@intentius/chant-lexicon-terraform 0.75.1 → 0.76.0

package/dist/behaviour/index.d.ts

@@ -1,4 +1,4 @@
 export { blockAddressOf, edgeCoverageOf, regionOfArn, substituteReferences, terraformBehaviourRequest, type LiveResourceFacts, type LiveResourceStatus, type TerraformBehaviourEntity, type TerraformBehaviourRequest, type TerraformBehaviourRequestOptions, type TerraformLiveRead, } from "./request.js";
-export { liveRootsOf, predictTerraformBehaviour, TERRAFORM, type TerraformBehaviourDeps, type TerraformPredictOptions, } from "./predict.js";
+export { liveRootsOf, predictTerraformBehaviour, readTerraformDeclaration, TERRAFORM, terraformPredictOptionsFrom, type TerraformBehaviourDeps, type TerraformDeclarationReader, type TerraformPredictOptions, } from "./predict.js";
 export { CATALOGUED_KINDS, isUnresolvedKind, REFERENCES_NOTHING, TERRAFORM_REFERENCE_CATALOG, } from "./reference-catalog.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/behaviour/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/behaviour/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,cAAc,EACd,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,SAAS,EACT,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/behaviour/index.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,cAAc,EACd,cAAc,EACd,WAAW,EACX,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,WAAW,EACX,yBAAyB,EACzB,wBAAwB,EACxB,SAAS,EACT,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,GAC7B,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,qBAAqB,CAAC"}

package/dist/behaviour/predict.d.ts

@@ -88,25 +88,83 @@ export interface TerraformPredictOptions extends Omit<PredictBehaviourOptions, "
     /** Directory the activities start the `chant.config.*` search from. Default: the process cwd. */
     cwd?: string;
     /**
-     * Which estate to predict. `"live"`, the default, is this path's whole
-     * point: the account as it stands, drift included. `"declared"` runs the
-     * same producer over the declaration alone and reads no account, which is
-     * the other half of the delta the epic asks for (#2355) — a caller wanting
-     * that delta calls this twice and differences the two reports, and gets two
-     * reports assembled by one producer rather than two shapes that have each
-     * been through a different translation.
+     * Which estate to predict, as the contract's own `from` (#2494) and required
+     * for the same reason: a default is a guess about which estate somebody
+     * meant, and the report that comes back from a wrong guess is well-formed.
+     *
+     * `"live"` is this path's whole point: the account as it stands, drift
+     * included. `"declared"` runs the same producer over the declaration alone
+     * and reads no account, which is the other half of the delta the epic asks
+     * for (#2355) — a caller wanting that delta calls this twice and differences
+     * the two reports, and gets two reports assembled by one producer rather
+     * than two shapes that have each been through a different translation.
      *
      * `"declared"` on a project with no live root is the same request `"live"`
      * builds, because there is no account to read; the option exists so that a
      * caller can ask for the declaration of a root that *is* live.
      */
-    from?: "live" | "declared";
+    from: "live" | "declared";
 }
+/** Reads the project's declaration afresh. Injectable so a test parses nothing from disk. */
+export type TerraformDeclarationReader = (cwd?: string) => Promise<ReadonlyMap<string, TerraformBehaviourEntity>>;
+/**
+ * The build's own entities, read again from the project's config: what
+ * `buildRoots()` renders, with `mode`, `body` and `references` as the parse
+ * stamps them. The config is found the way `observeAmbient` and the
+ * activities find it, so `terraform.roots` means one thing to all of them.
+ */
+export declare const readTerraformDeclaration: TerraformDeclarationReader;
+/**
+ * Read the contract's options as this producer's (#2495): the plugin method's
+ * whole adaptation. Two things are missing from an entity by the time a graph
+ * has carried it here, and which one depends on the graph.
+ *
+ * ## A declared graph has lost its `references`
+ *
+ * `root` and `mode` need no work: they are on `props`, the graph projects
+ * `props` onto a node's `attrs` as they stand, and `behaviourRequestFromIr`
+ * hands `attrs` back as `props`. `references` are left off `attrs` on
+ * purpose, because an edge already says the same thing (`graph-ir.ts`'s
+ * `SKIP_KEYS`), and the contract's `edges` arrive in their place. An `IREdge`
+ * is an `EntityReference` plus the entity it leaves from, so grouping the
+ * edges by `from` gives every entity its references back, field for field.
+ * Without this a block whose body holds a `${…}` is counted as an unresolved
+ * kind on a graph that resolved it. An entity that still carries its own
+ * `references` keeps them: the edges are the copy.
+ *
+ * ## A live graph has lost the declaration
+ *
+ * `chant graph --live` hands over observed nodes: an address, a root, the
+ * provider's type, and no `mode`, no `body` and no edge. Read as they stand,
+ * no root is live, so the account is never read here; no block has a size,
+ * because `body.instance_type` went with the body; and containment is empty.
+ * The figures that come back are well-formed and differ from the declared
+ * side's for reasons that have nothing to do with the account, which is the
+ * delta this producer exists to keep honest.
+ *
+ * So under `from: "live"`, a root any of whose entities arrived with no
+ * `mode` is declared again from the project's own config, and the producer
+ * then reads the account itself, as it does for any other caller. The
+ * observed entities of that root are set aside, the undeclared ones
+ * included: an owned orphan is the live read's to list, under the key
+ * `observeAmbient` gave it, and one the account no longer holds is not in a
+ * prediction of the account.
+ *
+ * A root the config does not render is left as it arrived. That is a worse
+ * reading and the only one available.
+ *
+ * ## What stops here
+ *
+ * The caller's `edges` and `edgeCoverage`. Both are this producer's to
+ * compute, from whichever reads it ends up making (see
+ * {@link TerraformPredictOptions}).
+ */
+export declare function terraformPredictOptionsFrom(options: PredictBehaviourOptions, redeclare?: TerraformDeclarationReader): Promise<TerraformPredictOptions>;
 /** Which roots the request would read live: those whose entities the parse stamped `mode: "live"`. */
 export declare function liveRootsOf(entityNames: readonly string[], entities: ReadonlyMap<string, TerraformBehaviourEntity>): string[];
 /**
  * Predict from the account for every live root, and from the declaration for
  * every other, through the engine `deps.predict` fronts.
  */
-export declare function predictTerraformBehaviour(options: TerraformPredictOptions, deps: TerraformBehaviourDeps): Promise<BehaviourResult>;
+export declare function predictTerraformBehaviour(options: TerraformPredictOptions, deps?: TerraformBehaviourDeps): Promise<BehaviourResult>;
 //# sourceMappingURL=predict.d.ts.map

package/dist/behaviour/predict.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"predict.d.ts","sourceRoot":"","sources":["../../src/behaviour/predict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAE7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,WAAW,CAAC;AAEnB,oDAAoD;AACpD,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxC;;;;OAIG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;IAC5E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;CAC5B;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,GACtD,MAAM,EAAE,CAQV;AAQD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,eAAe,CAAC,CA2E1B"}
+{"version":3,"file":"predict.d.ts","sourceRoot":"","sources":["../../src/behaviour/predict.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAE7B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAA6B,KAAK,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAK1F,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,WAAW,CAAC;AAEnB,oDAAoD;AACpD,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACpC,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACxC;;;;OAIG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,UAAU,GAAG,OAAO,GAAG,cAAc,CAAC;IAC5E,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD,iGAAiG;IACjG,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;;;;;OAeG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAC;CAC3B;AAmBD,6FAA6F;AAC7F,MAAM,MAAM,0BAA0B,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC,CAAC;AAElH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,0BAyBtC,CAAC;AAKF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,uBAAuB,EAChC,SAAS,GAAE,0BAAqD,GAC/D,OAAO,CAAC,uBAAuB,CAAC,CA+ClC;AAED,sGAAsG;AACtG,wBAAgB,WAAW,CACzB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,GACtD,MAAM,EAAE,CAQV;AAQD;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,uBAAuB,EAChC,IAAI,GAAE,sBAAkC,GACvC,OAAO,CAAC,eAAe,CAAC,CA4E1B"}

package/dist/behaviour/request.d.ts

@@ -107,7 +107,7 @@ export interface LiveResourceFacts {
     /** The marker tags the listing read off an undeclared resource. */
     tags?: Record<string, string>;
 }
-export interface TerraformBehaviourRequestOptions extends Pick<PredictBehaviourOptions, "environment" | "buildOutput" | "traffic" | "region" | "stack" | "owned"> {
+export interface TerraformBehaviourRequestOptions extends Pick<PredictBehaviourOptions, "environment" | "buildOutput" | "traffic" | "from" | "region" | "stack" | "owned"> {
     entityNames: readonly string[];
     entities: ReadonlyMap<string, TerraformBehaviourEntity>;
     /**

package/dist/behaviour/request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/behaviour/request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAU,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAI/B;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACzC;AAED,qDAAqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gCACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IAC/G,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD;;;;OAIG;IACH,IAAI,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,iGAAiG;IACjG,OAAO,EAAE,uBAAuB,CAAC;IACjC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC;IAC7C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAQD,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3D;AAmCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,UAAU,EAAE,SAAS,eAAe,EAAE,EACtC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC7C,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB;AAgRD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,kBAAkB,CAAC,EACxE,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,qBAAqB,CASvB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CA6D9G"}
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../src/behaviour/request.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8DG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EAClB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,eAAe,EAAU,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAoB,KAAK,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACxF,OAAO,EAML,KAAK,aAAa,EAClB,KAAK,aAAa,EAEnB,MAAM,uBAAuB,CAAC;AAI/B;;;;;;;GAOG;AACH,MAAM,WAAW,wBAAwB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CACzC;AAED,qDAAqD;AACrD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,aAAa,CAAC;IACvB,IAAI,EAAE,aAAa,CAAC;CACrB;AAED,6CAA6C;AAC7C,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE9E;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,+FAA+F;IAC/F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,MAAM,WAAW,gCACf,SAAQ,IAAI,CAAC,uBAAuB,EAAE,aAAa,GAAG,aAAa,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IACxH,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD;;;;OAIG;IACH,IAAI,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,iGAAiG;IACjG,OAAO,EAAE,uBAAuB,CAAC;IACjC,qDAAqD;IACrD,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,CAAC;IAC7C;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAQD,6FAA6F;AAC7F,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3D;AAmCD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,UAAU,EAAE,SAAS,eAAe,EAAE,EACtC,SAAS,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC7C,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC1C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyBzB;AAgRD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,IAAI,CAAC,kBAAkB,EAAE,UAAU,GAAG,kBAAkB,CAAC,EACxE,eAAe,EAAE,SAAS,MAAM,EAAE,GACjC,qBAAqB,CASvB;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CA8D9G"}

package/dist/index.d.ts

@@ -12,5 +12,5 @@ export type { TerraformWatchOpConfig, TerraformWatchOpResources, TerraformFindin
 export { TerraformAdoptOp } from "./composites/terraform-adopt-op.js";
 export type { TerraformAdoptOpConfig, TerraformAdoptOpResources } from "./composites/terraform-adopt-op.js";
 export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership.js";
-export { predictTerraformBehaviour, terraformBehaviourRequest, TERRAFORM_REFERENCE_CATALOG, type TerraformBehaviourDeps, type TerraformBehaviourEntity, type TerraformBehaviourRequest, type TerraformBehaviourRequestOptions, type TerraformLiveRead, type TerraformPredictOptions, } from "./behaviour/index.js";
+export { predictTerraformBehaviour, terraformBehaviourRequest, terraformPredictOptionsFrom, TERRAFORM_REFERENCE_CATALOG, type TerraformBehaviourDeps, type TerraformBehaviourEntity, type TerraformBehaviourRequest, type TerraformBehaviourRequestOptions, type TerraformLiveRead, type TerraformPredictOptions, } from "./behaviour/index.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAKzG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAOnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAKnD,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,GAC9B,MAAM,UAAU,CAAC;AAIlB,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,SAAS,EACT,qBAAqB,EACrB,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,wBAAwB,GAC9B,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,oBAAoB,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAK9E,OAAO,EACL,aAAa,EACb,aAAa,EACb,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AAKvB,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,aAAa,GACnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EACV,sBAAsB,EACtB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AAIzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,YAAY,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAKzG,OAAO,EAAE,8BAA8B,EAAE,MAAM,mBAAmB,CAAC;AAQnE,OAAO,EACL,yBAAyB,EACzB,yBAAyB,EACzB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,gCAAgC,EACrC,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,GAC7B,MAAM,aAAa,CAAC"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "cc5a818475d7fe292bbd9e6e9380a3fa6c9ffaede3d8d82d49c326470d1b00d5",
+    "manifest.json": "44cab69b3c02baa1d70326bb19709c04bd2f46ae14f50910edd223a3e57c4965",
     "meta.json": "ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356",
     "types/index.d.ts": "022927e6a7b351cc4cf52d5f973f60ccd140e5810e17b32fb8868965aa1db161",
     "rules/plan-before-apply.ts": "31b1b3176799fd365b2583fe3947edd187c2a863e3dc0094ed9e91ece2464c99",
@@ -38,5 +38,5 @@
     "rules/tf029.ts": "52e02b4921a64f3f928836896b8b80682400adb50bd7a0645f3fe2e8819433c2",
     "skills/chant-terraform.md": "d9ca7b7c28aed0038ce775a3491150298492eed2858fd3651ed9bfca0e577ae8"
   },
-  "composite": "f9006e840a25a031715acc7c1588425e93d2a76dd5cbf4703cea4d5fce2eef00"
+  "composite": "afae4e4b1c71fef38af254f5566aba669d275f61de38544d8bf27fa6294721cd"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "terraform",
-  "version": "0.75.1",
+  "version": "0.76.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Terraform"
 }

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAgElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAmP7B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAgElF;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,aAgQ7B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-terraform",
-  "version": "0.75.1",
+  "version": "0.76.0",
   "type": "module",
   "files": [
     "src/",
@@ -56,7 +56,7 @@
   },
   "peerDependencies": {
     "zod": "^4.3.6",
-    "@intentius/chant": "^0.75.1",
+    "@intentius/chant": "^0.76.0",
     "typescript": "^5.9.3"
   },
   "description": "terraform lexicon for chant, existing Terraform root modules as declarable entities",

package/src/behaviour/index.ts

@@ -17,8 +17,11 @@ export {
 export {
   liveRootsOf,
   predictTerraformBehaviour,
+  readTerraformDeclaration,
   TERRAFORM,
+  terraformPredictOptionsFrom,
   type TerraformBehaviourDeps,
+  type TerraformDeclarationReader,
   type TerraformPredictOptions,
 } from "./predict";
 export {

package/src/behaviour/predict.test.ts

@@ -33,10 +33,12 @@ import {
   type PredictedBehaviour,
   type UnpredictedEntity,
 } from "@intentius/chant/behaviour";
+import { behaviourRequestFromIr } from "@intentius/chant/behaviour-graph";
 import type { Declarable } from "@intentius/chant/declarable";
+import { buildGraphIr } from "@intentius/chant/graph-ir";
 import type { TerraformReadDeps } from "../describe-resources";
 import { renderTerraformRoots } from "../hcl/roots";
-import { liveRootsOf, predictTerraformBehaviour, TERRAFORM } from "./predict";
+import { liveRootsOf, predictTerraformBehaviour, TERRAFORM, terraformPredictOptionsFrom } from "./predict";
 import type { TerraformBehaviourEntity } from "./request";
 
 const fixtures = join(dirname(fileURLToPath(import.meta.url)), "..", "__fixtures__");
@@ -49,6 +51,8 @@ const key = (address: string): string => `${ROOT}/${address}`;
 
 let entities: Map<string, TerraformBehaviourEntity>;
 let entityNames: string[];
+/** The build's own entities, as `chant graph` is handed them. */
+let built: Map<string, Declarable>;
 
 beforeAll(async () => {
   const rendered = await renderTerraformRoots({
@@ -56,6 +60,7 @@ beforeAll(async () => {
     roots: { [ROOT]: { dir: "./live-estate" } },
     binary: "choudoufu",
   });
+  built = rendered.entities;
   entities = new Map();
   for (const [name, entity] of rendered.entities) {
     const e = entity as Declarable & { props: Record<string, unknown>; references?: readonly never[] };
@@ -183,7 +188,7 @@ async function predict(
 ): Promise<{ result: BehaviourResult; calls: Call[] }> {
   const d = deps(overrides?.deps);
   const result = await predictTerraformBehaviour(
-    { ...common, entityNames, entities, ...(overrides?.owned ? { owned: true } : {}) },
+    { ...common, from: "live", entityNames, entities, ...(overrides?.owned ? { owned: true } : {}) },
     { liveLs: d.deps.liveLs, livePlan: d.deps.livePlan, predict: tariff },
   );
   return { result, calls: d.calls };
@@ -325,7 +330,7 @@ describe("the screen runs before the engine", () => {
     });
     const d = deps();
     const result = await predictTerraformBehaviour(
-      { ...common, entityNames, entities: tainted },
+      { ...common, from: "live", entityNames, entities: tainted },
       {
         liveLs: d.deps.liveLs,
         livePlan: d.deps.livePlan,
@@ -378,4 +383,167 @@ describe("the delta the epic asks for", () => {
     // not computed over a graph the other side does not have.
     expect(live.meta.edgeCoverage.verdict).toBe(declared.meta.edgeCoverage.verdict);
   });
+
+  it("tells the engine which estate each side is about (#2494)", async () => {
+    const asked: Array<PredictBehaviourOptions["from"]> = [];
+    const listening = async (options: PredictBehaviourOptions): Promise<BehaviourResult> => {
+      asked.push(options.from);
+      return tariff(options);
+    };
+    const d = deps();
+    for (const from of ["live", "declared"] as const) {
+      await predictTerraformBehaviour(
+        { ...common, from, entityNames, entities },
+        { liveLs: d.deps.liveLs, livePlan: d.deps.livePlan, predict: listening },
+      );
+    }
+    expect(asked).toEqual(["live", "declared"]);
+  });
+});
+
+describe("the contract's options, read as this producer's (#2495)", () => {
+  /** What `chant graph --traffic` hands a plugin: the graph reshaped, references left behind on the edges. */
+  const throughTheGraph = (from: "live" | "declared"): PredictBehaviourOptions =>
+    behaviourRequestFromIr(buildGraphIr(built, fixtures), {
+      ...common,
+      from,
+      edgeCoverage: { verdict: "unknown" },
+    });
+
+  /** Run the producer and keep the request the engine was sent. */
+  async function sent(options: Parameters<typeof predictTerraformBehaviour>[0]): Promise<PredictBehaviourOptions> {
+    let request: PredictBehaviourOptions | undefined;
+    const d = deps();
+    await predictTerraformBehaviour(options, {
+      liveLs: d.deps.liveLs,
+      livePlan: d.deps.livePlan,
+      predict: async (o) => {
+        request = o;
+        return tariff(o);
+      },
+    });
+    if (!request) throw new Error("the engine was never asked");
+    return request;
+  }
+
+  /** A reader that must not be reached: nothing on the declared side, or on a live side that kept its `mode`, reads the project again. */
+  const neverRedeclared = async (): Promise<never> => {
+    throw new Error("the declaration was read again");
+  };
+
+  it("the graph drops every reference, and the edges give each one back", async () => {
+    const graphed = throughTheGraph("declared");
+    const referencing = [...entities].filter(([, e]) => (e.references ?? []).length > 0);
+    expect(referencing.length).toBeGreaterThan(0);
+    for (const [name] of referencing) {
+      expect(Object.prototype.hasOwnProperty.call(graphed.entities.get(name), "references"), name).toBe(false);
+    }
+    const read = await terraformPredictOptionsFrom(graphed, neverRedeclared);
+    for (const [name, entity] of referencing) {
+      expect(read.entities.get(name)?.references, name).toEqual(entity.references);
+    }
+  });
+
+  it.each(["live", "declared"] as const)("sends the engine the %s request the build's own entities would have", async (from) => {
+    const direct = await sent({ ...common, from, entityNames, entities });
+    const graphed = await sent(await terraformPredictOptionsFrom(throughTheGraph(from), neverRedeclared));
+    expect(graphed.edges).toEqual(direct.edges);
+    expect(graphed.edgeCoverage).toEqual(direct.edgeCoverage);
+    expect(graphed.entityNames).toEqual(direct.entityNames);
+    expect(graphed.from).toBe(from);
+  });
+
+  it("keeps the references an entity still carries over the edges' copy", async () => {
+    const [name, entity] = [...entities].find(([, e]) => (e.references ?? []).length > 0)!;
+    const read = await terraformPredictOptionsFrom({
+      ...common,
+      from: "declared",
+      entityNames,
+      entities: entities as PredictBehaviourOptions["entities"],
+      edges: [{ from: name, to: "somewhere/else", kind: "ref" }],
+      edgeCoverage: { verdict: "unknown" },
+    }, neverRedeclared);
+    expect(read.entities.get(name)?.references).toEqual(entity.references);
+  });
+
+  it("does not pass the caller's edges or coverage claim on", async () => {
+    const read = (await terraformPredictOptionsFrom(throughTheGraph("declared"), neverRedeclared)) as unknown as Record<
+      string,
+      unknown
+    >;
+    expect(Object.prototype.hasOwnProperty.call(read, "edges")).toBe(false);
+    expect(Object.prototype.hasOwnProperty.call(read, "edgeCoverage")).toBe(false);
+  });
+
+  /**
+   * What `chant graph --live` hands over: observed nodes. An address, a root
+   * and the provider's type; no `mode`, no `body`, no edge. Plus one the
+   * account holds that nothing declares.
+   */
+  const ORPHAN = key("aws_sqs_queue.nobody_declared");
+  function throughTheLiveGraph(): PredictBehaviourOptions {
+    const observed = new Map<string, { entityType: string; props: Record<string, unknown> }>();
+    for (const [name, entity] of entities) {
+      if (entity.entityType !== "Terraform::Resource") continue;
+      const address = String(entity.props.address);
+      observed.set(name, {
+        entityType: entity.entityType,
+        props: { address, root: ROOT, estate: ESTATE, resourceType: address.slice(0, address.indexOf(".")) },
+      });
+    }
+    observed.set(ORPHAN, {
+      entityType: "Terraform::Resource",
+      props: { address: "aws_sqs_queue.nobody_declared", root: ROOT, estate: ESTATE, resourceType: "aws_sqs_queue" },
+    });
+    return {
+      ...common,
+      from: "live",
+      entityNames: [...observed.keys()],
+      entities: observed,
+      edges: [],
+      edgeCoverage: { verdict: "unknown" },
+    };
+  }
+
+  it("declares a live graph's root again, so the account is read and the engine is sent what the build would send", async () => {
+    const direct = await sent({ ...common, from: "live", entityNames, entities });
+    const graphed = await sent(await terraformPredictOptionsFrom(throughTheLiveGraph(), async () => entities));
+    expect(graphed.entityNames).toEqual(direct.entityNames);
+    expect(graphed.edges).toEqual(direct.edges);
+    expect(graphed.edgeCoverage).toEqual(direct.edgeCoverage);
+    for (const name of direct.entityNames) {
+      expect(graphed.entities.get(name)?.props, name).toEqual(direct.entities.get(name)?.props);
+    }
+  });
+
+  it("read as it arrived, the same live graph reads no account at all", async () => {
+    // The hole the test above closes, pinned so it cannot close by accident:
+    // no observed entity says `mode: "live"`, so no root is live.
+    const asArrived = throughTheLiveGraph();
+    expect(liveRootsOf(asArrived.entityNames, asArrived.entities)).toEqual([]);
+    const read = await terraformPredictOptionsFrom(asArrived, async () => entities);
+    expect(liveRootsOf(read.entityNames, read.entities)).toEqual([ROOT]);
+  });
+
+  it("sets an observed orphan aside for the live read to list", async () => {
+    const read = await terraformPredictOptionsFrom(throughTheLiveGraph(), async () => entities);
+    expect(read.entityNames).not.toContain(ORPHAN);
+    expect(read.entities.has(ORPHAN)).toBe(false);
+    expect([...read.entityNames].sort()).toEqual(entityNames);
+  });
+
+  it("leaves a root the config does not render as it arrived", async () => {
+    const asArrived = throughTheLiveGraph();
+    const read = await terraformPredictOptionsFrom(asArrived, async () => new Map());
+    expect(read.entityNames).toEqual(asArrived.entityNames);
+    expect(read.entities.get(ORPHAN)).toEqual(asArrived.entities.get(ORPHAN));
+  });
+
+  it("reads the declaration again only for a live graph", async () => {
+    const declaredSide = { ...throughTheLiveGraph(), from: "declared" as const };
+    await expect(terraformPredictOptionsFrom(declaredSide, neverRedeclared)).resolves.toBeDefined();
+    await expect(terraformPredictOptionsFrom(throughTheLiveGraph(), neverRedeclared)).rejects.toThrow(
+      "the declaration was read again",
+    );
+  });
 });

package/src/behaviour/predict.ts

@@ -60,8 +60,13 @@ import {
   type PredictBehaviourOptions,
   type UnpredictedEntity,
 } from "@intentius/chant/behaviour";
+import { createBehaviourPredict } from "@intentius/chant/behaviour-predict";
+import type { EntityReference } from "@intentius/chant/graph-ir";
 import { indexLivePlan, readLiveLs, type TerraformReadDeps } from "../describe-resources";
+import type { TerraformConfig } from "../config";
 import { RESOURCE_TYPE } from "../hcl/parse";
+import { choudoufuLiveLs, choudoufuLivePlan } from "../op/activities/terraform";
+import { terraformBehaviourKinds } from "./kinds";
 import {
   terraformBehaviourRequest,
   type TerraformBehaviourEntity,
@@ -105,19 +110,175 @@ export interface TerraformPredictOptions
   /** Directory the activities start the `chant.config.*` search from. Default: the process cwd. */
   cwd?: string;
   /**
-   * Which estate to predict. `"live"`, the default, is this path's whole
-   * point: the account as it stands, drift included. `"declared"` runs the
-   * same producer over the declaration alone and reads no account, which is
-   * the other half of the delta the epic asks for (#2355) — a caller wanting
-   * that delta calls this twice and differences the two reports, and gets two
-   * reports assembled by one producer rather than two shapes that have each
-   * been through a different translation.
+   * Which estate to predict, as the contract's own `from` (#2494) and required
+   * for the same reason: a default is a guess about which estate somebody
+   * meant, and the report that comes back from a wrong guess is well-formed.
+   *
+   * `"live"` is this path's whole point: the account as it stands, drift
+   * included. `"declared"` runs the same producer over the declaration alone
+   * and reads no account, which is the other half of the delta the epic asks
+   * for (#2355) — a caller wanting that delta calls this twice and differences
+   * the two reports, and gets two reports assembled by one producer rather
+   * than two shapes that have each been through a different translation.
    *
    * `"declared"` on a project with no live root is the same request `"live"`
    * builds, because there is no account to read; the option exists so that a
    * caller can ask for the declaration of a root that *is* live.
    */
-  from?: "live" | "declared";
+  from: "live" | "declared";
+}
+
+/**
+ * What the plugin method runs with, where a caller injects nothing (#2495).
+ *
+ * The two reads are the activities `describeResources` already drives. The
+ * engine front is core's, handed this lexicon's coverage rows and no other's:
+ * a plugin method takes options alone and cannot see which other lexicons the
+ * project configured, and every name this producer sends is a terraform block
+ * or a name it passed through untouched. A passed-through name of another
+ * lexicon's type comes back `unknown-type`, which is true of what this path
+ * knows about it.
+ */
+const REAL_DEPS: TerraformBehaviourDeps = {
+  liveLs: choudoufuLiveLs,
+  livePlan: choudoufuLivePlan,
+  predict: createBehaviourPredict({ kinds: [terraformBehaviourKinds] }),
+};
+
+/** Reads the project's declaration afresh. Injectable so a test parses nothing from disk. */
+export type TerraformDeclarationReader = (cwd?: string) => Promise<ReadonlyMap<string, TerraformBehaviourEntity>>;
+
+/**
+ * The build's own entities, read again from the project's config: what
+ * `buildRoots()` renders, with `mode`, `body` and `references` as the parse
+ * stamps them. The config is found the way `observeAmbient` and the
+ * activities find it, so `terraform.roots` means one thing to all of them.
+ */
+export const readTerraformDeclaration: TerraformDeclarationReader = async (cwd) => {
+  const { loadChantConfigUpward } = await import("@intentius/chant/config");
+  const { renderTerraformRoots } = await import("../hcl/roots");
+  const { dirname, resolve } = await import("node:path");
+
+  const start = resolve(cwd ?? process.cwd());
+  const { config, configPath } = await loadChantConfigUpward(start);
+  const namespace = (config as { terraform?: TerraformConfig }).terraform;
+  const entities = new Map<string, TerraformBehaviourEntity>();
+  if (!namespace?.roots || Object.keys(namespace.roots).length === 0) return entities;
+  const rendered = await renderTerraformRoots({
+    projectRoot: configPath ? dirname(configPath) : start,
+    roots: namespace.roots,
+    binary: namespace.binary,
+    callModuleType: namespace.callModuleType,
+  });
+  for (const [name, entity] of rendered.entities) {
+    const e = entity as unknown as TerraformBehaviourEntity;
+    entities.set(name, {
+      entityType: e.entityType,
+      props: e.props ?? {},
+      ...(Array.isArray(e.references) ? { references: e.references } : {}),
+    });
+  }
+  return entities;
+};
+
+const rootOf = (entity: TerraformBehaviourEntity | undefined): string | undefined =>
+  typeof entity?.props.root === "string" ? entity.props.root : undefined;
+
+/**
+ * Read the contract's options as this producer's (#2495): the plugin method's
+ * whole adaptation. Two things are missing from an entity by the time a graph
+ * has carried it here, and which one depends on the graph.
+ *
+ * ## A declared graph has lost its `references`
+ *
+ * `root` and `mode` need no work: they are on `props`, the graph projects
+ * `props` onto a node's `attrs` as they stand, and `behaviourRequestFromIr`
+ * hands `attrs` back as `props`. `references` are left off `attrs` on
+ * purpose, because an edge already says the same thing (`graph-ir.ts`'s
+ * `SKIP_KEYS`), and the contract's `edges` arrive in their place. An `IREdge`
+ * is an `EntityReference` plus the entity it leaves from, so grouping the
+ * edges by `from` gives every entity its references back, field for field.
+ * Without this a block whose body holds a `${…}` is counted as an unresolved
+ * kind on a graph that resolved it. An entity that still carries its own
+ * `references` keeps them: the edges are the copy.
+ *
+ * ## A live graph has lost the declaration
+ *
+ * `chant graph --live` hands over observed nodes: an address, a root, the
+ * provider's type, and no `mode`, no `body` and no edge. Read as they stand,
+ * no root is live, so the account is never read here; no block has a size,
+ * because `body.instance_type` went with the body; and containment is empty.
+ * The figures that come back are well-formed and differ from the declared
+ * side's for reasons that have nothing to do with the account, which is the
+ * delta this producer exists to keep honest.
+ *
+ * So under `from: "live"`, a root any of whose entities arrived with no
+ * `mode` is declared again from the project's own config, and the producer
+ * then reads the account itself, as it does for any other caller. The
+ * observed entities of that root are set aside, the undeclared ones
+ * included: an owned orphan is the live read's to list, under the key
+ * `observeAmbient` gave it, and one the account no longer holds is not in a
+ * prediction of the account.
+ *
+ * A root the config does not render is left as it arrived. That is a worse
+ * reading and the only one available.
+ *
+ * ## What stops here
+ *
+ * The caller's `edges` and `edgeCoverage`. Both are this producer's to
+ * compute, from whichever reads it ends up making (see
+ * {@link TerraformPredictOptions}).
+ */
+export async function terraformPredictOptionsFrom(
+  options: PredictBehaviourOptions,
+  redeclare: TerraformDeclarationReader = readTerraformDeclaration,
+): Promise<TerraformPredictOptions> {
+  const { entities: given, edges, edgeCoverage: _edgeCoverage, ...rest } = options;
+  const leaving = new Map<string, EntityReference[]>();
+  for (const edge of edges ?? []) {
+    if (edge.kind !== "ref") continue;
+    const reference: EntityReference = {
+      to: edge.to,
+      ...(edge.viaAttr !== undefined ? { viaAttr: edge.viaAttr } : {}),
+      ...(edge.toAttr !== undefined ? { toAttr: edge.toAttr } : {}),
+    };
+    (leaving.get(edge.from) ?? leaving.set(edge.from, []).get(edge.from)!).push(reference);
+  }
+  const entities = new Map<string, TerraformBehaviourEntity>();
+  for (const [name, entity] of given) {
+    const own = (entity as TerraformBehaviourEntity).references;
+    const references = Array.isArray(own) ? own : leaving.get(name);
+    entities.set(name, references === undefined ? entity : { ...entity, references });
+  }
+  if (options.from !== "live") return { ...rest, entities };
+
+  const observed = new Set<string>();
+  for (const name of options.entityNames) {
+    const entity = entities.get(name);
+    const root = rootOf(entity);
+    if (root !== undefined && entity?.props.mode === undefined) observed.add(root);
+  }
+  if (observed.size === 0) return { ...rest, entities };
+
+  const declared = new Map<string, Map<string, TerraformBehaviourEntity>>();
+  for (const [name, entity] of await redeclare()) {
+    const root = rootOf(entity);
+    if (root === undefined || !observed.has(root)) continue;
+    (declared.get(root) ?? declared.set(root, new Map()).get(root)!).set(name, entity);
+  }
+  const entityNames = options.entityNames.filter((name) => {
+    const root = rootOf(entities.get(name));
+    if (root === undefined || !declared.has(root)) return true;
+    entities.delete(name);
+    return false;
+  });
+  for (const again of declared.values()) {
+    for (const [name, entity] of again) {
+      entities.set(name, entity);
+      entityNames.push(name);
+    }
+  }
+  return { ...rest, entityNames, entities };
 }
 
 /** Which roots the request would read live: those whose entities the parse stamped `mode: "live"`. */
@@ -146,7 +307,7 @@ function readsAsCredentials(text: string): boolean {
  */
 export async function predictTerraformBehaviour(
   options: TerraformPredictOptions,
-  deps: TerraformBehaviourDeps,
+  deps: TerraformBehaviourDeps = REAL_DEPS,
 ): Promise<BehaviourResult> {
   const { cwd, from: _from, ...contract } = options;
   const where = cwd ? { cwd } : {};
@@ -191,6 +352,7 @@ export async function predictTerraformBehaviour(
     environment: contract.environment,
     buildOutput: contract.buildOutput,
     traffic: contract.traffic,
+    from: options.from,
     ...(contract.region !== undefined ? { region: contract.region } : {}),
     ...(contract.stack !== undefined ? { stack: contract.stack } : {}),
     ...(contract.owned !== undefined ? { owned: contract.owned } : {}),

package/src/behaviour/request.test.ts

@@ -65,11 +65,12 @@ beforeAll(async () => {
 const common = { environment: "prod", buildOutput: "/tmp/build", traffic: "100 rps, p50" };
 
 const declaredSide = (): TerraformBehaviourRequest =>
-  terraformBehaviourRequest({ ...common, entityNames, entities });
+  terraformBehaviourRequest({ ...common, from: "declared", entityNames, entities });
 
 const liveSide = (): TerraformBehaviourRequest =>
   terraformBehaviourRequest({
     ...common,
+    from: "live",
     entityNames,
     entities,
     live: [{ root: ROOT, listing: LISTING, plan: PLAN }],
@@ -79,6 +80,11 @@ const factsOf = (built: TerraformBehaviourRequest, address: string): LiveResourc
   (built.request.entities.get(key(address))!.props as { live: LiveResourceFacts }).live;
 
 describe("the declared side", () => {
+  it("says which estate the request is about, on both sides (#2494)", () => {
+    expect(declaredSide().request.from).toBe("declared");
+    expect(liveSide().request.from).toBe("live");
+  });
+
   it("builds every declared block, from the file and nothing else", () => {
     const built = declaredSide();
     expect(built.request.entityNames).toEqual(entityNames);
@@ -179,6 +185,7 @@ describe("the live side", () => {
   it("withholds what is not this estate's when --owned was asked for", () => {
     const built = terraformBehaviourRequest({
       ...common,
+      from: "live",
       entityNames,
       entities,
       owned: true,

package/src/behaviour/request.ts

@@ -129,7 +129,7 @@ export interface LiveResourceFacts {
 }
 
 export interface TerraformBehaviourRequestOptions
-  extends Pick<PredictBehaviourOptions, "environment" | "buildOutput" | "traffic" | "region" | "stack" | "owned"> {
+  extends Pick<PredictBehaviourOptions, "environment" | "buildOutput" | "traffic" | "from" | "region" | "stack" | "owned"> {
   entityNames: readonly string[];
   entities: ReadonlyMap<string, TerraformBehaviourEntity>;
   /**
@@ -613,6 +613,7 @@ export function terraformBehaviourRequest(options: TerraformBehaviourRequestOpti
     ...(options.stack !== undefined ? { stack: options.stack } : {}),
     ...(options.region !== undefined ? { region: options.region } : {}),
     ...(options.owned !== undefined ? { owned: options.owned } : {}),
+    from: options.from,
     traffic: options.traffic,
     edges: reconstructed.edges,
     edgeCoverage: edgeCoverageOf(reconstructed, [...unresolved]),

package/src/index.ts

@@ -99,10 +99,12 @@ export { TERRAFORM_STATE_OWNERSHIP_KEYS } from "./state-ownership";
 // path for a choudoufu root, reading `live-ls -json` and `live-plan -json`
 // through the same activities `describeResources` runs, and the same producer
 // over the declaration so the two sides of the delta are built alike. The
-// engine is injected: this lexicon dials none.
+// engine is injected, and defaults to core's front (#2495): this lexicon
+// dials none.
 export {
   predictTerraformBehaviour,
   terraformBehaviourRequest,
+  terraformPredictOptionsFrom,
   TERRAFORM_REFERENCE_CATALOG,
   type TerraformBehaviourDeps,
   type TerraformBehaviourEntity,

package/src/plugin.test.ts

@@ -1,6 +1,7 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { behaviourEngineVariables, isBehaviourRefusalReport } from "@intentius/chant/behaviour";
 import { isLexiconPlugin } from "@intentius/chant/lexicon";
 import { validateLexiconConfig } from "@intentius/chant/lexicon-config";
 import type { ChantConfig } from "@intentius/chant/config";
@@ -79,6 +80,27 @@ describe("terraform plugin", () => {
   });
 });
 
+describe("predictBehaviour on the plugin (#2495)", () => {
+  afterEach(() => vi.unstubAllEnvs());
+
+  it("reaches core's engine front with nothing injected, and refuses by name when no engine is set", async () => {
+    for (const name of behaviourEngineVariables("chant")) vi.stubEnv(name, "");
+    const result = await terraformPlugin.predictBehaviour!({
+      environment: "prod",
+      buildOutput: "",
+      from: "declared",
+      traffic: "100 rps, p50",
+      entityNames: ["net/aws_vpc.main"],
+      entities: new Map([
+        ["net/aws_vpc.main", { entityType: "Terraform::Resource", props: { root: "net", address: "aws_vpc.main", body: {} } }],
+      ]),
+      edges: [],
+      edgeCoverage: { verdict: "unknown" },
+    });
+    expect(isBehaviourRefusalReport(result) && result.refusal.cause).toBe("no-engine");
+  });
+});
+
 describe("terraform config schema", () => {
   it("accepts a root with every optional field", () => {
     const parsed = terraformConfigSchema.parse({

package/src/plugin.ts

@@ -135,6 +135,19 @@ export const terraformPlugin: LexiconPlugin = {
     return describeResources(options);
   },
 
+  /**
+   * The prediction, for whichever estate `options.from` names (#2495). The
+   * producer is `predictTerraformBehaviour` and this is its second caller, not
+   * a second producer: the contract's options are read as its own and handed
+   * over, and it runs with the real reads and core's engine front. What that
+   * reading has to put back, for a declared graph and for a live one, is on
+   * `terraformPredictOptionsFrom`.
+   */
+  async predictBehaviour(options) {
+    const { predictTerraformBehaviour, terraformPredictOptionsFrom } = await import("./behaviour");
+    return predictTerraformBehaviour(await terraformPredictOptionsFrom(options));
+  },
+
   /**
    * The kinds a live root can enumerate beyond its declaration (#1278,
    * #2104). Empty on a project with no live root, because `live-ls` is the