is what
@@ -397,6 +438,15 @@ export interface TerraformReadDeps {
  * read observes still line up one to one.
  */
 export declare function qualifiedAddress(address: string, callers: readonly string[]): string;
+/**
+ * The root, qualified address and mode of one declared entity, from what
+ * `buildRoots()` recorded on its props. Exported for the behaviour request
+ * builder (#2360), which groups entities by root the same way.
+ */
+export declare function declaredOf(name: string, entity: {
+    entityType: string;
+    props: Record<string, unknown>;
+} | undefined): TerraformDeclared;
 export interface DescribeResourcesOptions {
     environment: string;
     buildOutput: string;

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyJG;AAEH,OAAO,KAAK,EACV,uBAAuB,EACvB,gBAAgB,EAEhB,mBAAmB,EAEpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAQL,KAAK,gBAAgB,EACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,aAAa,EACd,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACpC,wFAAwF;IACxF,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACtB;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CA6BjE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,CAE9F;AAWD,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACzC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7C;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,GAAG,aAAa,CAmF9D;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,QAAQ,CAAC,CAmB5F,CAAC;AA0PF,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,qFAAqF;AACrF,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,GAAG,aAAa,CAqC3D;AAYD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAEvC;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAkBlG;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C,GAAG,iBAAiB,EACrB,IAAI,GAAE,iBAA6B,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAsC3C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG,iBAAiB,EAC7E,IAAI,GAAE,iBAA6B,GAClC,OAAO,CAAC,mBAAmB,CAAC,CA6C9B;AAYD,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,aAAa,CAAC;IAC3B,IAAI,EAAE,OAAO,aAAa,CAAC;IAC3B,QAAQ,EAAE,OAAO,iBAAiB,CAAC;IACnC,MAAM,EAAE,OAAO,eAAe,CAAC;CAChC;AAmCD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEpF;AAgGD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,iBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAuElC"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyJG;AAEH,OAAO,KAAK,EACV,uBAAuB,EACvB,gBAAgB,EAEhB,mBAAmB,EAEpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAKL,KAAK,cAAc,EAGnB,KAAK,gBAAgB,EACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,aAAa,EACd,MAAM,2BAA2B,CAAC;AAMnC,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yFAAyF;IACzF,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,iEAAiE;IACjE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACpC,wFAAwF;IACxF,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACtB;AAgBD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,OAAO,GAAG,UAAU,CA6BjE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,CAE9F;AAWD,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4FAA4F;IAC5F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qFAAqF;AACrF,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kGAAkG;AAClG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACvD;AAED,0EAA0E;AAC1E,MAAM,WAAW,aAAa;IAC5B,+DAA+D;IAC/D,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IACzC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7C;;;;OAIG;IACH,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,GAAG,aAAa,CAmF9D;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,GAAG,QAAQ,CAAC,CAmB5F,CAAC;AAgBF;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,MAAM,EAAE,CAE3E;AASD,uEAAuE;AACvE,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,gBAAgB,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,GAAG,EAAE,oBAAoB,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,GAAG,eAAe,CA4B3F;AAgLD,wDAAwD;AACxD,MAAM,WAAW,UAAU;IACzB,oCAAoC;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,qCAAqC;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,4FAA4F;IAC5F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,CAAC;IAClB,6DAA6D;IAC7D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B;AAED,qFAAqF;AACrF,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,IAAI,EAAE,SAAS,EAAE,CAAC;CACnB;AAED,4FAA4F;AAC5F,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,GAAG,aAAa,CAqC3D;AAYD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAEvC;AAED,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IAChC,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAkBlG;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC5C,GAAG,iBAAiB,EACrB,IAAI,GAAE,iBAA6B,GAClC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAsC3C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG,iBAAiB,EAC7E,IAAI,GAAE,iBAA6B,GAClC,OAAO,CAAC,mBAAmB,CAAC,CA6C9B;AAYD,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,OAAO,aAAa,CAAC;IAC3B,IAAI,EAAE,OAAO,aAAa,CAAC;IAC3B,QAAQ,EAAE,OAAO,iBAAiB,CAAC;IACnC,MAAM,EAAE,OAAO,eAAe,CAAC;CAChC;AASD,wFAAwF;AACxF,MAAM,WAAW,iBAAkB,SAAQ,cAAc;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAoBD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEpF;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,SAAS,GAAG,iBAAiB,CActI;AAgFD,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,iBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAuElC"}

package/dist/index.d.ts

@@ -12,4 +12,5 @@ export type { TerraformWatchOpConfig, TerraformWatchOpResources, TerraformFindin
 export { TerraformAdoptOp } from "./composites/terraform-adopt-op.js";
 export type { TerraformAdoptOpConfig, TerraformAdoptOpResources } from "./composites/terraform-adopt-op.js";
 export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
+export { predictTerraformBehaviour, terraformBehaviourRequest, TERRAFORM_REFERENCE_CATALOG, type TerraformBehaviourDeps, type TerraformBehaviourEntity, type TerraformBehaviourRequest, type TerraformBehaviourRequestOptions, type TerraformLiveRead, type TerraformPredictOptions, } from "./behaviour/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAKzG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAKzG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAOnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "d343d6292beaaf88268848977437b1cbddfa88b84bb0daa88eb07e34536579b1",
+    "manifest.json": "226bbce3601e4a1ba4ae65964a53010231d8b6174b599804cfae272eeb6e0fc1",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
@@ -37,5 +37,5 @@
     "rules/tf028.ts": "81ef95659c40ad1774c83e663473ed769143d894a4ba0517c3defa31f00ba723",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "7d976b27efddd6fcfe089f960509d555e2e813abc093eb8317d3ef3163e8d3b7"
+  "composite": "f46021b80755a0ea4886db1cdfd1423d8d4e5e537967a787f10bae5bba496f07"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "type": "module",
   "files": [
     "src/",
@@ -56,7 +56,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.65.0",
+    "@intentius/chant": "^0.66.0",
     "typescript": "^5.9.3"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/behaviour/index.ts

@@ -0,0 +1,29 @@
+// The live path for choudoufu roots (#2360): the account as it stands, as a
+// behaviour engine's request, and the same producer over the declaration so
+// the two sides of the delta are built alike.
+export {
+  blockAddressOf,
+  edgeCoverageOf,
+  regionOfArn,
+  substituteReferences,
+  terraformBehaviourRequest,
+  type LiveResourceFacts,
+  type LiveResourceStatus,
+  type TerraformBehaviourEntity,
+  type TerraformBehaviourRequest,
+  type TerraformBehaviourRequestOptions,
+  type TerraformLiveRead,
+} from "./request";
+export {
+  liveRootsOf,
+  predictTerraformBehaviour,
+  TERRAFORM,
+  type TerraformBehaviourDeps,
+  type TerraformPredictOptions,
+} from "./predict";
+export {
+  CATALOGUED_KINDS,
+  isUnresolvedKind,
+  REFERENCES_NOTHING,
+  TERRAFORM_REFERENCE_CATALOG,
+} from "./reference-catalog";