@intentius/chant-lexicon-terraform 0.65.0 → 0.66.0

package/src/behaviour/predict.test.ts

@@ -0,0 +1,381 @@
+/**
+ * The live path, end to end (#2360): the two reads, the screen, the engine,
+ * and the delta against the declared path.
+ *
+ * The estate is the recorded one `./request.test.ts` and
+ * `../describe-resources.live.test.ts` use — `../__fixtures__/live-estate/`
+ * parsed as a build parses it, and the two documents choudoufu v0.15.0
+ * recorded from it against its pinned floci image. The activities are
+ * injected, so nothing here runs choudoufu and nothing reaches an account.
+ *
+ * ## The engine
+ *
+ * `deps.predict` is augur's `predictBehaviour` in production. Here it is
+ * {@link tariff}, which prices a node per hour by its provider type and
+ * nothing else. That is a poor cost model and a good instrument: it makes an
+ * estate's total a plain sum over the entities that side of the path sent, so
+ * a difference between the two totals is a difference in **which entities were
+ * sent** and cannot be anything else. Which entities each side sends is the
+ * whole of what this issue changed.
+ */
+
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { beforeAll, describe, expect, it } from "vitest";
+import {
+  behaviourReport,
+  isBehaviourRefusalReport,
+  predictedRate,
+  type BehaviourReport,
+  type BehaviourResult,
+  type PredictBehaviourOptions,
+  type PredictedBehaviour,
+  type UnpredictedEntity,
+} from "@intentius/chant/behaviour";
+import type { Declarable } from "@intentius/chant/declarable";
+import type { TerraformReadDeps } from "../describe-resources";
+import { renderTerraformRoots } from "../hcl/roots";
+import { liveRootsOf, predictTerraformBehaviour, TERRAFORM } from "./predict";
+import type { TerraformBehaviourEntity } from "./request";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "..", "__fixtures__");
+const PLAN: unknown = JSON.parse(readFileSync(join(fixtures, "live-plan.json"), "utf-8"));
+const LS: unknown = JSON.parse(readFileSync(join(fixtures, "live-ls.json"), "utf-8"));
+const ROOT = "estate";
+const ESTATE = "stateless-e2e-block";
+
+const key = (address: string): string => `${ROOT}/${address}`;
+
+let entities: Map<string, TerraformBehaviourEntity>;
+let entityNames: string[];
+
+beforeAll(async () => {
+  const rendered = await renderTerraformRoots({
+    projectRoot: fixtures,
+    roots: { [ROOT]: { dir: "./live-estate" } },
+    binary: "choudoufu",
+  });
+  entities = new Map();
+  for (const [name, entity] of rendered.entities) {
+    const e = entity as Declarable & { props: Record<string, unknown>; references?: readonly never[] };
+    entities.set(name, {
+      entityType: e.entityType,
+      props: e.props,
+      ...(e.references ? { references: e.references } : {}),
+    });
+  }
+  entityNames = [...entities.keys()].sort();
+});
+
+/* ── the activities ──────────────────────────────────────────────────────── */
+
+/** A stock activity that must never be reached: a live root has no state file to show. */
+const neverStock = (() => {
+  throw new Error("terraform show was run on a live root");
+}) as never;
+
+interface Call {
+  activity: "liveLs" | "livePlan";
+  root: string;
+}
+
+function deps(overrides?: Partial<TerraformReadDeps>): { deps: TerraformReadDeps; calls: Call[] } {
+  const calls: Call[] = [];
+  return {
+    calls,
+    deps: {
+      init: neverStock,
+      show: neverStock,
+      livePlan: (async (options: { root: string }) => {
+        calls.push({ activity: "livePlan", root: options.root });
+        return { json: PLAN, estate: ESTATE, dir: fixtures, drift: true, text: "" };
+      }) as unknown as TerraformReadDeps["livePlan"],
+      liveLs: (async (options: { root: string }) => {
+        calls.push({ activity: "liveLs", root: options.root });
+        return { json: LS, estate: ESTATE, dir: fixtures };
+      }) as unknown as TerraformReadDeps["liveLs"],
+      ...overrides,
+    } as TerraformReadDeps,
+  };
+}
+
+/* ── the engine ──────────────────────────────────────────────────────────── */
+
+const FIXTURE_ENGINE = "tariff";
+const FIXTURE_VERSION = "0.0.1";
+
+/** Rate per hour by provider type. Round numbers, so a delta is readable. */
+const RATES: Readonly<Record<string, number>> = {
+  aws_vpc: 0,
+  aws_subnet: 0,
+  aws_security_group: 0,
+  aws_security_group_rule: 0,
+  aws_cloudwatch_log_group: 1,
+  aws_eip: 2,
+  aws_s3_bucket: 8,
+};
+
+function providerTypeOf(props: Record<string, unknown>): string | undefined {
+  const stated = props.resourceType;
+  if (typeof stated === "string") return stated;
+  const address = props.address;
+  if (typeof address !== "string") return undefined;
+  const dot = address.indexOf(".");
+  return dot > 0 ? address.slice(0, dot) : undefined;
+}
+
+function figure(perHour: number, traffic: string): PredictedBehaviour {
+  return {
+    at: { traffic },
+    cost: predictedRate(perHour, "USD"),
+    headroom: { cpu: 0.5 },
+    errorRate: 0,
+    resilience: { failure: "one zone lost", verdict: "survives" },
+    provenance: {
+      engine: FIXTURE_ENGINE,
+      version: FIXTURE_VERSION,
+      tolerance: "±100%",
+      basis: "modeled",
+    },
+  };
+}
+
+/**
+ * The engine: a rate per provider type, and a stated decline for anything
+ * else. Every name it is sent lands in one map or the other, which is the
+ * contract's rule and also what keeps a total a sum over a known set.
+ */
+async function tariff(options: PredictBehaviourOptions): Promise<BehaviourResult> {
+  const priced: Record<string, PredictedBehaviour> = Object.create(null) as Record<string, PredictedBehaviour>;
+  const declined: Record<string, { type?: string; reason: "unsupported-kind"; detail: string }> = Object.create(
+    null,
+  ) as Record<string, { type?: string; reason: "unsupported-kind"; detail: string }>;
+  let total = 0;
+  for (const name of options.entityNames) {
+    const entity = options.entities.get(name);
+    const type = entity ? providerTypeOf(entity.props) : undefined;
+    if (type === undefined || !Object.prototype.hasOwnProperty.call(RATES, type)) {
+      declined[name] = {
+        ...(entity ? { type: entity.entityType } : {}),
+        reason: "unsupported-kind",
+        detail: `${FIXTURE_ENGINE} prices no ${type ?? "block of this kind"}`,
+      };
+      continue;
+    }
+    total += RATES[type];
+    priced[name] = figure(RATES[type], options.traffic);
+  }
+  return behaviourReport(
+    options,
+    { engine: FIXTURE_ENGINE, version: FIXTURE_VERSION, total: predictedRate(total, "USD") },
+    priced,
+    declined,
+  );
+}
+
+/* ── helpers ─────────────────────────────────────────────────────────────── */
+
+const common = { environment: "prod", buildOutput: "/tmp/build", traffic: "100 rps, p50" };
+
+async function predict(
+  overrides?: { owned?: boolean; deps?: Partial<TerraformReadDeps> },
+): Promise<{ result: BehaviourResult; calls: Call[] }> {
+  const d = deps(overrides?.deps);
+  const result = await predictTerraformBehaviour(
+    { ...common, entityNames, entities, ...(overrides?.owned ? { owned: true } : {}) },
+    { liveLs: d.deps.liveLs, livePlan: d.deps.livePlan, predict: tariff },
+  );
+  return { result, calls: d.calls };
+}
+
+/**
+ * The declared side: the same function, the same producer, `from: "declared"`.
+ * The activities throw, so a run that reached for the account fails loudly
+ * rather than quietly answering with it.
+ */
+async function predictDeclared(): Promise<BehaviourResult> {
+  const reachedForTheAccount = (() => {
+    throw new Error("the declared side read the account");
+  }) as never;
+  return predictTerraformBehaviour(
+    { ...common, entityNames, entities, from: "declared" },
+    { liveLs: reachedForTheAccount, livePlan: reachedForTheAccount, predict: tariff },
+  );
+}
+
+function report(result: BehaviourResult): BehaviourReport {
+  if (isBehaviourRefusalReport(result)) throw new Error(`refused: ${result.refusal.reason}`);
+  return result;
+}
+
+/**
+ * The report's `unpredicted` map. Optional on the type and omitted entirely
+ * when empty (`behaviourReport`), so a run that predicted everything has no
+ * key at all rather than an empty object — reading it through here keeps that
+ * from reading as a missing entry.
+ */
+function unpredictedOf(result: BehaviourResult): Record<string, UnpredictedEntity> {
+  return report(result).unpredicted ?? {};
+}
+
+const totalOf = (result: BehaviourResult): number => report(result).meta.total?.perHour ?? 0;
+
+describe("which roots are read", () => {
+  it("names the roots the build stamped live, and no other", () => {
+    expect(liveRootsOf(entityNames, entities)).toEqual([ROOT]);
+    // A root the build did not stamp live is never read: `describeResources`
+    // branches the same way, and a stock root has no `live-ls` to run.
+    const stock = new Map(
+      [...entities].map(([name, e]) => [name, { ...e, props: { ...e.props, mode: "stock" } }]),
+    );
+    expect(liveRootsOf(entityNames, stock)).toEqual([]);
+  });
+
+  it("runs one live-ls and one live-plan for the root, and no stock activity", async () => {
+    const { calls } = await predict();
+    expect(calls).toEqual([
+      { activity: "liveLs", root: ROOT },
+      { activity: "livePlan", root: ROOT },
+    ]);
+  });
+});
+
+describe("the prediction of the account", () => {
+  it("prices what the account holds, including what nothing declares", async () => {
+    const { result } = await predict();
+    const predicted = report(result);
+    expect(Object.keys(predicted.entities)).toContain(key("aws_s3_bucket.data"));
+    expect(predicted.entities[key("aws_s3_bucket.data")].cost.perHour).toBe(RATES.aws_s3_bucket);
+    expect(predicted.meta.engine).toBe(FIXTURE_ENGINE);
+    expect(predicted.meta.at.traffic).toBe(common.traffic);
+  });
+
+  it("leaves every name the caller asked about in one map or the other", async () => {
+    const { result } = await predict();
+    const predicted = report(result);
+    const landed = new Set([...Object.keys(predicted.entities), ...Object.keys(unpredictedOf(result))]);
+    // Everything asked about, minus what the account does not hold — a
+    // resource the plan reported ABSENT is not the account's to predict, and
+    // the declared side is where it is answered for.
+    for (const name of entityNames) {
+      if (name === key("aws_cloudwatch_log_group.never_applied")) continue;
+      if (name === key("aws_security_group_rule.https")) continue;
+      expect(landed.has(name), name).toBe(true);
+    }
+  });
+
+  it("reports what --owned withheld as filtered, not as absent", async () => {
+    const { result } = await predict({ owned: true });
+    const predicted = report(result);
+    const held = unpredictedOf(result)[key("aws_cloudwatch_log_group.held_elsewhere")];
+    expect(held?.reason).toBe("filtered");
+    expect(held?.detail).toContain("--owned");
+    expect(Object.keys(predicted.entities)).not.toContain(key("aws_cloudwatch_log_group.held_elsewhere"));
+  });
+});
+
+describe("a read that failed", () => {
+  it("reports every resource of the root read-failed, naming the root, and sends none of them", async () => {
+    const { result } = await predict({
+      deps: {
+        liveLs: (() => {
+          throw new Error("no valid credential sources found for AWS Provider");
+        }) as never,
+      },
+    });
+    const predicted = report(result);
+    const entry = unpredictedOf(result)[key("aws_vpc.main")];
+    expect(entry?.reason).toBe("read-failed");
+    expect(entry?.detail).toContain(`terraform.roots.${ROOT}`);
+    // The failure names credentials, and saying so is the difference between
+    // an operator checking a variable and one debugging an account.
+    expect(entry?.detail).toContain("the failure names credentials");
+    // Nothing of that root was priced: a failed read must never render as an
+    // estate with nothing in it.
+    expect(Object.keys(predicted.entities)).toEqual([]);
+    expect(predicted.meta.total?.perHour).toBe(0);
+  });
+
+  it("does not claim credentials when the failure was something else", async () => {
+    const { result } = await predict({
+      deps: {
+        livePlan: (() => {
+          throw new Error("dial tcp 127.0.0.1:4660: connect: connection refused");
+        }) as never,
+      },
+    });
+    const entry = unpredictedOf(result)[key("aws_vpc.main")];
+    expect(entry?.reason).toBe("read-failed");
+    expect(entry?.detail).not.toContain("credentials");
+    expect(entry?.detail).toContain("connection refused");
+  });
+});
+
+describe("the screen runs before the engine", () => {
+  it("refuses a request whose props carry a credential, and asks no engine", async () => {
+    let asked = false;
+    const tainted = new Map(entities);
+    tainted.set(key("aws_vpc.main"), {
+      entityType: "Terraform::Resource",
+      props: {
+        ...entities.get(key("aws_vpc.main"))!.props,
+        body: { cidr_block: "10.99.0.0/16", awsSecretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" },
+      },
+    });
+    const d = deps();
+    const result = await predictTerraformBehaviour(
+      { ...common, entityNames, entities: tainted },
+      {
+        liveLs: d.deps.liveLs,
+        livePlan: d.deps.livePlan,
+        predict: async () => {
+          asked = true;
+          throw new Error("the engine was asked after the screen refused");
+        },
+      },
+    );
+    expect(asked).toBe(false);
+    expect(isBehaviourRefusalReport(result)).toBe(true);
+    if (isBehaviourRefusalReport(result)) {
+      expect(result.refusal.reason).toContain(TERRAFORM);
+    }
+  });
+});
+
+describe("the delta the epic asks for", () => {
+  it("predicts a different figure for the drifted estate, by the size of the drift", async () => {
+    const live = report((await predict()).result);
+    const declared = report(await predictDeclared());
+
+    // The recording's drift, and the whole of it: `storage.tf` was removed
+    // after the apply, so the bucket is in the account and in no file; three
+    // blocks were restored after the apply and never applied, two of which
+    // the plan reports ABSENT.
+    const onlyLive = Object.keys(live.entities).filter((n) => !(n in declared.entities));
+    const onlyDeclared = Object.keys(declared.entities).filter((n) => !(n in live.entities));
+    expect(onlyLive).toEqual([key("aws_s3_bucket.data")]);
+    expect(onlyDeclared.sort()).toEqual([
+      key("aws_cloudwatch_log_group.never_applied"),
+      key("aws_security_group_rule.https"),
+    ]);
+
+    // The money moves by exactly the priced half of that: one bucket in, one
+    // log group out. The rule is the third and prices at zero, so it moves the
+    // membership and not the figure — which is why the membership is asserted
+    // above rather than inferred from the total.
+    expect(totalOf(live) - totalOf(declared)).toBe(RATES.aws_s3_bucket - RATES.aws_cloudwatch_log_group);
+    expect(totalOf(declared)).toBe(RATES.aws_cloudwatch_log_group * 4 + RATES.aws_eip);
+    expect(totalOf(live)).toBe(RATES.aws_cloudwatch_log_group * 3 + RATES.aws_eip + RATES.aws_s3_bucket);
+  });
+
+  it("keeps both sides comparable: same engine, same level, same basis", async () => {
+    const live = report((await predict()).result);
+    const declared = report(await predictDeclared());
+    expect(live.meta.engine).toBe(declared.meta.engine);
+    expect(live.meta.at).toEqual(declared.meta.at);
+    // And the same edge-coverage claim, so a resilience verdict on one side is
+    // not computed over a graph the other side does not have.
+    expect(live.meta.edgeCoverage.verdict).toBe(declared.meta.edgeCoverage.verdict);
+  });
+});

package/src/behaviour/predict.ts

@@ -0,0 +1,225 @@
+/**
+ * The live path for choudoufu roots (#2360): a prediction of the account as
+ * it stands, drift included.
+ *
+ * `describeResources` (`../describe-resources.ts`) answers "does this declared
+ * block exist" for a live root by running `choudoufu live-plan -json` through
+ * the applier's own activity. This does the same two reads — `live-ls -json`
+ * for what the account holds, `live-plan -json` for how that binds to the
+ * declaration — through the same injected activities, builds the engine's
+ * request from them (`./request.ts`), and hands it to whichever lexicon fronts
+ * the engine. The terraform lexicon has no engine of its own and dials none:
+ * `deps.predict` is augur's `predictBehaviour` in production, and a fixture
+ * in a test.
+ *
+ * ## Four moves, in this order
+ *
+ *  1. **Read.** One `live-ls` and one `live-plan` per live root — none at all
+ *     under `from: "declared"` — no ambient
+ *     credentials and no new shell-out: the activities are the ones
+ *     `describeResources` already runs. A root whose read fails reports every
+ *     resource it declares `read-failed`, naming the root, and is not sent — a
+ *     failed read must never render as an estate with nothing in it.
+ *  2. **Build.** `terraformBehaviourRequest`, pure, over the parsed documents.
+ *  3. **Screen.** `screenBehaviourRequest`, before any engine is asked. Live
+ *     props are exactly where a resolved connection string or a secret written
+ *     into a tag can appear, and the screen's key-name, value-shape,
+ *     URL-userinfo and walk-depth rules all apply to them. A refusal here is
+ *     the result.
+ *  4. **Ask, and account for the rest.** The engine-fronting lexicon answers
+ *     for what was sent. What was not sent — a resource the plan could not
+ *     read, one withheld by `owned`, every resource of a root whose read
+ *     failed — is merged into the report as `unpredicted` with its reason, so
+ *     every declared name still lands in one map or the other.
+ *
+ * A root that is not live is built from its declaration by the same producer,
+ * so a project mixing stock and live roots gets one request with both, and
+ * `sources` says which is which. With no live root at all this is the
+ * declared path, containment included.
+ *
+ * ## Both halves of the delta come out of here
+ *
+ * `from: "declared"` reads no account and builds every root from its file,
+ * including a root that is live. That is the other side of the delta the epic
+ * wants, and it is deliberately the same function rather than a second one:
+ * two reports that differ because one producer was handed different input are
+ * a statement about the estate, and two reports that differ because two
+ * producers disagree about how to assemble a graph are a statement about
+ * chant. `edgeCoverage.containmentEdges` is the field that made the
+ * difference concrete (#2360's third review comment) — it is built by the same
+ * catalog over the same reconstruction on both sides here, so a "one zone
+ * lost" verdict that differs between the two differs because the account
+ * differs.
+ */
+
+import {
+  behaviourReport,
+  isBehaviourRefusalReport,
+  screenBehaviourRequest,
+  type BehaviourResult,
+  type PredictBehaviourOptions,
+  type UnpredictedEntity,
+} from "@intentius/chant/behaviour";
+import { indexLivePlan, readLiveLs, type TerraformReadDeps } from "../describe-resources";
+import { RESOURCE_TYPE } from "../hcl/parse";
+import {
+  terraformBehaviourRequest,
+  type TerraformBehaviourEntity,
+  type TerraformLiveRead,
+} from "./request";
+
+/** The name this path screens and refuses under. */
+export const TERRAFORM = "terraform";
+
+/** What the live path needs beyond the request: the two reads, and an engine to ask. */
+export interface TerraformBehaviourDeps {
+  liveLs: TerraformReadDeps["liveLs"];
+  livePlan: TerraformReadDeps["livePlan"];
+  /**
+   * The lexicon in front of the engine. Its own `screenBehaviourRequest` runs
+   * again inside; that is harmless, and the one here is what makes "screened
+   * before any engine call" true of this path rather than of its callee.
+   */
+  predict: (options: PredictBehaviourOptions) => Promise<BehaviourResult>;
+}
+
+/**
+ * The contract's options, less the three fields this path produces rather than
+ * accepts, plus where to read from.
+ *
+ * `edges` and `edgeCoverage` are **not** inputs. They are what
+ * `./request.ts` computes — from the live reads on one side and from the
+ * declaration on the other — and a caller has no way to know either before
+ * this function has decided which roots it is reading. Asking for them and
+ * then discarding whatever arrived would be a signature that lies about what
+ * it uses, and the delta this path exists for depends on both sides' coverage
+ * being this producer's claim rather than a caller's.
+ *
+ * `entities` is widened to carry the terraform build's `references` beside
+ * `props`, which the builder needs and the contract's own entity shape has no
+ * room for.
+ */
+export interface TerraformPredictOptions
+  extends Omit<PredictBehaviourOptions, "entities" | "edges" | "edgeCoverage"> {
+  entities: ReadonlyMap<string, TerraformBehaviourEntity>;
+  /** Directory the activities start the `chant.config.*` search from. Default: the process cwd. */
+  cwd?: string;
+  /**
+   * Which estate to predict. `"live"`, the default, is this path's whole
+   * point: the account as it stands, drift included. `"declared"` runs the
+   * same producer over the declaration alone and reads no account, which is
+   * the other half of the delta the epic asks for (#2355) — a caller wanting
+   * that delta calls this twice and differences the two reports, and gets two
+   * reports assembled by one producer rather than two shapes that have each
+   * been through a different translation.
+   *
+   * `"declared"` on a project with no live root is the same request `"live"`
+   * builds, because there is no account to read; the option exists so that a
+   * caller can ask for the declaration of a root that *is* live.
+   */
+  from?: "live" | "declared";
+}
+
+/** Which roots the request would read live: those whose entities the parse stamped `mode: "live"`. */
+export function liveRootsOf(
+  entityNames: readonly string[],
+  entities: ReadonlyMap<string, TerraformBehaviourEntity>,
+): string[] {
+  const roots = new Set<string>();
+  for (const name of entityNames) {
+    const props = entities.get(name)?.props;
+    const root = typeof props?.root === "string" ? props.root : undefined;
+    if (root && props?.mode === "live") roots.add(root);
+  }
+  return [...roots].sort();
+}
+
+function readsAsCredentials(text: string): boolean {
+  return /\b(no valid credential|credentials?|not authorized|unauthorized|accessdenied|access denied|expiredtoken|invalidclienttokenid|signature)\b/i.test(
+    text,
+  );
+}
+
+/**
+ * Predict from the account for every live root, and from the declaration for
+ * every other, through the engine `deps.predict` fronts.
+ */
+export async function predictTerraformBehaviour(
+  options: TerraformPredictOptions,
+  deps: TerraformBehaviourDeps,
+): Promise<BehaviourResult> {
+  const { cwd, from: _from, ...contract } = options;
+  const where = cwd ? { cwd } : {};
+
+  const reads: TerraformLiveRead[] = [];
+  const failed = new Map<string, string>();
+  const roots = options.from === "declared" ? [] : liveRootsOf(options.entityNames, options.entities);
+  for (const root of roots) {
+    try {
+      const listed = await deps.liveLs({ root, consistent: true, ...where });
+      const planned = await deps.livePlan({ root, ...where });
+      reads.push({ root, listing: readLiveLs(listed.json), plan: indexLivePlan(planned.json) });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      failed.set(root, message);
+    }
+  }
+
+  // A root whose read failed contributes no node and every one of its
+  // resources as `read-failed`, naming the root: the tri-state's rule for a
+  // broken read, applied to a prediction.
+  const unpredicted: Record<string, UnpredictedEntity> = {};
+  const entityNames = options.entityNames.filter((name) => {
+    const entity = options.entities.get(name);
+    const root = typeof entity?.props.root === "string" ? entity.props.root : undefined;
+    if (!root || !failed.has(root)) return true;
+    if (entity?.entityType === RESOURCE_TYPE) {
+      const message = failed.get(root)!;
+      unpredicted[name] = {
+        type: RESOURCE_TYPE,
+        reason: "read-failed",
+        detail:
+          `terraform.roots.${root}: the live read failed, so the account was not predicted for this root` +
+          `${readsAsCredentials(message) ? " (the failure names credentials)" : ""}: ${message.split("\n")[0]}`,
+      };
+      return false;
+    }
+    return true;
+  });
+
+  const built = terraformBehaviourRequest({
+    environment: contract.environment,
+    buildOutput: contract.buildOutput,
+    traffic: contract.traffic,
+    ...(contract.region !== undefined ? { region: contract.region } : {}),
+    ...(contract.stack !== undefined ? { stack: contract.stack } : {}),
+    ...(contract.owned !== undefined ? { owned: contract.owned } : {}),
+    entityNames,
+    entities: options.entities,
+    live: reads,
+  });
+  Object.assign(unpredicted, built.unpredicted);
+
+  const unsafe = screenBehaviourRequest(TERRAFORM, built.request);
+  if (unsafe) return unsafe;
+
+  const result = await deps.predict(built.request);
+  if (isBehaviourRefusalReport(result)) return result;
+
+  const extra = Object.keys(unpredicted);
+  if (extra.length === 0) return result;
+  return behaviourReport(
+    {
+      entityNames: [...built.request.entityNames, ...extra],
+      traffic: result.meta.at.traffic,
+      edgeCoverage: result.meta.edgeCoverage,
+    },
+    {
+      engine: result.meta.engine,
+      version: result.meta.version,
+      ...(result.meta.total ? { total: result.meta.total } : {}),
+    },
+    result.entities,
+    { ...result.unpredicted, ...unpredicted },
+  );
+}